How to spot a fake online store before you buy

The ad shows up between a cousin's vacation photos and a video about a dog. A name-brand jacket, or a power tool, or a pair of boots, at 70 percent off. The store has a clean logo, a countdown timer, and reviews. You've never heard of it, and that's fine, because you'd never heard of half the stores you've bought from.

This is where most shopping scams start now. The FTC's latest numbers say that in 2025, nearly 30 percent of people who reported losing money to a scam said it started on social media, and reported losses hit $2.1 billion, about eight times the 2020 figure. More than 40 percent of those people said it began when they ordered something they'd seen in an ad. Facebook led every other platform in reported losses. WhatsApp and Instagram were, in the FTC's words, "a distant second and third."

What arrives is nothing, or a knockoff, or something that looks nothing like the picture. The FTC's own description of the pattern is a store that impersonates a real brand and runs "ads for brand-name products at unusually low prices." The price is the bait. Everything below is how to check the store before you bite.

Check when the store was born

Most stores sell on a .com or another generic domain, and those registration records carry a creation date. Scam storefronts tend to be weeks old. Go to lookup.icann.org, type the store's web address without the https and without anything after the first slash, and read the date. ICANN's rules require that date to show even when the owner's name is hidden behind a privacy service, so a redacted owner proves nothing. A store that appeared last month and is selling $300 boots for $59 has told you what you need to know.

A new domain on its own isn't a conviction. Real small businesses are new once too. It's the first of three checks.

Check where the photos came from

Fake stores usually don't take their own product photos. They lift them from the brand or from other stores. On a computer, right-click the product picture and choose 'Search with Google Lens', or right-click it, choose 'Copy image address', go to google.com, click 'Search by image', and paste it under 'Paste image link'. On an Android phone, touch and hold the picture in Chrome and choose 'Search image with Google Lens'. On an iPhone, the same long-press in Chrome offers a Google search, or you can screenshot the photo and open it with the Lens button in the Google app.

If the identical photo shows up on the brand's own site at four times the price, or on a dozen unrelated storefronts, the ad store didn't take it. Legitimate drop-shippers reuse supplier photos too, so this check pairs with the first one. Stolen photos on a month-old domain is the combination.

Search the store's name

The FTC's own advice is the simplest. "Before you buy, search online for the seller's name and the website URL the ad sends you to, plus words like 'review,' 'complaint,' or 'scam' to see what others have to say." Two results are useful. A pile of complaints on sites the store doesn't control, or nothing at all. A store with no footprint anywhere but its own ads may be a store nobody has received a package from.

What the lock icon does and doesn't tell you

Nearly every scam store is encrypted. The FTC says it plainly. The "s" after http "means the site is encrypted," and "it doesn't mean it's a legitimate site. Scammers know how to encrypt sites, too." Google retired the padlock in Chrome in 2023 for exactly this reason, writing that "nearly all phishing sites use HTTPS, and therefore also display the lock icon." What Chrome shows now is a tune icon, and its help page says a secure connection means the information "is private between you and the site," and then adds, "always be careful when you share sensitive or personal information." The padlock only tells you the connection is private.

The useful rule runs the other way. If the address bar says "Not secure" on a checkout page, leave.

Reviews prove less than they look like they do

The FTC banned fake reviews in 2024, and the rule lets the agency seek civil penalties against companies that knew or should have known the reviews were fake. A scam store that will never be sued is not deterred by that. The FTC's consumer page is blunt about your odds of spotting one. "Don't assume that, just by looking, you can spot the difference between a real review and a fake one." Its tells are a burst of reviews in a short period, and reviewers whose account exists to write one review of one product. Treat the reviews on the store's own page as decoration.

Pay with the card that can take the money back

The FTC's line is that "Paying by credit card best protects you and your money in case of a scam, or if something else goes wrong." If the item never arrives, you can dispute the charge as a billing error, in writing, within 60 days of the statement it appears on. The issuer has to acknowledge the dispute within 30 days and resolve it within 90. Separately, if somebody else runs up charges on your card, federal law caps what you owe at $50. Those are two different protections, and the one that covers a fake store is the billing-error dispute.

A debit card is a different animal. The protections the CFPB describes for debit cover unauthorized transactions, the ones you didn't make. Paying a fake store yourself is a transaction you made. The FTC's advice for that case is to call the bank and ask for a refund, which is a request, not a right.

And if a store will only take a gift card, a wire, a payment app, or cryptocurrency, the FTC says it's "probably a scam," because those are ways of paying that make it "hard for you to get your money back." A real store that sells boots takes a credit card.

If you already paid

Call the number on the back of your card today and ask for the charge to be refunded. The 60-day clock for a formal dispute runs from the statement, so don't wait for the package that isn't coming. If you paid through an app, report it inside the app and ask them to reverse it. Gift card, call the number on the back of the card and say a scammer tricked you. Then report the store at ReportFraud.ftc.gov, which won't get your money back but is how the FTC builds cases. Keep the ad, the order confirmation, and the store's web address.

One more rule that helps. If a seller doesn't promise a shipping date, federal rules give it 30 days to ship after it takes your money. Past that, you're owed your money back or a choice about waiting.

The test before you tap Buy

You have the store open and the price looks great. Look up the creation date. Long-press the photo. Search the name with "scam." If all three come back clean and you pay with a credit card, the worst case is a phone call and a dispute you have a legal right to file. If any one of them comes back dirty, close the tab, and go buy the boots somewhere you've heard of.

Which ad almost got you? I'd like to know what product it was. My guess is that it's never the expensive thing, it's the $40 thing that looked like a deal. joel@freshfromcache.com