This year Black Friday falls on 27 November, although many shops start their deals days earlier. So do scammers. We have been building online shops for years, and we know how little it takes to put up one that looks legitimate. With AI, it takes even less.

A report published on 20 October by Savi Security, the company behind the Scamwise extension, describes a new fake shop roughly every three minutes, based on reports from its users. Seven in ten are seen only once and 85% disappear within two weeks. These figures come from a company that sells protection, so treat them as a guide. The pattern itself has been seen in Spain by INCIBE, the national cybersecurity institute: in May it warned about sponsored search ads and messaging-app messages impersonating Lidl and leading to fraudulent shops, and during the summer sales it detected a rise in fake shops copying well-known brands.

Before you click

Many fake shops reach people through ads. The same report estimates that at least one in five comes from an ad on a major platform, with Meta and Google as the preferred channels. If a deal shows up on Instagram or at the top of Google's results, do not go in from there: open the shop's official app or type the address yourself.

Be wary of videos of celebrities giving products away or announcing impossible discounts. These days they can be made with AI in an afternoon.

Signs the shop is not what it seems

  • The address looks like the real one but is not quite the same: a changed letter, an extra hyphen, or an ending like .shop or .store for a brand that has always used .com or its country domain.
  • Discounts of 70 or 80% on products that almost never drop that much.
  • There is no legal notice, or it lacks a company name, tax ID and address. In Spain the law requires every online shop to publish those details.
  • Oddly translated text, photos that do not match each other, or five-star reviews all written in the same week.
  • The only payment options are bank transfer, instant payment to an individual, gift cards or cryptocurrency.
  • A "deal ends in 10 minutes" timer that starts again every time you reload the page.

When you pay

Use a card or a well-known payment gateway with buyer protection. If your bank offers it, a virtual or prepaid card loaded with just the amount you need limits the damage if something goes wrong. And if the site asks for the code sent to you by text message to "verify your identity" rather than to confirm a specific purchase and amount, stop there.

Those days also bring plenty of texts and emails from "courier companies" about a held parcel and a link to pay a small fee. With several orders on the way, it is easy to fall for it. Check tracking on the carrier's own website or app, never through the link in the message.

If you have already paid

  1. Call your bank as soon as possible so they can block the card and start their fraud procedure.
  2. Keep screenshots of the ad, the website and the order confirmation.
  3. In Spain, call 017, INCIBE's free cybersecurity helpline.
  4. Report it to the police. Many banks ask for the police report to process the claim.

If you are the one selling

For a small shop, a fraudulent copy does damage twice: it takes sales and it makes customers distrust the real shop as well. It helps to keep your legal notice complete and easy to find, to remind followers and newsletter subscribers which web address is your only one, to register the most obvious variations of your domain, and to search Meta's Ad Library for your brand from time to time. If you find a copy, report it to the platform and warn your customers before they write to you asking about an order they never placed with you.