How to Spot a Fake Store Before You Pay

The picture most people carry around of an online scam — a badly spelled email from a stranger — is about a decade out of date. Today it looks like a well-produced ad for a jacket you were already thinking about, targeted at you, in the feed you scroll every day.

The numbers are not small. Reported losses to scams that started on social media reached $2.1 billion, roughly eight times the 2020 figure. Shopping scams are the most frequently reported type: more than 40% of people who lost money to a social-media scam say it began when they ordered something from an ad.

And the platforms are not catching them for you. The FTC has said it plainly: ads on social media aren't necessarily vetted. Buying ads gives a scammer the same targeting tools a real business uses, for very little money.

The good news is that the defence is cheap. Almost every fake storefront fails at least one of four checks, and running all four takes under a minute.

The 60-second check

Domain age is the single best check, and it's free. Paste the address into any WHOIS lookup and read the registration date. A shop presenting itself as a long-running retailer on a domain registered three weeks ago is telling you what it is. Under six months is high risk; over a year is not a guarantee, but it means somebody has been maintaining a reputation.

The payment options are a confession. A real storefront wants to take your card, because cards are how people buy things. A site that pushes you toward Zelle, a bank transfer, or crypto is choosing the payment rails that can't be reversed — which is the whole point.

Look for a company, not a website. A physical address you can find on a map, a phone number that connects, a returns policy written for this business rather than pasted from a template. "All sales final" on a brand-new store is a red flag, not a policy.

Check reviews somewhere the store doesn't control. Not the glowing carousel on their homepage. Search the store's name plus "scam" or "reviews" and see what turns up on the open web.

The advice that stopped working

Some of the standard checklist has genuinely expired, and repeating it now gives people false confidence.

Fake reviews no longer read like fake reviews. Research across more than 714,000 reviews found that AI-generated fakes are cleaner and less exaggerated than genuine ones — which makes clumsy phrasing and over-the-top praise the least reliable tells available. Read patterns instead: a burst of reviews all dated within a few days, reviewers with no other history, or a rating profile that's all fives and ones with nothing in between.

The Amazon commingling warning is out of date. For years the standard advice was that Amazon pooled identical items from different sellers into shared bins, so a counterfeit could reach you even from a good seller. That was true, and it was a real risk. Amazon ended inventory commingling on 31 March 2026; stock is now tracked per seller. The old warning has been copied forward into a lot of 2026 articles that haven't caught up.

The padlock means encrypted, not honest. HTTPS certificates are free and automatic. All the padlock tells you is that nobody can read your card number in transit to the criminal.

On the big marketplaces, read the seller line

A legitimate marketplace can still deliver you a bad product, because a lot of what's on it isn't sold by the marketplace. On any listing, find who it's sold by and who ships it — those are two different fields and they matter.

• Sold and shipped by the retailer itself is the safest combination.
• Sold by a third party, shipped by the retailer means the platform is only handling logistics; the goods are someone else's.
• Sold and shipped by a third party means you're really buying from a company you've never heard of, inside a site you trust.

For anything where a counterfeit would be expensive or unsafe — chargers and batteries, cosmetics, supplements, car parts, memory cards — buy from the brand's own storefront or the retailer directly, even at a small premium. Deep discounts on those categories from an unknown seller are the classic shape of a counterfeit listing, and a suspiciously large "discount" deserves the same scrutiny you'd give any price tag.

How you pay decides whether you have a way back

This is the part that matters most, and it's decided before anything goes wrong:

How you paid	If it turns out to be a scam
Credit card	Strongest. You can dispute the charge, and the amount is withheld while it's investigated
Debit card	Weaker. The cash already left your account and you're waiting for it to come back
BNPL (pay-in-4)	Inconsistent. Protections are contractual rather than statutory — read the provider's policy
Zelle, wire, crypto, gift cards	Effectively none. Treat these as cash handed to a stranger

The rule that follows is short: for any seller you haven't used before, pay with a credit card. It converts a total loss into a dispute, and the full escalation path is in our returns and chargebacks guide.

If you already paid

Speed matters more than anything else here.

1. Contact your card issuer today and tell them it was a fraudulent merchant. Do it before the statement arrives — the clock on billing-error rights starts at the statement, but the practical odds are better the earlier you call.
2. Screenshot everything before it disappears: the ad, the listing, the confirmation email, the site itself. Scam storefronts are taken down and rebuilt under new domains constantly, and your evidence goes with them.
3. If you paid by bank transfer or crypto, call your bank immediately anyway. Recovery is unlikely, but it is occasionally possible within hours and essentially never possible after days.
4. Report it to the FTC at reportfraud.ftc.gov. It won't get your money back directly, but these reports are what produce the data at the top of this article and what gets domains taken down.

Then check your statements for the next couple of months. A site set up to take your card details has your card details.

The short version: the entry point is an ad, not an email. Check the domain's age, check whether they'll take a card, check that a real company exists behind the page, and check for reviews they don't control. Ignore the padlock and ignore the writing quality — both stopped being signals. And put anything from a seller you don't know on a credit card, because that single choice is the difference between a dispute and a donation. More of today's deals — from stores we've actually vetted — are below.