Shipping container purchase scams: how they work, what to check, which sites have been reported

You find the listing on a marketplace or a classified ads site. The price is well below market, availability is immediate. The seller replies fast, is friendly, and knows the subject. He asks for a deposit or the full amount before any delivery, by bank transfer. The transfer leaves. The seller stops replying.

The Australian public body WA ScamNet describes exactly this path: victims who responded to listings for containers on online classified sites, and were asked to pay by bank transfer.

Documented ground: Facebook Marketplace and Gumtree for containers specifically, in the United Kingdom as in Australia; Leboncoin in France, according to industry sources. We have no source documenting this set-up on Marktplaats, Milanuncios, Subito or Kleinanzeigen for this precise product: so we will not claim it.

This is the best-documented mechanism, and the most important one to understand, because it defuses the very check you believe is sufficient.

The fraudster does not invent a company: he copies a real one. He takes its name, its address, its registration number, sometimes its visual identity. The alert published on 29 June 2023 by Cornwall Council Trading Standards is explicit: the invoice received carries the name of a legitimate container company, and its details « may even appear to be registered at Companies House ». A British alert relayed by the logistics press describes fraudsters using a real seller's visual identity, photos of its staff, its logos and fake email addresses, to produce invoices that « at first glance look legitimate ».

You check. The number exists. You pay.

What to take away: only the IBAN and the contact address were substituted. The company named is itself a victim. A number that exists is not proof — the name, the address and the business activity must match, and you must call the seller back on a number found elsewhere.

This is what sets container fraud apart from parcel fraud. Once the first transfer has been cashed, the fraudster does not disappear. He calls back.

WA ScamNet describes fraudsters demanding extra funds over « delivery » problems, or requiring « customs » or « insurance » fees. The Australian press has documented a case where a buyer, after paying 4,500 Australian dollars for a container that was never delivered, received an email demanding a further 5,000 dollars for « refundable insurance » before delivery. An American seller describes the same pattern on the logistics side: you have paid, delivery is confirmed, and unexpected charges appear — road permits, crane hire, special equipment, area surcharges.

The mechanism is simple: having already paid, refusing the second instalment means writing off the first.

The test that kills this scenario in Europe: between EU countries, French customs point out that you carry out most of your trade « freely, without formalities and without border controls », with no customs declaration. A container bought in Rotterdam, Antwerp, Hamburg or Valencia and delivered to France generates neither customs duties nor clearance. (Do not confuse the two: this does not remove VAT obligations, which exist separately.)

Official French markers, useful to hold up: customs contact you only by registered letter with acknowledgement of receipt; they will never contact you by SMS, email or telephone to demand payment of a customs duty or to release goods against payment; their email addresses always end in @douane.finances.gouv.fr; and their only official site is douane.gouv.fr.

From the second or third message, the seller suggests continuing elsewhere: WhatsApp, Telegram, Signal, SMS. Cybermalveillance.gouv.fr says it literally: be wary of over-hasty invitations to continue the exchange off the platform, all the more so on instant messaging apps. A French industry professional makes the same observation for containers: contact preferred over encrypted messaging, a Gmail or Hotmail address rather than a company domain.

The German consumer association gives the opposite instruction, more directly usable: pay and communicate exclusively through the portal, use no external link, QR code or site.

The intended effect: the platform loses the trace of the negotiation, and therefore the evidence and the moderation. And bank details sent over a messaging app can be deleted.

The payment method demanded is the single best indicator, and every source converges.

Cybermalveillance.gouv.fr recommends refusing so-called « alternative » payment methods, often used in the context of fraud, and names them: PCS, Transcash, Neosurf, Moneygram, Mandat Cash, Western Union, Taptap Send. A French industry professional describes transfers « to the account of a third party that often has nothing to do with the company », or to « an account opened at an online bank under a false name using a stolen identity document ». The Spanish consumer association ASUFIN mentions Bizum and PayPal in « friends and family » mode. A German professional adds cryptocurrency and transfers to private accounts.

What they have in common: none of these channels allows the funds to be recalled.

A variant where the fraud plays out on the logistics side. The seller imposes his haulier; or you receive a message from a transport company you have never heard of, demanding delivery charges.

Cybermalveillance.gouv.fr covers both stages in so many words: be wary of parties who insist on imposing a specific delivery company; and refuse proposals to pay for the transaction directly to a delivery company — « it will always be a fraud ».

On the transport document itself, the North American freight association NMFTA lists the markers of forgery: different fonts from one field to the next (carrier, consignee, address, weight), cropped logos, blurred text, irregular margins, missing or overwritten seal numbers. And the rule that goes with it: verify the haulier's details against an authoritative source, and call that number, not the one printed on the document.

The hardest set-up to spot, because everything is genuine except one line. The company on the other side exists, the order is real, the previous exchanges were the real ones. Then, just before the balance is due, an email announces a change of bank details.

Cybermalveillance.gouv.fr defines this pattern precisely — impersonating a creditor with whom the victim is in a relationship in order to make them transfer to an account held by the fraudster — and gives its frequent origin: « this type of fraud often follows the compromise of an email account ».

An associated sign: a lookalike email address, differing from the real one only by a hyphen, an underscore, a letter or an extension.

Absolute rule: a change of bank details announced by email is treated as fraudulent by default, and is confirmed by telephone on a number you already knew, never on the one in the new message.

Fraud without disappearance. A seller advertises « cargo worthy » containers at a competitive price, shows photos of immaculate units, and cashes in. On arrival, the container is in fact « wind and water tight », or worse. An American seller describes precisely this pattern.

You have no leverage left once the unit has been set down: sending it back costs the price of a second haul.

Practical consequence: require, before payment, that the quote states in black and white the standardised condition (new, one-trip, cargo worthy, wind & water tight), the year, the dimensions, the container number, the depot address, the transport price included and the unloading arrangements. A quote that says « good condition » and leaves transport « to be confirmed » sets up mechanisms 3 and 8 at the same time.