119,000 fake shops could steal your credit card details

This post was originally published on this site.

Google general counsel explains AI-powered phishing rise

Halimah Delaine Prado, Google General Counsel, reveals the rise of AI-powered phishing scams originating from China’s ‘outsider enterprise.’ She explains how these criminals use artificial intelligence to create highly convincing fake websites, impersonating trusted brands like T-Mobile to defraud hundreds of thousands of Americans, causing millions in losses.Prado highlights Google’s strategy to combat these evolving threats.

You find a product you want for 65% off.The site looks polished, the branding feels familiar, and the deal seems hard to pass up.That could be exactly the trap.

Cybersecurity company Nebty has linked about 119,000 domains to afake shopping operationcalled DoppelCart.The sites impersonate legitimate businesses and can steal payment details at checkout, including one-time bank verification codes.

BleepingComputer reports that more than 105,000 DoppelCart shops were active in Nebty’s latest scans, while Nebty says the majority of the cluster remains online.So, before you jump on a huge discount from a store you do not recognize,take a closer lookat who is really behind the checkout page.

FAKE RENTAL LISTING SCAMS CAN COST YOU THOUSANDS

Before entering payment information into an online storefront, check the web address and make sure the retailer is one you recognize and trust.(Kurt “CyberGuy” Knutsson)

NEW!🩺 Free CyberGuy LIVE class: Get Better Healthcare With AI Saturday, September 26 at 11 a.m.ET / 8 a.m.PT

Kurt “CyberGuy” Knutsson will show you five practical ways AI can help you organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare smarter questions for your doctor.No technical experience is needed.

Save your free spot at CyberGuyLive.com.

What is DoppelCart?

Nebty discovered DoppelCart while investigating fake shops that targeted several of its customers.Researchers noticed that stores impersonating different companies shared technical characteristics.They began following those connections through publicly available website scans.

The investigation eventually grew to roughly 119,000 associated domains.Nebty says that, to its knowledge, DoppelCart represents the largest publicly documented fake-shop cluster when measured by associated domains.

The company also makes an important point about attribution.Shared infrastructure does not prove that one person or organization controls every DoppelCart store.

Even so, the technical overlap is striking.Nebty CEO Benedikt Scheungraber told BleepingComputer that 96% of the confirmed shops shared identical build files and resolved to 27 commerce backends.

DoppelCart has swallowed a huge piece of the .shop domain

Most of the domains connected to DoppelCart use the .shop top-level domain.Nebty’s September 2026 data included 118,787 distinct .shop domains linked to the cluster out of 4,361,908 .shop domains in the company’s snapshot.That’s 2.72%, or roughly one out of every 37 domains in that particular data set.

However, that number needs some context.Nebty says the snapshot represents domains listed in the .shop DNS zone.It does not tell us how many legitimate or fraudulent stores were operating at the same moment.

For comparison, researchers previously documented BogusBazaar, a fake-shop operation involving more than 75,000 domains.Nebty cautions that observation periods and counting methods differ between investigations, so the numbers are not perfectly comparable.

We reached out to GMO Registry, which operates the .shop domain, for comment but did not hear back before our deadline.

Why DoppelCart fake shops can look so convincing

The days when everyscam websitelooked like somebody threw it together in five minutes are long gone.DoppelCart sites can copy product catalogs from real companies along with descriptions, branding and other material.

In some cases, researchers found fake stores loading assets directly from the legitimate company’s servers.That creates a real problem for shoppers.

You may recognize the brand.The products look right.Nothing on the page immediately screams scam because much of the material came from the real business in the first place.

Scheungraber says DoppelCart shops mimic 44,182 different brands, with a median of two clones for each brand.

Some brands received much more attention.Researchers found more than 30 shops apiece targeting companies including SodaStream, Velasca, CurrentBody, Daniel Wellington, Dreame, Horze, MOVA and SPARK PAWS.

That 65% discount can be the hook

This is where the scam can catch you.Most of us shop around before spending money online.Finding the same product at a dramatically lower price can feel like a great deal.DoppelCart stores take advantage of that reaction.

Researchers found fake shops advertising discounts as high as65%.Of course, a steep discount does not automatically mean you’re looking at a scam.Real stores run clearance sales every day.

Still, if you’ve never heard of the retailer and its price beats everyone else by a mile, spend another minute checking who you’re buying from.CyberGuy has a full guide on the warning signs worth checking before buying from an unfamiliar website:Tips to help you tell if an online store is real or a scam.

‘THE ODYSSEY’ STREAMING SCAM COULD STEAL YOUR BANK INFO

A person holding a phone while shopping online

DoppelCart checkout pages can capture card details and other personal information as shoppers enter it online.(Kurt “CyberGuy” Knutsson)

How DoppelCart fake shops steal your card details

The real danger starts when you decide to check out.Nebty tested several checkout pages tied to the DoppelCart cluster and found code collecting:

Card numbers
Expiration dates
Security codes
Cardholder names
Email addresses
Phone numbers
Physical addresses

According to the researchers, those fields can be transmitted through WebSockets to command-and-control infrastructure in real time.So, an attacker may receive the information while you’re still sitting on the checkout page.

The technique has similarities to web skimming, where malicious code captures payment information as a shopper types it into an online checkout page.We’ve previously broken down how that kind of attack works and why shoppers may see no obvious warning:Web skimming attacks target major payment networks.

Your one-time bank code can be captured too

This is the part I find especially concerning.Many of us have been trained to see a verification code from our bank as an extra layer of protection.DoppelCart can potentially turn that security step against you.

Nebty found that the checkout code can relay the one-time confirmation code issued by a victim’s bank.Attackers may then try to use the code to get past protections surrounding a fraudulent transaction.

So, don’t automatically enter a bank code simply because a checkout page asks for it.Read the bank’s message carefully.Look at the merchantand transaction details if they’re included.

If something does not match the purchase you’re making, stop the transaction and contact your bank through its official app or the number printed on your card.

The legitimate business can get dragged into the scam

DoppelCart creates another headache after the purchase.Some fake shops display the real company’s legitimate customer support address.

Now imagine you place an order and nothing arrives.You find the support information on the site and contact the business demanding to know where your purchase went.

The company you’re calling may have no idea what you’re talking about because you never bought anything from it.Nebty says legitimate businesses have received complaints from shoppers over orders those businesses never processed.

The scammer gets the payment information.Meanwhile, the legitimate company gets the angry customer and has to explain that somebody copied its store.

Nebty says it tried to contact the main hosting provider associated with DoppelCart sites but received no response.Want to see whether a brand or website appears in the DoppelCart investigation?Search Nebty’s DoppelCart database atinvestigations.nebty-id.com/doppelcart.

APPLE PAY TEXT SCAM THREATENS $8,250 LOSS IN 35 MINUTES

Fake online stores can copy legitimate product pages and branding, making it harder to tell when you are shopping on a scam site.(Kurt “CyberGuy” Knutsson)

How to spot a fake online store before you pay

A professional-looking site no longer gives you enough information to decide whether a retailer deserves your trust.Instead, slow down when you’re shopping somewhere unfamiliar.

1) Check the exact web address

Look at the domain in your browser before entering payment information.A fake site may use a recognizable company name inside a completely different domain.If you’re trying to buy directly from a well-known brand, find its official website independently.Also, don’t let the padlock or HTTPS fool you.HTTPS tells you a website encrypts the connection.It does not prove the seller behind the site is legitimate.Scammers can encrypt websites too.

2) Take another look at an extreme discount

A 65% discount can make you want to buy before the deal disappears.That’s when I would slow down.Check the product on the company’s official website or compare it with a retailer you already know.If the price difference looks unusually large, investigate the seller.

3) Research an unfamiliar retailer

Search the store’s name before buying.Look beyond reviews displayed on the website itself.Search for independent complaints or reports that connect the domain to scams.Then check the company’s contact information.A cloned website can look impressive while having very little legitimate history behind it.

4) Pay by credit card when possible

The Federal Trade Commission recommends paying by credit card when possible for online purchases because credit cards provide protections when a transaction goes wrong.Some issuers also let you use virtual card numbers for online purchases.Availability varies by issuer.A virtual number can keep your primary card number away from the merchant and may let you shut down the virtual number if something goes wrong.

5) Read bank verification messages carefully

Don’t treat a one-time verification code as a routine box to fill in.Read the message your bank sends.If the merchant or transaction looks unfamiliar, do not enter the code.Contact your card issuer through a trusted channel instead.

6) Turn on transaction alerts

Check whether your bank or card issuer lets you receive notifications when purchases hit your account.Alerts can help you spot an unfamiliar transaction quickly.Do not ignore a small charge simply because the amount looks harmless.Any transaction you don’t recognize deserves a closer look.

7) Use strong security software

Strong antivirus software can help warn you about known malicious websites and dangerous links.Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android &iOS devices atCyberguy.com

However, no program catches every newly created fake shopping site.That means your own judgment still plays an important role when a store you’ve never heard of suddenly offers the deal of the year.

What to do if you already entered your card on a suspicious shop

Act quickly if you think you purchased from a DoppelCart site or another fake retailer.The FTC recommends contacting the financial institution you used to make the payment as soon as possible.

Contact your card issuer right away

Use the number on the back of your card, your bank’s official app or its official website.Tell the issuer that you entered your card information on a suspected fraudulent website.Ask whether the card should be locked or replaced with a new number.If you also entered a one-time verification code from your bank, tell them that too.

Check your account for suspicious charges

Review your recent transactions and continue watching the account.If you paid the fake retailer, tell your issuer that you believe thetransaction involved a scam.Also report any other charges you do not recognize.The FTC recommends asking the card issuer or bank whether it can reverse the fraudulent transaction and return your money.

Change any password you reused

If the fake store asked you to create an account and you reused a password from somewhere else, change that password on the other accounts.Give important accounts unique passwords.Apassword managercan help generate and store strong passwords without forcing you to remember every one.

Watch for follow-up scams

Remember what DoppelCart checkout pages can collect.The people behind the operation may have your contact information along with payment details.Be suspicious of unexpected bank warnings, delivery messages or refund offers connected to the purchase.Scammers sometimes target people who already lost money and then pose as someone who can help recover it.Go directly to your bank or the company’s official website rather than clicking a link in an unexpected message.

Run a security scan if you downloaded something

If you downloaded a file, installed software or gave the suspicious site additional access to your device, update your security software and run a scan with strong antivirus software.If all you did was type card information into the fake checkout, focus first on protecting the payment account and watching for fraudulent transactions.

Report the fake store

Report suspected fraudto the Federal Trade Commission atReportFraud.ftc.gov.Reports can help authorities identify fraud patterns and investigate scam operations.

Kurt’s key takeaways

What bothers me most about DoppelCart is how convincing these fake stores can look.You may recognize the products and the branding because scammers copied them from a real business.For me, that changes how I look at a bargain from a store I don’t know.If the price seems unusually low, I want to know exactly who I’m buying from before I enter my card information.Take a minute to check the web address and search for the retailer on your own.That small pause could save you from having to replace your card or deal with fraudulent charges later.

Have you ever landed on an online store that looked completely legitimate but something made you suspicious, and what tipped you off?Let us know by writing to us atCyberguy.com.

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
For simple, real-world ways to spot scams early and stay protected, visitCyberGuy.com–trusted by millions who watch CyberGuy on TV daily.
Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

onelink.me/xLDS?pid=AppArticleLink&af_web_dp=https%3A%2F%2Fwww.

Kurt “CyberGuy�Friends.” Got a tech question?Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.