Fake websites and online shopping scams

Buying from a fake shopping website is one of the most common scams in the UK, and it usually starts the same way: a professional-looking site, a price that seems too good to miss, and a payment page that feels perfectly normal. Criminals create fake websites, clone the websites of well-known retailers, list fake items on online marketplaces and advertise non-existent products on social media¹. Some even send fake invoices and receipts afterwards so the purchase looks genuine¹.

The good news is that fake shops leave clues. A web address registered weeks ago, reviews that read oddly alike, a "contact us" page that does not exist: these are all checkable before you pay². And the way you pay matters enormously afterwards. A credit or debit card gives you routes to get your money back; a bank transfer gives you far fewer, and a gift card gives you almost none³.

How fake shopping websites work: cloned shops and goods that don't exist

A fake shopping website is designed to be indistinguishable from the real thing at a glance. Some are complete inventions: a shop that has never existed, with a catalogue of products that will never be posted. Others are clones, copies of a well-known retailer's site with the same logos, layout and product photos, but a web address that differs slightly from the genuine one. Copycat websites of this kind imitate genuine companies, organisations and even authorities⁶. Scammers can also use spoofing, software that makes a display name or phone number appear to belong to a genuine organisation⁶.

The hook is almost always price. Scam websites use extremely low prices to lure bargain-hungry shoppers into buying fake, counterfeit or even non-existent items². The site may look polished, take your payment without any error, and send you a confirmation email with a tracking number that never updates. In some cases nothing arrives at all; in others you receive a counterfeit or worthless item, which makes the purchase harder to dispute because a parcel did turn up.

Ticket scams follow the same pattern with an extra twist of urgency. Criminalinals use social media, messaging apps, online marketplaces, fake websites and cloned ticketing pages to sell tickets for concerts and events that either do not exist or have already been sold to someone else⁷. The pressure of a release day or a sold-out show makes buyers less careful, which is exactly what the scammer is counting on. If you think you have paid for a fake ticket or shared your financial information with a criminal, contact your bank immediately⁷.

Fake shops rarely stand alone. They are fed by adverts on social media, sponsored search results, messages and emails containing links, and even AI-generated summaries and chatbot answers that can suggest scam shopping websites². The website is the last step in the chain, which is why the checks in the next two sections start before you ever reach the payment page.

Signs a website or seller may be a scam

No single sign proves a website is fraudulent, but several together should stop you reaching for your card. The most telling is age: a recently registered website could indicate that it's a scam, and you can check when a domain was created using a domain checker such as who.is². A shop claiming years of happy customers whose web address was registered three weeks ago is a contradiction worth walking away from.

Look at the practical details every genuine trader needs:

• Contact information: a website without a "contact us" page could well be fraudulent, though the presence of contact details is not itself a guarantee of legitimacy².
• Policies: a site selling products should have a shipping and returns policy, terms and conditions, and a privacy policy³.
• Reviews: oddly similar reviews, very new reviewers, non-factual or overly factual reviews, and very few reviews at all are red flags, and similar reviews across several websites may be a warning sign³.
• Prices: extremely low prices are the lure itself, used to draw shoppers into buying fake, counterfeit or non-existent items².

The government's scam checklist applies to any approach, not just websites. It could be a scam if it pressures you into making a decision, sets a short deadline, is threatening or unexpected, asks for personal information such as bank details, tells you to transfer money, says you have to pay to apply for something, claims you have unclaimed credits, or offers a discount, refund, rebate or grant⁸.

You do not have to rely on your own eye alone. Get Safe Online runs a "Check a website" tool that assesses whether a website might be a scam⁹, and the tools in the next section can check individual sites, numbers and accounts. Be careful with search results and AI assistants: AI summaries on search engines and chatbots may also suggest scam shopping websites, so treat a recommendation as a starting point for checks rather than an endorsement².

Checking a website, phone number or bank account before you pay

Before entering card details, run through a short routine. First, check the payment page itself: make sure the website address starts "https", not just "http", as this means the site is secure⁴. Then check who is behind the address. A domain checker like who.is can tell you when the website was created, and a newly created website should raise alarm bells³.

Independent tools go further. The ScamAdviser website can help detect whether scam websites, numbers or bank accounts are legitimate: you type in a website address, phone number or crypto address and see a trust score indicating how likely it is to be a scam¹⁰. Another service, Ask Silver, carries out legwork such as visiting webpages to check for warning signs, looking up the company behind the website, and checking for reports or reviews on the scam or the company behind it¹⁰.

If a seller asks you to pay by bank transfer, treat that as a warning in itself. Take Five's advice on purchase fraud is blunt: be suspicious of any "too good to be true" offers, avoid clicking on links in social media or email offers, type the website into your browser yourself, use secure payment methods recommended by reputable online retailers, research the company or seller and read reviews, and avoid paying by bank transfer¹.

When you do make a bank transfer, a UK-wide service called Confirmation of Payee checks whether the name of the account you are sending money to matches the name you have entered, and alerts you when there has not been a match¹¹. It is designed to help prevent authorised push payment scams and misdirected payments¹¹. A mismatch, or a name that only partly matches, is a strong signal to stop and query the account before sending money. The dedicated page on what to do when Confirmation of Payee shows no match explains the alerts in detail.

Fake messages and links that lead to scam sites

Most people do not find fake websites by accident; they are led there. A text might ask you to follow a link to fix a problem with an account or track a parcel, leading to a fake website where you are asked to log in¹². Clicking on links can also lead you to cloned websites or download malware, malicious software that can take over your phone and access your data¹³.

The warning signs of a scam message are consistent across texts and emails: inaccurate spelling and wording, a sense of urgency to act quickly, requests for bank details or passwords, being told not to tell anyone, and an unfamiliar sender address¹⁴. With emails, the sender's address can be viewed by hovering the cursor over or right-clicking the sender's name; scam emails usually come from unrecognisable addresses¹⁵. Scam emails may also contain information such as account numbers and IDs designed to trick you into thinking the email is official, and these can be checked against your own records¹⁵.

A real example shows how convincing these can be. In September 2026, Which? confirmed that a text claiming an unpaid RingGo parking balance, including a link to enter your vehicle registration number and make a payment, was a scam being sent to huge numbers of people¹⁶. The advice: avoid clicking on any links in messages and go straight to your RingGo app or type myringgo.co.uk into your browser. Do not reply to the message, report it by forwarding it to 7726, then delete it, and report scam websites to the National Cyber Security Centre¹⁶. Anyone who shares personal or payment information through such a link should contact their bank immediately and change all relevant passwords¹⁶.

Do not reply to, call or click through on a suspicious text even to challenge it. Replying only lets scammers know your number is in use and may lead to more scam messages and calls, and the number has likely been spoofed, so you may be messaging an innocent person whose number was stolen¹³. Scam emails can be reported by forwarding them to report@phishing.gov.uk, and phishing websites can be reported to the National Cyber Security Centre¹⁷. The page on forwarding suspicious texts to 7726 explains how the reporting service works.

Scammers pose as regulators and trusted names too

Fake websites do not only imitate shops. An impersonation scam is when you are convinced to make a payment or give out your personal or financial details to a criminal claiming to be a trusted organisation or someone you know¹⁸. In banking fraud, criminals often impersonate trusted organisations such as banks, HMRC and broadband providers to get this information¹⁹. Scammers can even mimic an official telephone number, which can trick you into thinking the caller is from a legitimate organisation such as a bank or utility company¹².

Regulators themselves are impersonated. The Financial Ombudsman Service advises consumers to use the Financial Conduct Authority's Firm Checker to confirm a firm is authorised and help avoid scams²⁰, and the FCA warns that consumers should check the contact details they are given match those listed on Firm Checker, to avoid scammers pretending to be a real firm²¹. The Payment Systems Regulator has issued its own warning about fraudsters posing as PSR employees²². For suspected investment or pension scams, FSCS guidance is to check the details of the investment and whether the provider is genuine on the FCA's website²³.

The Financial Services Compensation Scheme lists seven signs that a message is not really from it: being asked for money or payment details; the message coming from an unusual channel such as WhatsApp; a phone number that is not on the official website; an email not ending @fscs.org.uk; involvement of an unregulated firm such as a cryptoasset provider; compensation offered in a foreign currency or by a firm in another country; and American spellings or spelling errors²³. The same logic applies to any official-sounding approach: contact the organisation yourself, using details you look up independently, never the ones in the message.

If the approach concerns an investment or pension, the FCA's Warning List and ScamSmart service are the places to check, and the site has a dedicated page on the FCA Warning List and ScamSmart. If it concerns a bank, the page on how to check your bank is really contacting you sets out the steps.

Paying by card: fraud protection and your liability

The single most important decision you make with a fake shop is the payment method. If you are asked to pay for something online via a bank transfer, do not do it: with a credit or debit card you have some rights to get your money back, but with a bank transfer your main option is to contact your bank immediately³.

Card fraud happens when criminals get hold of your card details, for example through a fake website or a phishing message, and then use this information to purchase goods or services, which will be charged to your card²⁴. The protection advice is to avoid clicking on links in emails, texts and social media, and always verify the website you are on²⁴. If you spot transactions on your bank statements that you do not recognise, contact your bank immediately¹⁹.

Contactless is as safe as chip and PIN in fraud terms. Contactless payments offer the same level of fraud protection as standard chip and PIN transactions²⁵, and contactless works up to £100 per transaction without a PIN²⁵. Some banks and building societies are offering to remove the £100 maximum to an unlimited spending amount, and you may be able to ask your bank to reduce this unlimited payment option, fix your own limit, or remove contactless from your card altogether²⁵. If your card is lost or stolen you may be protected against fraudulent activity and will not be liable for any losses, unless you have given your card to someone²⁵.

Contactless is now a huge part of UK payments: contactless debit and credit card payment volumes totalled 19.2 billion in 2025, up from 18.9 billion in 2024, and 39% of all payments in the UK were made via contactless methods in 2025²⁶. By 2035 contactless payments are expected to be 41% of all payments, accounting for 26 billion payments²⁶.

The diagram shows the practical difference. A card payment can be reversed through the card schemes; a bank transfer is you instructing your bank to send your own money to another account, which is why the rules on authorised push payment reimbursement matter so much. The site's comparisons of credit card versus debit card protection and bank transfer versus card payments set out the detail, including the difference between authorised and unauthorised payments.

Gift cards: why scammers ask for them and what they are worth

Some fake shops and many individual scammers ask for payment in gift cards. The reason is simple: scammers love gift cards because they are easy to buy, hard to trace, spent quickly and can be sold on²⁹. Once you read out the code on the back of a card, the money is effectively gone, and scammers steal millions from gift cards every year²⁹.

There is also a physical version of the scam that does not involve a fake shop at all: gift card draining, where fraudsters take the codes from the physical cards displayed in the shop and then steal the funds once money has been loaded onto the card²⁹. A card hanging on a shop rack can therefore already be compromised before you buy it.

If you think you have been conned in a gift card scam, contact your bank and the gift card provider immediately to try and recover your money; sometimes the gift card provider will be able to block the gift card²⁹. One provider, One4all, has said that customers who have experienced fraudulent activities on their gift card should contact its customer service team, and that it will reimburse their gift card²⁹. The page on getting money back after paying a scammer by gift card covers the options in full.

Paid a fake website? Contact your bank straight away

Speed matters more than anything else once you realise you have been scammed. The recommended step as soon as you realise you have fallen victim to a scam is to contact your bank to report it⁵. This means calling your bank immediately using the number on the back of your bank card, and reporting it to Report Fraud, formerly known as Action Fraud¹⁷. Take Five gives the same guidance: contact your bank immediately if money or account details are involved, and report it to the police at reportfraud.police.uk or on 0300 123 2040³⁰.

The Financial Ombudsman Service sets out the immediate steps for scam victims: contact your bank or payment services provider immediately, contact the police on 101, report the scam to Report Fraud, and keep records of all contact and correspondence between you and the scammer³¹. Keeping the screenshots, emails, order confirmations and payment references matters, because they are the evidence your bank, the card schemes or the ombudsman will later rely on.

What happens next depends on how you paid. If you paid by bank transfer, your bank will assess whether the payment counts as an authorised push payment scam, and the rules on reimbursement, including the maximum refund, the £100 excess and the consumer standard of caution, decide what you get back. If you paid by card, the routes are chargeback and, for credit cards, the statutory protections described in the next section. In both cases, if you think your card details or online banking have been stolen or hacked, speak to your bank or building society straight away³², and check your statements for transactions you do not recognise, since you will usually get a refund if it is fraud and unrecognised transactions are reported quickly³².

The site's pages on first steps for victims, claiming a refund from your bank and how to complain to your bank about a scam refund walk through each stage in more detail.

Chargeback and complaints when a trader won't help

If a fake or failing trader will not return your money, your card provider may. If you can provide evidence of a breach of contract, for example goods that are not delivered or a service that was not carried out, you can ask your card provider to attempt to recover the payment through the chargeback scheme³³. With a debit card, you may be able to use chargeback if goods are not delivered, arrive damaged or not as described, or the trader goes out of business²⁵.

Chargeback is a scheme, not a legal right, and it has limits. If you used a debit card or a credit card to service an online payment method such as PayPal, it is unlikely that you will be able to use either the Consumer Credit Act 1974 or the chargeback scheme to claim from your card provider²⁸. In practice that means paying a stranger "through PayPal" with a card behind it can leave you with fewer options than paying the seller directly by card.

If the trader disputes your claim, the card scheme decides between the trader's bank and yours. When a buyer complains they have not been refunded for goods not received or not as described, the Financial Ombudsman Service usually considers evidence about the goods or services, such as the seller's original description, and whether the goods or services were significantly different from that description³⁴. So the listing you screenshotted at the time of purchase is worth keeping.

In Northern Ireland, Consumerline offers an online service to make a complaint against a trader, report a fraud or ask about consumer rights; you give details of what happened and when, the trader's contact details, and whether you have contacted the trader and if they replied³⁵. The page on where to report a scam covers the equivalent routes in England, Wales and Scotland.

Where disputes go next: Citizens Advice, Trading Standards and the ombudsman

Not every bad online purchase is a scam, and the routes differ depending on which it is. If the trader is genuine but has breached your consumer rights, Citizens Advice offers guidance on what to do if you have been scammed³⁶, and it can refer your complaint to local Trading Standards Officers, who may then investigate on your behalf³⁷. The government's consumer protection guidance sets out your rights and the enforcement routes for faulty goods and services³⁷.

If the dispute is with a bank or card provider, for example a refused scam refund or a rejected chargeback, the Financial Ombudsman Service is the next step. It is free to use. Answer a few questions on its website and it will let you know whether it thinks it can help and what you need to do next³⁸. The ombudsman can look at complaints involving fraud and scams, including unauthorised payments and identity theft³¹, and its decisions bind the business, not you.

One boundary matters when a bank investigates a bank transfer scam. The Payment Systems Regulator publishes guidance to help payment service providers distinguish between APP scams and civil disputes, because a genuine commercial disagreement with a trader is treated differently from a scam³⁹. If your bank says your payment was a civil dispute rather than a scam, that guidance is what it is applying, and you can challenge the bank's view through the ombudsman. The page on taking a refused scam refund to the ombudsman explains how.

For traders outside financial services, alternative dispute resolution is not automatic. Traders do not have to agree to use ADR for a consumer complaint unless it is compulsory for them by law, by trade association membership or by contract⁴⁰. So while the ombudsman is a compulsory, free route for complaints about banks and card issuers, a general online retailer may not belong to any scheme at all, which leaves court action, including the small claims process, as the remaining route for amounts worth pursuing.