Around 119,000 fake online shops are copying real brands down to the product photos, and taking card details at checkout. Here is how to tell one from the real thing before you pay.
What was found
The news comes from a small security company in Munich called nebty. It began with a handful of customers complaining that someone had copied their shop. The analysts kept noticing the same things: identical files, the same hosting, the same way of building a page.
They followed the trail and ended up with roughly 119,000 web addresses. Nearly all of them end in .shop, which is about one in every 37 addresses on that ending. The company calls the network DoppelCart, a play on the word doppelganger, meaning a double or a copy.
For comparison, the largest network of this kind found before had about 75,000 addresses.
Why the copies look real
You might think you can spot a fake shop because it looks thrown together. These do not. The copied pages use the real company’s product names, its descriptions word for word, its logo, and in some cases photos loaded straight from the real shop’s own server.
So a page can look completely correct and still belong to a stranger. The researchers counted about 44,000 different brands that have been copied this way, most of them only once or twice. Some well-known names, such as the drinks maker SodaStream and the watch brand Daniel Wellington, have more than 30 copies each.
What happens when you pay
At checkout the fake shop asks for the usual things: the card number, the expiry date, the three-digit code on the back, your name, your email, your address. The difference is where that information goes. In the checkout pages the researchers tested, every field was sent to the criminals as it was typed, so they held the whole card while the buyer was still sitting on the page.
It can get worse. The same code was able to pass on the confirmation code that your bank sends to your phone. Most of us treat that code as the safety net that stops a stolen card from being used. Here it can be collected together with the card.
There is a second victim who never sees a cent. Fake shops often display the real company’s customer service address. So when the parcel never arrives, you write to the real brand, which has no record of your order and never received your money. Small German businesses, such as a Munich bakery whose website was copied four times, spend their days explaining a scam they had nothing to do with.
What you can actually do
- Read the address bar, not the logo. A fake shop can hide a brand’s name inside a web address that belongs to someone else.
- Treat a huge discount as a warning. Discounts of 60 to 65 percent on a well-known brand are exactly the bait this network uses.
- Look for details that do not fit. Many of these pages show prices in US dollars even though the text is in German, and their addresses usually end in .shop.
- Read the message from your bank before you type its code. If it does not name the shop and the amount you expected, stop and call the bank on the number printed on your card.
- Find the brand yourself. Search for the company by name and open its shop from the results, instead of following an advert or a link in a message.
- If you have already paid, tell your bank straight away and report it to the police. In Germany you can usually file that report online through your state’s police website.
Common misunderstandings
Myth: the padlock means the shop is safe
Every website can carry that little padlock, fake ones included. It means your connection is encrypted, so nobody can read what you send along the way. It says nothing about who is at the other end. A copied shop with a padlock is still a copied shop.
Myth: only big international brands get copied
Most of the copied businesses are small and medium-sized. In Bavaria alone, reporters found a jeweller, a brewery and a furniture maker whose shops had been cloned. The people behind these pages pick companies that are unlikely to be watching.
Myth: I would spot a fake straight away
That is the whole point of this network. Because the text, the products and the pictures come from the genuine shop, there is very little on the page itself that looks wrong. The address bar is where the difference shows.
What to watch for next
The scale and the quality are new. A senior prosecutor at Bavaria’s cybercrime unit says the sites are run fully or partly automatically, which is why there are so many. The researchers asked the main hosting company to act and got no reply.
Most of the network was still online when the company last checked, more than 105,000 shops. Expect new copies, new names and other endings than .shop. The habit that protects you stays the same: look at the real address, and slow down when a price looks too good.
The one thing to remember
A logo you recognise and a good price are no longer proof that a shop is real. Before you type your card details, look at the web address in your browser, not at the brand printed on the page.
Image credit: “Business professional engages in online shopping from home workspace while using credit card” by Shixart1985, via Wikimedia Commons, licensed CC BY 2.0 (creativecommons.org/licenses/by/2.0).