Case-swap fraud

Case-swap fraud is the act of selling a Mac whose exterior identifies as one device but whose internals belong to another. The chassis serial (etched into the case or read from system metadata) matches the seller's listing; the logic-board serial inside doesn't. This pattern is invisible to Apple's Coverage Check, which only validates the external serial.

Case-swap fraud became commercially viable when the Mac Studio shipped, because high-end M-series logic-boards are worth more than the case they sit in. A bad actor takes a legitimate working Mac (clean Coverage Check, clean Find My, clean Activation Lock), swaps its logic-board with a stolen or broken one, and resells under the original serial. The buyer gets a working machine that fails real diagnostics six months later.

Macfax detects this in two ways. First, every report hashes the chassis serial against the logic-board serial; a mismatch surfaces immediately. Second, every report binds to the specific Secure Enclave that produced the diagnostic, and the device-key fingerprint is published on the report. On Premium reports, a buyer can re-derive that fingerprint on receipt through the Macfax app; if the seller swapped hardware between issuing the report and shipping the Mac, the re-derivation fails.

A PDF report or Apple Coverage Check has no protection against this pattern; both confirm only that the serial is valid Apple.