Almost 119,000 fake shops are copying real brands to steal card details: how to spot one

What's happened

Security researchers have found what they describe as the largest publicly documented network of fake online shops: almost 119,000 websites copying real brands to steal shoppers' card details. German security firm Nebty named the network "DoppelCart", and its findings were reported by BleepingComputer on 8 September and Malwarebytes on 9 September.

The fake shops copy product listings, logos and photos from more than 44,000 genuine brands. Eight brands had more than 30 copycat shops each, including SodaStream, Daniel Wellington, CurrentBody and Dreame. Nebty's latest scans found more than 105,000 of the shops still online.

The timing matters for UK shoppers. Black Friday and Christmas buying is about to start, and UK Finance figures published in June show that remote purchase card fraud, where stolen card details are used online or by phone, rose 3% in 2025 to £423.5 million across 3.2 million cases.

How the scam works: the warning signs

• Prices that look too good. The DoppelCart shops advertise discounts of up to 65% on branded goods.
• An odd web address. Almost all of the shops, 118,787 of them, use addresses ending in .shop.
• You arrived from an ad. Malwarebytes warns about following sponsored search results or social media ads instead of going to a shop's address you already know.
• It looks polished. A smart design, a padlock and real product photos prove nothing.
• A security code pops up at checkout. The fake checkout sends your card number, expiry date and security code to the criminals as you type. It can also pass on the one-time code your bank sends, so they can get past the extra security check.
• The contact details lead to the real brand. Some fake shops list the genuine company's support address, so when your order never arrives, you end up complaining to the wrong firm.

What it could cost: a worked example

Say you see a branded coffee machine that usually costs £400 advertised at 65% off, so £140, on a shop you found through a social media ad.

• If you pay by credit card, the item costs more than £100, so you can ask your card provider for a Section 75 claim. Citizens Advice says this applies to single items costing more than £100 and no more than £30,000.
• If you pay by debit card, you can ask your bank for a chargeback, which can cover goods that never arrived.
• If the site talks you into a bank transfer, the bank transfer scam reimbursement rules apply instead. You can claim up to £85,000, but your bank can take off an excess of up to £100. On a £140 loss, that could leave you with just £40 back. Vulnerable customers can't be charged the excess.

The bigger risk is what happens next. Your card details are now in criminals' hands, and they can be used again for other purchases until you cancel the card. Shopping scams paid by bank transfer are common too. UK Finance says purchase scams made up 71% of all bank transfer scam cases in 2025, with losses up 20% to £118.1 million.

How to check a shop is genuine

• Type the retailer's address yourself, use a saved bookmark or open its official app, rather than clicking an ad.
• Search the shop's name and web address with words like "scam" or "reviews" before you buy.
• Check that the contact details, returns policy and company information match the real brand's own website.
• Be wary of any shop that asks you to pay by bank transfer, cryptocurrency or gift card.

What to do if you've been caught

1. Call your bank or card provider straight away. Use the number on the back of your card. Ask them to cancel the card and watch for payments you don't recognise.
2. Ask about getting your money back. That means a chargeback for a debit card, a Section 75 claim for a credit card, or a reimbursement claim for a bank transfer. You have 13 months to report a bank transfer scam.
3. Keep the evidence. Save screenshots of the site, its web address, your order confirmation and any emails.
4. Report the website. Send its address to the National Cyber Security Centre (NCSC) through its online scam website reporting tool. Forward scam emails to [email protected] and scam texts to 7726, which is free.
5. Report the crime. In England, Wales and Northern Ireland, report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.

Your questions answered

Is every .shop website a scam?

No. Plenty of genuine businesses use .shop addresses. But the DoppelCart sites make up about 2.72% of all .shop domains, so take extra care with a .shop site you haven't heard of.

The site had a padlock. Doesn't that mean it's safe?

No. The padlock only means the connection is encrypted. It doesn't tell you who runs the site, and fake shops use padlocks too.

Will my bank refund me if I paid by card?

The bank transfer reimbursement rules don't cover card payments, but cards have their own protections. Chargeback and Section 75 can cover goods that never arrive. Contact your card provider as soon as you can.

Sources: BleepingComputer, Malwarebytes, UK Finance, Payment Systems Regulator, Citizens Advice, NCSC