Oil Storage Tank Farm Scams: How Storage Spoofing Works and How to Avoid It

What is storage spoofing?

Storage spoofing is the sale of tank capacity, or of oil said to sit in tanks, that does not exist at real terminals. The term was coined in Rotterdam, where the Port Authority says the fraud runs mainly through fake websites impersonating genuine tank storage companies and also targets other seaports ^[1]. It sits at the heart of most tank farm scams, oil storage scams and fake tank storage offers: the terminal is real, or looks real, but the product and the seller's right to it are not.

Victims include traders who pay for deals that never existed and terminals whose names, staff and data are misused ^[1]. The Port Authority puts traders' losses at €10 million a year or more, counting only known payments ^[1]. Roger Berk of The Commodity Traders (TCT), which helps run the reporting point, told Dutch broadcaster NOS that many victims absorb the loss and never report it ^[2]. For advance-fee fraud in oil more broadly, see our guide to oil trading scam red flags.

How do tank farm scams work, step by step?

Cases documented in Rotterdam follow a recognisable sequence.

Step 1 — Groundwork. Fraudsters register look-alike domains, often months before a fake site goes live. Vopak has tracked variants such as fopak.com, vipak.com, voapk.com and ovpak.com ^[4]. They copy public material such as terminal websites, chamber of commerce records and map listings ^[1]. NOS reports that artificial intelligence (AI) now makes cloning an oil storage company's website easy ^[2].

Step 2 — The offer. An unsolicited email offers product "already stored" in a famous port, often 1 or 2 million barrels, at an attractive price ^[3,5].

Step 3 — The paperwork. Storage documents, inspection reports, stamps and certificates follow, and all of them can be forged ^[2,3,9].

Step 4 — The fee. The buyer is asked to pay before seeing anything: tank farm access fees, storage extension fees, document endorsement, or an "Authorization to Verify" (ATV) or "Dip Test Authorization" (DTA) ^[6]. In one documented pattern, the product suddenly has to move, a third party offers spare tanks for three to five days and immediately invoices $100,000–450,000 for "storage facilitation", payable to obscure foreign banks ^[5].

Step 5 — The vanishing act. When questioned, the seller turns vague, becomes unreachable or sends more forged documents ^[5]. In some cases tank trucks have arrived at terminals to collect product that does not exist ^[1].

Step 6 — The harvest. VTTI warns that impostors may seek invoices or email confirmations to reuse in later scams ^[8].

The most sophisticated schemes involve real tanks. De Volkskrant reported that criminals, sometimes helped by corrupt port workers, have gained access to restricted terminal sites ^[11]. In the first tank storage spoofing case to reach a Dutch court, the suspects were accused of producing falsified inspection reports for about 2 million barrels of non-existent oil, offered for $155 million; TCT spotted red flags and went to the police ^[9]. On 13 March 2026 the Rotterdam District Court convicted four defendants of forgery offences: a Shell employee, an SGS employee, a sampling company owner and the reports' drafter. Between March 2021 and July 2022, seven unauthorised samplings were staged at Shell's Pernis and Europoort sites without the consent of Shell or SGS. Two defendants were acquitted of attempted fraud, and all four received community service ^[10].

Which storage hubs and terminals do scammers impersonate?

Rotterdam is the best-documented target. Forged documents in Vopak's name pointed to vopakterminal.com and vopakterminaleuropoort.nl ^[4]. HES International had botlektankterminal.nl, .com and .net taken offline, only for a new variant to appear ^[12]. The taskforce's blacklist includes koninklijke-vopak.com, koole-tsp.com (styled "Koole Tank Storage Pernis"), koole.ae, eurotankamsterdam.nl (flagged for abuse of VTTI's name) and deltaoiltanking.com ^[6]. Standic has had its website copied and staff names and contact details used in forged documents, although it stores no petroleum products at all ^[2].

Other hubs feature too. The blacklist includes lbcantwerpen.com, listed as "LBC Antwerpen", and Houston-branded domains such as houstontankterminal.com and houstonstoragepartners.com ^[6]. Motiva says it has no link to a "Motiva Ltd Tank Terminal" claiming to run storage in Houston and Rotterdam ^[7]. For Fujairah, the blacklist includes a site styled "GTI Fujairah FZC" ^[6]. GTI Fujairah is one of 10 firms on the Port of Fujairah's published list of tank storage companies, alongside Vopak Horizon Fujairah and VTTI Fujairah ^[13].

The operation is international. Of 421 fraudulent websites analysed by de Volkskrant, more than 40% were registered in the United States, about 30% in Russia and around 10% in the Netherlands ^[11]. The blacklist grew from more than 1,250 domains in February 2026 ^[1] to about 1,400 by June ^[2].

Why do real terminals never "hold" product for unknown sellers?

An independent terminal is a service provider: it stores product for a contracted client and releases it on that client's instructions. The 2023 general conditions of VOTOB, the Dutch tank storage association, spell this out. A terminal is only obliged to give information about stored goods to its client, the client's legal representative or the holder of a store warrant, and may demand proof of entitlement (Article 42). Goods are released on written instruction from the client or its agent, and the terminal may first check identity and entitlement (Article 43). A change of ownership must be notified to the terminal in writing, the new owner must accept the storage agreement in writing, and the terminal will not recognise the transfer until its own claims are paid (Article 48). A store warrant is issued only at the client's request and the terminal's discretion, signed for the terminal and bearing a serial number (Articles 1 and 45) ^[14].

So a "seller" who is not the terminal's client has no standing to order a dip test, an injection or a site visit, and the terminal is not obliged to confirm stock to a stranger. Any genuine route to the product runs through the terminal's own client and a transfer the terminal records. A Port Authority adviser has said that in spoofing cases the physical product is nowhere to be found, and that a simple check often exposes the fraud ^[5].

Even real-looking receipts need checking at source. In Natixis v Marex (2019), a nickel case, forged warehouse receipts in storage company Access World's name led to a claim of about $32 million ^[18]. Medlog's head of collateral management has described fraudsters fitting an inner tube inside a petroleum tank so that it appeared full ^[17].

What do ports and terminal operators say?

On 6 February 2026 the Port of Rotterdam Authority and VOTOB signed an agreement to continue and expand the taskforce, which also includes TCT and the Seaport Police. Domain registry SIDN has helped take fraudulent .nl sites offline since 2020 ^[1]. "Several of our members have been dealing with this for years," said VOTOB director Willem-Henk Streekstra ^[1]. According to the Seaport Police, the first, clumsier cases date from 2011 ^[2].

"It's very easy to register a domain name, but taking it offline is a very complicated matter," said Vopak's Michael Noorlander ^[4]. VTTI says impostors use its name and logos, seek up-front fees and supply false documents ^[8].

Enforcement is slow. A Dutch cybercrime prosecutor said in 2017 that "identifying the perpetrators is very complicated", but added that payments can sometimes be recovered through Europol ^[15]. In 2026 the Public Prosecution Service told NOS that prosecution is very difficult because perpetrators and victims are almost always abroad ^[2].

NOS reported that English trader Atif Aslam lost a purchase of almost $1.5 million after paying in advance for storage in Rotterdam that, like the oil, did not exist ^[2]. The reporting point recorded $10 million of fraudulent payments in 2025 ^[2].

How to protect your business from tank storage fraud (checklist)

• Start from the terminal, not the seller. Find it through the Port of Rotterdam's Facts & Figures brochure, the storagespoofing.nl whitelist ^[16] or the Port of Fujairah's list ^[13], and call numbers you found yourself.
• Make the terminal part of the deal. Under Dutch terminal conditions, the client must notify a transfer in writing and the new owner must accept the storage terms in writing ^[14].
• Never pay to verify. ATV, DTA, tank access, storage extension, permit or "storage facilitation" fees are red flags ^[5,6,7].
• Insist on proper inspection. Ask for a quality and quantity report from an inspector working in the port plus the storage company's injection report ^[6], and appoint your own inspector: staged samplings can produce convincing reports ^[10].
• Authenticate receipts at source, in person where possible ^[18], and check stock physically ^[17].
• Check domains and registrations. Search the blacklist; Rotterdam port companies have a Dutch Chamber of Commerce (KVK) number ^[6]. Free webmail and unofficial phone numbers are warnings ^[8].
• Keep evidence and report fast. Save websites, contact details, phone numbers and IP addresses ^[15], report suspicious sites to the taskforce ^[6] and get an independent deal check ^[16].

Alupetra applies these storage and counterparty checks in its KYC and due diligence work from its Istanbul, London and Dubai offices.