Really good suggestions, especially the idea of new picture (checking the XIF data, though that can be forged). Cross-check everything possible with independent sites. Google picture search can be used to locate the forged source. As yourself "What would TEG do?"
I shudder to think back to my own Roadster purchase. It was from a reputable (but new to me) dealer (Shift in San Francisco), but I ended up paying for the whole car - not just a deposit - sight unseen other than the on-line pictures, but with a written (email) 7 day / 250 mile full return policy. This was after a number of email, phone exchanges, a chat with the local SC, and lots of Googling, so I was pretty confident that the place and car were real, but it was a certainly big risk. A big issue was that I couldn't travel to see the car, even though it was only 130 miles away, due to family issues. Needless to say, it worked out, but what would I do today if I had to do it over again? Shudder...