Brian Krebs has a great case study of a shady snake-oil seller. Worth reading. Also, the Robert Hansen mentioned in it is not me. :) http://krebsonsecurity.com/2015/08/how-not-to-start-an-encryption-company/