Scammers phishing for credit card info with fake Van Gogh Museum site

The Van Gogh Museum website was recently spoofed in a phishing scam. Victims thought they were buying tickets for exhibits at the museum in Amsterdam, but were actually just giving their credit card details to scammers.

The Van Gogh Museum received at least 50 reports about the fake site, either from victims or people who noticed it and found it suspicious. “We passed on every report to the police,” a spokesperson told Parool. The museum also reported the fake site to Google and put a notice on its website, warning people to only buy tickets from vangoghmuseum.nl.

The fake site first appeared in early April and has now been taken down. According to the spokesperson, it was the first time the Van Gogh Museum had its site spoofed.

Parool spoke to two victims. Jessie (36) really wanted to go to the Matthew Wong exhibit in the Van Gogh Museum but found the tickets sold out on the site. Through Google, she ended up on an English-language page that looked exactly like the Van Gogh Museum website. It still had tickets available. She bought two tickets for Museum Card Holders. She didn’t have to pay anything, only enter her credit card information. “I felt like I had hacked the system,” Jessie said. “And I thought: Maybe they’re keeping some tickets reserved for tourists.”

Ria (85) ended up on the same site because it was the top Google search result. She is also a Museum Card holder. “Normally, you don’t have to enter credit card details. But I really wanted to go.” So she went ahead. Later that day, she looked at the Van Gogh Museum’s website and saw that tickets were sold out. “Strange, I thought, but I didn’t think more about it.”

Not much later, the two victims received messages from their banks saying that their cards had been blocked because fraud was detected on their accounts.

Both victims bank with ABN Amro. Peter Hermsen of International Card Services (ICS), which manages ABN Amro’s credit card transactions, told Parool that the service is continuously working on detecting fraud. “Every day we tighten and improve our detection and prevention service,” he said. “As soon as we become aware of a fraudulent site where card details of ICS cardholders are misused, we will have this site taken offline as soon as possible.”