ShopBuyZones is reader-supported. When you buy through links on this page, we may earn a commission at no extra cost to you.
Fake online stores used to be easy to spot. Broken English, stolen photos at the wrong resolution, a layout that looked like it was built in 2009. If you were paying attention, you were fine.
That era is over. Generative AI has made it possible to produce a polished storefront — professional product descriptions, a convincing review section, clean page design, even a responsive chatbot — in an afternoon. The spelling mistakes are gone. Security researchers now describe fake shops that are visually indistinguishable from real ones, and many operate on domains that exist for less than a day before being replaced.
So the old advice — “look for a professional-looking site” — is now actively misleading. Here’s what still works.
1. Check how old the domain is
This is the single most effective check, it takes thirty seconds, and almost nobody does it.
Search for “whois lookup,” paste in the store’s address, and look at the registration date. A scam storefront is usually days or weeks old. A real business has a domain that’s been registered for years.
The reason this works so well is that it directly contradicts the story these sites tell. Fake stores lean heavily on heritage language — “family-run since 1994,” “three generations of craftsmanship.” When the About page claims three decades and the domain was registered last month, you have your answer, and no amount of polished design changes it.
2. Ask how you arrived at the site
Where the click came from predicts risk better than anything on the page itself.
- Highest risk: a link in a text message, a direct message, or an email you didn’t expect. Also any ad in a social feed, particularly on a phone, where the “sponsored” label is easy to miss.
- Moderate risk: a sponsored result at the top of a search page. Scammers buy ads against real brand names, so the paid result and the genuine site can sit one above the other.
- Lowest risk: you typed the address yourself, or used a bookmark.
Fake stores are increasingly promoted through what looks like social proof — stolen influencer videos, AI voiceovers, comment sections full of enthusiasm. If a brand you’d never heard of found you rather than the other way round, slow down.
3. Look at the domain name character by character
Lookalike domains are a staple, and they’re designed to survive a glance rather than a read. Extra hyphens, an added word, a swapped letter, an unusual ending — brandname-outlet.shop, brand-official.store, brandnarne.com.
The padlock icon proves nothing here. It means traffic to the site is encrypted, not that the site is honest. Certificates are free and scammers use them routinely. Encrypted delivery of your card details to a criminal is still delivery of your card details to a criminal.
4. Try to contact a human
Real retailers can be reached. Fake ones offer a web form and nothing else.
Look for a full street address, a phone number, and a company registration number. Then check them rather than accepting them: paste the address into a map and see whether it’s a warehouse or an empty lot, and search the phone number to see whether it appears on a hundred unrelated sites.
A generic email on a free provider — gmail, outlook — for a company supposedly turning over serious money is a strong signal on its own.
5. Sanity-check the discount
Nobody sells current-season designer goods at 80% off. Nobody is clearing genuine premium electronics at a third of retail. When a whole catalogue is marked down that steeply, the discount isn’t the offer — it’s the bait.
Watch for manufactured urgency alongside it: a countdown timer, “only 3 left,” a popup announcing someone in a nearby town just bought one. These are designed to stop you doing the thirty-second checks on this page. When you notice pressure, that’s precisely the moment to slow down.
6. Watch what happens at checkout
This is where a fake store finally has to reveal itself, because it needs your money in a form it can keep.
Walk away immediately if the only options are bank transfer, wire, cryptocurrency, gift cards, or a peer-to-peer app like Zelle, Venmo or Cash App used as a “friends and family” payment. Every one of these is chosen for the same reason: the money is gone the moment you send it, with no mechanism to claw it back.
Pay by credit card or PayPal, which give you a dispute process that works even if the seller vanishes. A credit card is better than a debit card, because a chargeback happens before the money leaves your account rather than after.
Two things to be alert for. Payment logos — Visa, Mastercard, PayPal badges — are just images, and fake sites display them freely without any of those services being involved. And be wary if a payment popup errors out and sends you back to try again: on compromised legitimate sites, that’s a known pattern where an overlay harvests the card details on the first attempt.
7. Search for the brand name with the word “scam”
Obvious, quick, and it catches a lot. Search the store name plus “scam,” “review,” or “legit,” and read what comes back on Reddit and consumer forums rather than on the store’s own site.
One catch: because these operations rotate domains constantly, a brand-new scam site will have no results at all. Absence of complaints isn’t proof of safety — but combined with a domain registered three weeks ago, it’s confirmation.
You can also reverse-image-search a product photo. If the same image appears across dozens of unrelated stores, you’re looking at a dropshipping operation at best.
If you’ve already paid
Act quickly, and in this order.
- Contact your card issuer or PayPal and start a dispute. Don’t wait to see whether the parcel turns up. Chargeback windows have deadlines, and “item never arrived” and “item not as described” are both standard, well-trodden grounds.
- Save everything. Screenshot the listing, the order confirmation, and any messages — scam sites disappear, and your evidence goes with them.
- Report it. In the US, the FTC at reportfraud.ftc.gov and the FBI’s IC3 at ic3.gov.
- If you reused a password on that site, change it everywhere else. The card details matter, but a reused password is often the more expensive loss.
- Watch your statement for small test charges over the following weeks.
The bottom line
You can no longer tell a fake store by looking at it. What you can still do is check things the design can’t fake: how old the domain is, whether a real human can be reached, and what the site will accept as payment.
If you only remember one rule, make it the payment one. Pay by credit card or PayPal and a bad outcome costs you a phone call. Send a bank transfer or a gift card code and it costs you the whole amount, permanently.