In partnership with

Title Story

The Mustang Con: Inside a Perfect Online Car Scam

Teddy spent his entire career cutting through lies. A criminal defense attorney with the kind of sharpened instincts you only earn from years of listening to stories that don’t add up. He prided himself on seeing the con before anyone else even sensed the setup. Nothing rattled him. Nothing fooled him. Nothing got past him.

Until the day he went shopping for a car.

It started innocently, the way most modern trouble does: a simple scroll through Facebook. He’d just won a major case—a hard-fought victory—and decided he was finally going to reward himself. That’s when he saw it. A 2021 Ford Mustang Shelby GT500 in Grabber Yellow with bold black racing stripes. The exact car he wanted as a kid, back when posters on bedroom walls were as close as he could get to horsepower. He had spent years ignoring that dream. This time, he didn’t.

The listing read like a wish list: low miles, no accidents, one owner, leather seats, handling package, carbon fiber wheels. The price—fifty-seven thousand—was far below what a GT500 actually commands, but he rationalized it the way any expert negotiator eventually does: maybe he’d stumbled on someone else’s need for a quick sale. Maybe he just got lucky. Even the best of us want to believe we’ve earned a break.

He did what he believed was due diligence. More than sixty emails traded with a courteous and knowledgeable representative who called himself Frederick Lemos. There were dozens of detailed photos, walk-around videos, documents, ownership reports—all crisp, organized, convincing. They used a Bank of America account. They sent paperwork through DocuSign. Everything looked exactly the way a legitimate online car sale should look. He even paid for his own CarFax, and every detail lined up perfectly with what he’d been told.

Overconfidence doesn’t announce itself. It feels like competence—right up until the moment it doesn’t. When the invoice arrived, Teddy’s bank refused the transfer because the account lacked an address. A small red flag, nothing more. He asked Lemos, who replied immediately with a branch address in Orlando, which matched the supposed dealership’s location. A quick map search seemed to confirm it. Satisfied, he wired the money.

Later he would learn the truth: multiple fake auto-seller websites use the same name—Carcoin—mirroring real dealerships without the legitimate businesses ever knowing they’ve been cloned. Fraudsters scrape photos, videos, and documents from real listings, populate a polished new site, and wait for the right buyer to wander in. When one site disappears, another appears, sometimes offering to buy or consign classic cars to gather fresh material for the next round of victims. It’s assembly-line fraud, industrialized deception.

But at the time, none of this was visible. What Teddy saw was an order number posted on their website and a delivery date for the car. They promised the vehicle would arrive in an enclosed carrier, and that the driver would call twenty-four hours before arrival. The day came. No call. When he emailed Ramos, the order status on the website quietly shifted to “delayed.” The following day, delivery slipped again. This time, he requested a cancellation. The site updated immediately: “Order canceled — refund in process.”

It was theater. By then, the money was long gone.

The detail he learned far too late is one every consumer should know: a wire transfer must be recalled within twenty-four hours, or recovery becomes unlikely. After that window closes, you’re no longer chasing a refund—you’re chasing shadows.

For a man who spent his life unraveling other people’s deceptions, this one carried a particular sting. It wasn’t the money. It wasn’t even the car. It was the realization that expertise in one arena doesn’t grant immunity in another, and that the smartest people often fall the hardest because they don’t believe they can fall at all.

And that’s the real lesson here: scams don’t succeed because victims are gullible. They succeed because criminals are patient, prepared, and increasingly professional—and because even the sharpest among us sometimes want something badly enough that we stop questioning the story unfolding in front of us.

Teddy wanted the Mustang. They wanted his money. Only one side got what they came for.

Protect Yourself—Starting Today

My new hub, PROTECT, is now live at ericoneill.net/protect and it’s built for anyone who wants to stop cybercriminal scammers cold.

Inside, you’ll get the exact steps to take the moment your accounts are compromised, how to lock them down before criminals get in, and how to spot the scams hitting elders, teens, and anyone with a pulse and a Wi-Fi signal. There’s even a crash course on beating deepfakes—because they’re cheap, everywhere, and entirely too convincing.

If you want the full battle manual, that’s in Spies, Lies and Cybercrime. If you want to start protecting yourself right now? Begin here: ericoneill.net/protect Now—on to this week’s tip.

Cybersecurity Tip of the Week

Defeating the Mustang GT500 Scam

Every good con has the same opening move: make the mark believe he’s too smart to be a mark. Our attorney walked straight into that psychological ambush. And here’s the uncomfortable truth—any of us could have done the same. The trick is learning to think like the spy setting the trap and like the spy hunter who tears it apart.

Think Like a Spy: How the Criminals Ran the Operation

1. They built a convincing legend. Stolen dealership identity. Real VIN. Real photos. A fake business wrapped in a professional-looking website. A classic spy tactic: make the lie look effortless.

2. They shaped the narrative through patience. Sixty emails, all polite and measured. No pressure. Criminals know that giving you time makes you believe you’re the one controlling the deal.

3. They hid behind trusted institutions. Bank of America account. DocuSign. Clean documents. Add corporate polish and people stop questioning the fundamentals.

4. They let emotion do the work. He wanted the Mustang. Badly. A good spy never fights desire—they redirect it.

5. They collapsed the operation on their terms. Fake delivery delays, fake refund promises—the digital equivalent of a disappearing act.

Act Like a Spy Hunter: How to Expose the Plot

1. Verify independently, not through the seller. A single call to the real Orlando dealership—using a number he found himself—would have ended the illusion instantly.

2. Check the infrastructure, not the story. A WHOIS lookup, a reverse image search, or even checking site age would have revealed the operation was new and suspiciously anonymous.

3. Validate the bank details first. Banks can confirm whether an account belongs to a business. No address on a wire is a glaring warning light.

4. Break the scammer’s script. Request a live FaceTime walk-around or a video showing the VIN and that day’s date. Fraudsters can fake documents, not real-time proof.

5. Control the timing. Wire recalls must happen within 24 hours. Spy hunters assume anything involving money can go sideways—and plan accordingly.

Technology News of the Week

The Corporate War for Hollywood

Netflix thought it had locked down Warner Bros., HBO, and HBO Max with its tidy $82.7 billion deal. This is the kind of acquisition that would have made old-school studio bosses choke on their cigars. But before the ink dried, David Ellison and Paramount stormed the gates with a hostile $108.4 billion all-cash offer, backed by sovereign wealth funds and the Ellison family fortune. In other words: real war-chest money.

Now the question isn’t whether Warner Bros. gets bought. It’s who conquers it… and what survives afterward.

If Netflix wins, the last great studio titan gets absorbed into a global streaming empire. This would drive the final nail into the coffin Hollywood’s been lying in since COVID pulverized the box office. Prestige franchises like Harry Potter, Game of Thrones, The Sopranos, DC, and the classics from Casablanca to The Wizard of Oz would bolster Netflix’s vault, with theatrical releases potentially becoming a quaint tradition rather than a business model.

If Paramount wins, Hollywood gets a chance to breathe. Ellison promises more theaters, more movies, more traditional output — thirty-plus films a year — a kind of retro revival pitched as salvation for an industry that’s been sprinting toward the algorithm.

Either way, someone is about to walk off with one of the greatest collections of stories ever assembled. The only real mystery left is whether the future of Hollywood plays out under bright theater lights… or in the glow of your living room.

Because in this Corporate War for Hollywood, the real prize is who gets to shape what we watch next.

Get the Book: Spies, Lies, and Cybercrime

Thanks to all of you, my book, Spies, Lies, and Cybercrime, is an instant national bestseller and an Amazon #1 Bestseller.

If you haven’t already, please buy SPIES, LIES, AND CYBERCRIME. If you already have, thank you, and please consider gifting some to friends and colleagues. It’s the perfect holiday gift!

📺 Leave a 5-star review on Amazon or on Goodreads.

📖 Get a Signed copy.

🎤  I’m on the road doing speaking events. If your company or organization is interested in having me talk about the book, or you know of someone who is, book me to speak at your next event.

Appearance of the Week

In Episode 96 of the Cybersecurity Readiness Podcast, Eric O’Neill — former FBI ghost (undercover operative), renowned spyhunter, bestselling author, and the real-life inspiration behind the film Breach, takes us inside the high-stakes world of counterintelligence: how he helped expose Robert Hanssen, why spies and cybercriminals think alike, and how the tactics of the physical world now map directly onto digital deception, insider threats, and AI-powered social engineering at scale.

AI Trend of the Week

Following the Warner Bros. Studio story, this week’s AI trend of the week comes from @esheffects on Instagram who used AI to create a fever dream in their Superman/Supergirl Universe series.

Who does it better? — Guys’ night out or girls’ night out?

Please give some love to our sponsor. It only takes a click. No purchase enecessary!

The Hustle: Claude Hacks For Marketers

Some people use Claude to write emails. Others use it to basically run their entire business while they play Wordle.

This isn't just ChatGPT's cooler cousin. It's the AI that's quietly revolutionizing how smart people work – writing entire business plans, planning marketing campaigns, and basically becoming the intern you never have to pay.

The Hustle's new guide shows you exactly how the AI-literate are leaving everyone else behind. Subscribe for instant access.

Get our Claude playbook

Like What You're Reading?

Don’t miss a newsletter! Subscribe to Spies, Lies & Cybercrime for our top espionage, cybercrime and security stories delivered right to your inbox. Always weekly, never intrusive, totally secure.

Continue Reading