Thousands of Fake Online Shops Target Shoppers, Posing Significant Credit Card Fraud Risk

Cybersecurity researchers have identified a vast fake shopping operation known as DoppelCart, which has been linked to approximately 119,000 domains. This operation mimics legitimate businesses, creating convincing websites designed to steal consumers' credit card details and other sensitive payment information during the checkout process.

DoppelCart's Scale and Tactics

According to cybersecurity company Nebty, which investigated the operation, over 105,000 DoppelCart shops were active at the time of its latest scans, with the majority still online. The sheer volume of domains associated with DoppelCart makes it the largest publicly documented fake-shop cluster identified to date, based on domain count. Researchers observed striking technical similarities across these fraudulent sites, with a significant percentage sharing identical build files and utilizing common backend systems.

DoppelCart stores often impersonate well-known brands, copying product catalogs, descriptions, and branding material. In some instances, these fake sites even load assets directly from the legitimate companies' servers, making them appear highly credible to unsuspecting shoppers. Nebty's analysis indicated that DoppelCart shops mimic over 44,000 different brands, with some companies being targeted by multiple cloned sites.

Exploiting Discounts and User Trust

These fake shops frequently advertise significant discounts, sometimes as high as 65%, to lure customers. While legitimate businesses also offer sales, extreme price reductions from unfamiliar retailers should raise a red flag. Shoppers are urged to verify the authenticity of a website before making a purchase, especially when a deal appears too good to be true.

How Payment Information is Stolen

When a consumer attempts to make a purchase on a DoppelCart-affiliated site, the checkout pages are designed to capture sensitive data. This can include credit card numbers, expiration dates, security codes, cardholder names, email addresses, phone numbers, and physical addresses. Researchers found that this information can be transmitted in real-time to command-and-control servers, a technique similar to web skimming. A particularly concerning aspect of the operation is its ability to potentially capture one-time bank verification codes that are intended as an extra layer of security. Attackers may attempt to use these codes to bypass protections for fraudulent transactions.

Impact on Legitimate Businesses and Consumers

The DoppelCart operation not only defrauds consumers but also creates problems for the legitimate businesses whose brands are being impersonated. Some fake shops display authentic customer support information, leading to confused and angry customers contacting the real companies about orders they never placed. This can damage the reputation of legitimate businesses and force them to handle customer complaints stemming from fraudulent activity.

How to Avoid Fake Online Shops

Consumers are advised to take several precautions to protect themselves from such scams:

• Verify the Web Address: Carefully examine the URL for any discrepancies, even if the brand name appears familiar. Always navigate to a known brand's official website independently.
• Scrutinize Extreme Discounts: Be cautious of prices that are significantly lower than those offered by other retailers. Research the seller before purchasing.
• Research Unfamiliar Retailers: Search for independent reviews and reports that may link the store to scams. Check the company's contact information for legitimacy.
• Use Credit Cards for Purchases: Credit cards generally offer better fraud protection than other payment methods. Consider using virtual card numbers if your issuer provides them.
• Read Bank Verification Messages Carefully: Always verify the merchant and transaction details in bank verification messages before entering codes.
• Enable Transaction Alerts: Set up notifications from your bank or card issuer to quickly spot any unauthorized charges.
• Use Strong Security Software: Maintain up-to-date antivirus software, though exercise personal judgment as new fake sites may not be immediately detected.

What to Do If You Fall Victim

If you suspect you have entered your payment information on a fake shopping site, act immediately. Contact your card issuer or bank using the official number on your card or through their official app. Inform them about the fraudulent website and ask about securing or replacing your card. Monitor your accounts for suspicious activity and report any unauthorized transactions. If you reused passwords on other sites, change them immediately and consider using a password manager.

Nebty has made its DoppelCart database available for public search at investigations.nebty-id.com/doppelcart, allowing users to check if specific brands or domains are associated with the operation.