Anatomy of a fake store: how a cloned shop takes your customers’ money

How cloned stores are built, six checks any merchant can run in five minutes, and how to get a fake shop taken down.

4 min read

Somewhere right now, a shopper is typing their card number into a store that looks exactly like a brand they trust. Same product photos. Same layout. Same logo. The price is 70% off, the countdown timer says 14 minutes, and the order will never arrive.

We take these stores apart for a living. This post walks through what a typical clone looks like under the surface, the checks you can run on any suspicious address in about five minutes with nothing but a browser, and what to do when one turns out to be fake.

The template, not the target

The first thing to understand: your brand was probably not chosen. It was harvested.

Most of the fake shops we confirm are not one-off builds. They come out of kits: a storefront template, a hosting setup and a checkout, reused across many brands with only the logo, the photos and the name swapped. One family we see again and again runs Shopify-style storefronts on addresses like yourbrand-sale.it.com, yourbrand.de.com or yourbrandoutlet.shop, under the same few banners, such as “Summer Exclusive: Up to 70% Off! Free Shipping On All Orders.” The contact address in the footer is often a leftover from the last shop the kit was used for.

Another kit we took apart this autumn runs on WooCommerce. Its checkout shows a Stripe badge, but the card form is a frame served from the fake shop's own address, and the numbers go to a collection server somewhere else. Stripe never sees the payment, which is the point: there is no payment company to complain to.

The kits copy your photos onto their own servers instead of loading them from yours, so nothing unusual shows up in your own traffic. What gives them away is the price. Nearly every product on the page is struck through, with the “sale” price around 70% lower. When we tested that pattern against 2,004 pages we had already ruled on, the price pattern together with the brand's name and a copied page layout caught 93 of the 140 confirmed clones. It also flagged four pages that were not clones, and not one official site.

Six checks that expose most clones

  1. The discount that doesn't happen. Storewide 70 to 80% off, forever, with a countdown that resets on reload.
  2. The footer that leads nowhere. Terms, returns and contact pages that are empty, copied from another brand, or missing.
  3. The domain's age. An “established 2015” store on a domain registered three weeks ago.
  4. The payment mismatch. A checkout that suddenly leaves the domain, or only takes cards where the real brand offers PayPal and Klarna.
  5. The reverse image search. The “team photo” and the product shots appear on a dozen other stores.
  6. The ad trail. Search your brand name in the Meta Ad Library. An ad using your photos that sends shoppers to an address that is not yours is the fastest-moving kind of fake.

What to do when you find one

  1. Save the evidence first. Screenshot the home page, a product page and the checkout, and note the address and the date. Fake shops move, and every report below asks for proof.
  2. Report it to the company hosting it. A “who hosts this site” lookup names the host; send its abuse address your evidence. If the site sits behind Cloudflare, Cloudflare's abuse form passes the report on to the host behind it.
  3. Report it to the registrar, the company that sold the address. Registrars act on addresses registered to deceive, and a suspended address stops working everywhere at once.
  4. Report it to the blocklists browsers use: Google Safe Browsing, Microsoft SmartScreen and Netcraft. They decide whether to list it; when they do, browsers can warn the people who visit.
  5. Follow the money and the ads. If an ad sent shoppers there, report the ad to the platform that ran it. If the checkout runs through Shopify, Stripe or PayPal, report the shop to them too: they can close it or stop its payments.
  6. Warn your customers. A short note on your site and in your next email, naming the address that is not yours, stops the next order.
  7. Keep checking. Fakes come back, at a new address or the same one. The same reports work the second time.

Saving the evidence, filing every report and checking again each time a fake comes back is the work Watchdog does for you: notices sent in your name, followed up until the case is resolved, with no per-case fees. Several signs must agree before we alert you or send a notice, and we review every case daily.