Someone copied my website: what to do in the first hour?

Your customer asks about an order that does not exist in your system. Apparently, it’s not your customer after all. Their confirmation leads to a store displaying your photographs and logo, but the web address is unfamiliar.

If someone copied your website, preserve evidence and establish whether shoppers are at risk immediately. If you discover a fraudulent checkout, start reporting it as soon as you have evidence while the other work continues. Unfortunately, it’s probably only the first hour you found out, but the website might have been up for a long time.

Establish what was copied

First, check that the domain does not belong to an authorised reseller or a site one of your partners created. To be fair, that’s usually pretty easy to spot: same images from your site, unusually high discounts, some typos – that’s something your partners probably wouldn’t go for.

Compare the copycat website with your store:

• Product images or descriptions: identify the matching product pages and save the originals you own.
• Branding: look for your logo, business name and contact information, particularly claims that this is your official store.
• The whole storefront: record copied navigation and product listings, including policies presented as yours.
• Checkout or login pages: note requests for card details, passwords or verification codes, and any different domain already visible in customer screenshots.

Copied photographs alone do not establish payment fraud. A store posing as your business and requesting sensitive information needs urgent attention.

A clone also does not, by itself, prove your own store was hacked. Nowadays, copying a website with the help of AI is just a matter of a few prompts. Ask your developer to investigate separately if your real domain redirects unexpectedly or your administration account shows unfamiliar changes.

Preserve evidence before it disappears

Create a restricted incident folder and assign one person to maintain it. Collect:

• Screenshots with the address bar visible. Capture the copied storefront and any payment or login page already available. Make sure to record the date, time and time zone either by including it in the screenshot, or by adding it in screenshot’s data.
• Exact URLs. Save the full page addresses, including the path after the domain.
• Suspicious ads. Save the creative, advertiser name and ad ID where available, plus the destination URL and the platform where it appeared.
• Customer reports. Retain the original message and relevant order confirmation. Record how the shopper found the site and whether they entered information or paid.

Keep in mind that keeping more pages (and their information) as evidence is better. Homepage address alone may miss the page demonstrating the abuse. Also, keep customer records private and redact unnecessary personal information from reporting copies.

Check whether the clone can harm shoppers now

Treat requests for payment details or other personal details as urgent. A customer reporting that they paid increases the urgency, but you should not wait for a confirmed loss before acting.

SRLabs’ 2024 investigation into the BogusBazaar fake-shop network identified more than 75,000 associated domains and over 850,000 victims. Researchers documented fake payment pages that harvested card details, displayed an error and then redirected shoppers to a functioning payment gateway. That means “my payment failed” can still describe a customer whose card details were stolen.

Use existing screenshots and customer reports to assess the checkout. If verification requires further interaction, hand it to a security professional.

Give customer support a usable reply

Tell support which domain is involved and what kind of data collection has been observed. Name the person handling reports and give a time for the next internal update.

You can adapt this reply after confirming the site is unauthorised:

“I’m sorry this happened. [Suspicious domain] is not operated by [Brand]. Our official website is [official domain]. If you paid or entered any payment details, contact your bank or payment provider immediately using its official app or a verified phone number. If you entered a password, change it on any genuine accounts where you use that password. Please send the website address and any order confirmation that you already have, with sensitive information hidden, to [support email]. Do not send passwords or full card details, and if you do not have the website address or order confirmation, do not open the malicious website again.”

The UK’s National Cyber Security Centre advises contacting your bank immediately after entering banking or card details on a phishing site. The FTC also recommends changing exposed passwords wherever reused and enabling two-factor authentication.

Do not promise reimbursement (unless it’s your platform’s fault due to some cybersecurity issues or leaks) or tell shoppers their data is safe without evidence. Explain that their payment provider can advise on securing the account and disputing a transaction.

Warn customers where it will help

BehindLink tracks thousands of brands every day. We know better than anyone that scammers can create phishing pages one after another, so using your social media or other communication channels to warn your customers about every single one might be a little too much.

A public warning is appropriate when shoppers are actually encountering the clone often enough, suspicious ads are circulating at a significant volume or a convincing fake store is collecting sensitive information. You do not need a confirmed victim before warning people about a verified threat.

Put the warning where affected shoppers are likely to look: a store banner may help people checking whether an offer is genuine, while a pinned social post can address a scam spreading on that platform.

Use a short notice:

“Customer notice: We have identified an unauthorised website impersonating [Brand]. Our official online store is [official domain]. Check the address before paying. If you entered card details on the fake site, contact your bank immediately. Report suspicious pages to [support email].”

Adjust the wording if you have multiple official regional stores. Avoid clickable links to the clone. If naming it helps customers recognise it, write the address as suspicious-domain[.]com, although usually mentioning links is not very helpful.

Start removal and set the next check

Send the evidence to the relevant hosting company or e-commerce platform. For phishing, also report the domain to its registrar through its abuse channel. The NCSC identifies hosts and registrars as direct routes for reporting brand impersonation.

Report suspicious ads separately to the advertising platform. Where evidence identifies an actual payment provider, notify that provider too; a copied payment logo alone does not establish involvement. For copied material you own, use the relevant copyright-reporting process.

Our guide, How to take down a fake website impersonating your brand, explains how to identify providers and submit removal requests properly, if you want to do it yourself. And, of course, if you see that the phishing page issue is getting out of hand and you don’t have enough time or the right skills to track all the fake websites and take them down, contact the BehindLink team, and we will help you out.