"Request for Quotation. 60 laptops, 40 tablets. Ship priority. Payment Net 30 upon receipt."
The email hit Jordan's inbox at 4:52 p.m. on a Thursday. He runs a two-person IT resale shop out of a strip-mall suite. He registered on SAM.gov last spring because everyone told him government work was the steady money.
This looked like it. An Army seal. A contracting officer's name he could actually find online. A signature block, a solicitation number, a delivery address. The sender's name ended in something that looked close enough to .mil.
He quoted $71,400. They accepted the next morning. A purchase order showed up with a signature on it, and a note: rush it, it's needed before the end of the month.
Jordan didn't have $71,400 in laptops sitting around. So he took an advance against his sales to buy them. The funder pulled a slice of every deposit, every day. Didn't matter. The government pays in 30 days. Everybody knows the government pays.
The boxes went to a warehouse address two states away. Twenty-nine days later, he sent the invoice.
Nobody answered. When he finally found a real phone number for the agency, the person on the line had never heard of the order. There was no order.
Jordan is a composite. The scam is not.
The General Services Administration's Office of Inspector General, the watchdog for the government's main buying agency, is warning about continued fake "Requests for Quotations" aimed at small and large businesses, including contractors registered in SAM.gov. The fake emails ask for things that resell fast: phones, laptops, tablets, toner, cameras, medical gear. The sender addresses are built to look like .gov or .mil, but they actually end in .net, .org or .com.
Here's how it closes. You quote. They accept. A fake purchase order arrives, often with a real official's signature copied from public contract files. Payment is "guaranteed" Net 30. The ship-to is a storage unit, a warehouse or a freight forwarder. When your invoice reaches the real agency, it gets rejected or ignored, because the agency has no record of buying anything.
The scammers don't need your money. They need your inventory, and 30 days of head start.
A second version is going around too. The same office says people posing as real GSA officials are emailing vendors from look-alike domains (one used e-gsa.us) about a yearly "credentialing fee" to keep your status active, with a credit card form attached. Another fake notice says your contract file is "non-compliant" and points you to the attachment for "resolution steps."
Red flags
- The domain is almost right. It says gov or mil somewhere, but the address really ends in .com, .net, .org or something like e-gsa.us. Check the Reply-To too, since it can differ from the From line.
- The ship-to doesn't belong to the agency. A self-storage facility, a virtual office, a freight forwarder, a pack-and-ship store or a house.
- Big quantities of easy-to-resell stuff, rushed. Laptops, phones, toner, overnight shipping, "needed by end of month."
- The "official" won't get on the phone. The GSA watchdog says to be suspicious of procurement officials who refuse to talk by phone.
- A fee to stay "active" or "compliant." The GSA watchdog says to treat any unsolicited "credentialing fee" request with skepticism until you verify it.
What to do
- Call before you quote. Find the named official's number on your own, from the agency's real website or a contact you already have. Don't use the phone number or reply address in the email.
- Hover, don't click. Check the full sender domain and the Reply-To before you open any attachment.
- Search the delivery address. If it comes back as a storage unit or a shipping store, stop.
- Don't buy inventory on borrowed money for an order you haven't verified. A fake order plus a daily debit is two problems at once.
- Report it. File with the FBI's Internet Crime Complaint Center at ic3.gov. If they posed as an agency, report it to that agency's Inspector General too (the directory is at ignet.gov). For GSA, use gsaig.gov/hotline. Save the emails, with headers if you can. You can also report at ReportFraud.FTC.gov.
Jordan still has the purchase order. It's the best-looking document in his filing cabinet.
Sources:
- GSA Office of Inspector General, Fraud Alert: Fake Government Requests for Quotes: https://gsaig.gov/news/fraud-alert-fake-government-requests-quotes-0
- GSA Office of Inspector General, Scam Alert: Scammers Impersonating GSA Contracting Officials to Target Vendors and Contractors: https://www.gsaig.gov/news/scam-alert-scammers-impersonating-gsa-contracting-officials-target-vendors-and-contractors
- FBI Internet Crime Complaint Center: https://www.ic3.gov
- Inspectors General directory: https://www.ignet.gov/content/inspectors-general-directory
- FTC, Business Impersonator Scams: https://consumer.ftc.gov/features/pass-it-on/impersonator-scams/business-impersonator-scams