Fake-Shops Detection Test 2024

Analysis of Findings

The evaluation shows that only very few of the tested products offer a reasonable level of protection against fake shop websites (scams). Users should not solely rely on security products; instead, they should adopt a multi-layered approach to security. Regular updates, awareness of common scam tactics, and cautious online behaviour are crucial. Further details about fake shops and best practices for identifying them can be found on the following pages.

Most products appear to rely solely on blacklists for identifying fake shop URLs. The effectiveness of these products depends on the accuracy and maintenance of these blacklists, and some solutions seem not to use very up-to-date lists. Only one specialised product in the test utilises machine learning specifically for fake shop detection, resulting in high scores.

In the test, AV-Comparatives observed that many of the tested fake shop websites had a very similar design and appearance (see screenshots below). This could be due to the use of common web frameworks, and web design patterns or possibly being operated by the same group of scammers. We also noticed that a significant number of the fake shop URLs use Cloudflare services. Machine learning algorithms might use these factors to identify fraudulent web pages.

Examples of fake webshops

Understanding Fake Online Shops and Other Scams

Scammers use various tactics to create a false sense of security, including:

• Impersonating legitimate brands by stealing logos, copying professional website design, mimicking social media profiles, and using domain names similar to reputable brands but often with minor misspellings or different extensions.
• Creating fake positive reviews or hiding negative reviews to maintain the illusion of reliability and customer satisfaction.
• Sophisticated phishing techniques by sending convincing emails that appear to be from trusted brands or using targeted ads on social media platforms, prompting recipients to click on links leading to fake shops.
• Fake customer service by providing contact information and live chat options that either do not work or are manned by scammers.
• Manipulating search engine results by employing optimisation tactics or using paid ads on search engines to appear at the top of search results, making them more likely to be clicked.
• Exploiting trust signals by displaying fake trust badges, security seals, and certifications from well-known organisations or showcasing fake social media icons, followers, and likes.

Some examples of typical fake shops are:

• Websites based in China selling luxury brands at steep discounts. Consumers find it challenging to get refunds due to international legal complexities.
• Websites based in Eastern Europe offer popular electronics at unbeatable prices. They often vanish after collecting payments, leaving customers unable to retrieve their money.
• Websites selling fashionable clothing and accessories from Southeast Asia. They look professional but deliver substandard or fake products, if they deliver anything at all.
• Websites based in countries with less stringent regulations for health products selling fake or harmful supplements. They take advantage of the lack of international regulatory oversight.

Based on the following considerations, it is not always possible to definitively determine whether an online shop is fraudulent:

• Reasonable discounts and low prices.
• Goods can be held up in customs, causing shipping delays, additional costs, or non-delivery.
• Not all online shops based in foreign countries are fake.
• Visiting an unsecured website (HTTP) does not automatically mean it is a scam. Secure sites can be scams as well.

Unfortunately, fake retailers also try to sell their goods on large and legitimate online marketplaces such as Amazon, eBay, and Alibaba.

Best Practices for Identifying Fake Shops

To minimise the risk of falling victim to fake shops, we recommend the following:

• Be careful when shopping online on your mobile phone, as it is easier to accidentally click on fraudulent popups or ads.
• Be cautious of deals that seem too good to be true; compare the price with the original brand.
• Be wary of misspelt domain names or unusual domain extensions.
• Verify the website’s legitimacy by checking for valid SSL certificates (indicated by “https://” at the URL’s start and the padlock symbol next to the URL) and domain registration information (https://who.is/, https://lookup.icann.org/).
• Confirm the website ownership by looking for contact information (including physical address, phone number, and email address), typically found in the header, footer, or imprint.
• Check the website for grammatical and spelling mistakes.
• Ensure the website has a clear and accessible privacy policy, as well as terms and conditions regarding returns, refunds, and shipping.
• Check for reasonable shipping fees and times.
• Do quick research of the retailer by brand name plus keywords “reviews” or “scams”.
• Check the shop’s reputation by reading customer reviews on various sites and social media; avoid those with predominantly negative or suspicious feedback.
• Report suspicious websites to relevant authorities.
• Do not agree to payments made outside the online shop.
• Be cautious of foreign bank account numbers (IBAN).
• Use trusted payment methods like credit cards or secure payment services such as PayPal, which offer better fraud protection; avoid advance payment.
• Save and auto-fill bank or credit card details using a password manager.
• Ensure that you receive an order confirmation and invoice after making a purchase.
• Be aware of subscription traps that may be hidden in the small print of free offers.
• Monitor your financial accounts by setting up alerts for unusual activities and regularly checking for unauthorised transactions.
• Report any suspicious financial activity to your bank or credit card company immediately.
• Keep up with the latest news on online scams and fraud tactics.
• Use trusted security software with high detection rates.
• Regularly update security software and browser extensions.
• If possible, avoid purchases from shops based in foreign countries as it can pose a higher risk of being fake and may be more difficult to pursue legal action or obtain refunds due to different laws and regulations.
• Be aware of customs complications and import restrictions, including the possibility of fake luxury goods being confiscated by customs, high toll fees for very inexpensive goods, and the risk of non-delivery.
• Educate and share experience with your friends and family to help them stay safe online.

Appendix

Screenshots

Below are examples of screenshots showcasing detections by some of the tested products.

*Fake-Shop Detector is research project by the Austrian Institute for Applied Telecommunications (ÖIAT), X-Net, and AIT Austrian Institute of Technology.