Online Shopping Scams: How to Check a Store Before You Buy

A fake store is built to survive one look and not two. It has photographs, prices, a checkout, and a countdown, and it usually has no address, no phone number, no return policy that makes sense, and a payment page that steers you away from a credit card. Most of them fall apart in a few minutes of checking. This guide covers the checks that do that, why the payment method is half the protection, and what to do if you have already paid.

By Prudents·6 min read

September 21, 2026, 7:20 PM·Updated September 24, 2026, 5:20 PM

A woman sitting on a living-room rug with a laptop on the coffee table and a bank card in her hand

How an online shopping scam works

An online shopping scam is a store that takes payment and does not deliver what it promised. Sometimes nothing arrives at all. Sometimes a cheap substitute arrives, which is worse for you, because a delivered package makes a dispute harder to win.

The shopfront is cheap to build. Product photographs are copied from real retailers, the layout comes from a template, and the domain costs a few dollars. What makes it work is traffic: a paid ad in a social feed, a sponsored search result, a link in a marketplace listing, or a code on a flyer. The offer is a well-known item at a price nobody else is close to, and there is a timer.

Non-payment and non-delivery is one of the larger reported categories in the FBI Internet Crime Complaint Center’s 2025 Internet Crime Report, with 56,478 complaints and 503,373,587 dollars in reported losses that year. The average loss is small next to investment fraud, which is exactly why these stores keep running.

The distinction that decides this

Checking the store tells you whether to buy. The payment method decides what happens if you were wrong. A credit card carries a federal dispute process; a wire transfer, a gift card, cryptocurrency and a person-to-person payment app transfer generally do not. Do both checks, because the second one is the only one that still works after the money leaves.

The checks that expose a fake store in a few minutes

Run these before you enter a card number. Any single one can be explained away; three failures together are an answer.

Search the store name with the word scam or complaint. This is the FTC’s first suggestion on its page about shopping online, and it costs thirty seconds. Also search the exact product photograph if you can, to see whether it belongs to a different retailer.
Look for a real address and a real phone number. Not a contact form. A street address you can find on a map, and a number that a human or a real voicemail answers. A store that will take your money but not a phone call has told you something.
Read the return policy and the shipping page. Look for who pays return shipping, the window to return, and where returns go. A policy that is missing, copied from another brand, contradicts itself, or sends returns to another country is a failure.
Check the domain age and the spelling. A store claiming twenty years in business on a domain registered last month is not that store. Watch for a familiar brand name with an extra word, a hyphen, or a different ending attached.
Distrust reviews on the site itself. Reviews on the seller’s own page are whatever the seller wants them to be. Look for the store’s name in places it does not control, and be suspicious when every review is five stars, posted the same week, and written in the same voice.
Watch the checkout for a switch. If the card option fails and the page then offers a wire, a gift card, cryptocurrency, or a transfer through a payment app to a person, stop. That is the scam presenting itself.

One more, for the price itself: if a current-model item is sixty or seventy percent below every other seller, the discount is the bait. Real clearance exists, but it does not usually appear on a store nobody has heard of, for the item everyone wants, on the week it is hardest to find.

A hand writing notes on a small notepad beside a laptop and a bank card — Illustrative scene: writing down the seller’s address and phone before paying makes the store easy to check and easy to find later.

Where a fake store usually finds you

Most people do not go looking for these stores. The store comes to them, through a channel that carries some borrowed credibility.

Paid ads in social feeds are the main one, because targeting is cheap and a rejected ad can be reposted under a new page the same day. Sponsored results above a search listing work the same way. A link in a message from a friend’s compromised account carries more weight than any ad, and that is the point of taking over the account.

Codes on printed material are a growing version of the same route, and they hide the address until you scan, which is why our guide to QR code scams exists. Around disasters and holidays the same infrastructure gets pointed at donations instead of products, which is covered in charity scams.

None of this means an ad is a warning sign by itself. Real stores advertise. It means the ad is not evidence about the store, so the checks still have to happen.

Why the payment method is part of the defense

The payment method decides what rights you have when a purchase goes wrong, and those rights are not the same across methods. A credit card gives you the most room, and the FTC says plainly that you should never buy from an online seller that insists you can only pay with gift cards, wire transfers, a payment app, or cryptocurrency.

With a credit card, federal billing error rules let you dispute a charge for goods that were not delivered or that arrived not as described. The FTC’s guide to disputing credit card charges explains the written notice and the deadline: your letter has to reach the issuer within sixty days after the first bill containing the error was sent to you. For charges made without your permission, Regulation Z caps your liability at the lesser of fifty dollars or the amount charged before you notify the issuer. Our guide to how to dispute a credit card charge walks through the evidence to keep.

A debit card is a weaker position for a purchase dispute, because the money has already left your account and the protections work differently. The FTC’s comparison of card protections shows how debit liability grows with the delay in reporting, while the credit card cap does not.

A wire transfer, a gift card code, a cryptocurrency payment, or a transfer sent through a payment app to a person are, in practice, closer to handing over cash. There is no built-in dispute process behind them, and recovery depends on getting to the provider before the money is collected, which is rarely possible.

Where a disposable card number fits

A virtual card number can limit what a leaked number is worth to whoever takes it, which is useful with a seller you do not know. It does not make the seller honest, and it does not refund anything. Its limits, including the cases where it actively gets in the way, are covered in virtual credit cards.

What the rules say about delivery and refunds

A seller cannot simply keep your money and go quiet. Under the FTC’s Mail, Internet, or Telephone Order Merchandise Rule, a seller that does not state a shipping time must have a reasonable basis to expect it can ship within thirty days of a properly completed order. If it cannot ship on time, it has to notify you, give you a revised date or say it cannot give one, and offer you the option to cancel for a full refund.

That rule is a real lever with a slow but real business. It is not a recovery tool against a store that never intended to ship, because a store that vanishes is not going to honor a refund notice. Its practical value is that it tells you when a delay stops being a delay: once the promised date passes with no notice and no option to cancel, you have stopped waiting and started disputing.

There is a separate rule worth knowing if something turns up you never ordered. The FTC’s page on being billed for things you never got explains that merchandise you did not order is generally yours to keep, and you do not have to pay for it. A bill that follows an unordered package is a claim to examine, not an obligation to settle.

What to do after you have paid a fake store

Move on the payment first, because every protection you have depends on the payment channel and on how quickly you use it.

In the first hour, contact your card issuer or bank. Say the charge is for goods not delivered or not as described, or that you believe the charge was unauthorized, and ask what their process requires. If you paid by wire or through a payment app, call the provider and ask whether the transfer can still be stopped. Speed is the variable you control.
Put the dispute in writing. For a credit card billing error, the FTC’s guidance is a written notice reaching the issuer within sixty days of the first bill with the error. Send it in a way that leaves a record of delivery, and keep a copy.
Collect the evidence now, while the store is still up. Screenshots of the listing, the price, the promised delivery date, the order confirmation, the payment receipt, and every message you sent the seller. Fake stores disappear, and the page you did not save is gone.
Change the password if you created an account on that site, and change it anywhere you reused it. Treat the card number you entered as exposed and ask for a replacement.
Report it at ReportFraud.ftc.gov and to the FBI’s Internet Crime Complaint Center. If the store reached you through an ad, a marketplace, or a social platform, report the listing there too, because that is what gets it taken down.

If you are weighing a refund request against a dispute with the card issuer, they are not the same instrument and they do not have the same timeline. Chargeback vs. refund explains which one applies.

Where to report an online shopping scam

Report to the FTC at ReportFraud.ftc.gov. The FTC does not resolve individual cases, but the reports are what build the pattern that enforcement runs on.

Report to the FBI’s Internet Crime Complaint Center, which collects internet crime complaints and routes them to investigators, and include the payment details, the site address, and the dates.

Report to your state attorney general as well, since state consumer protection offices handle individual complaints in a way the federal agencies usually do not. If the payment involved a bank, a card issuer, or a payment service and you are not getting anywhere with them, you can file with the Consumer Financial Protection Bureau, which forwards complaints to the company and asks for a response.

Our guide to how to report a scam covers the order to do all of this in and what each agency actually does with the report.

What these checks cannot do

The checks raise your odds. They do not settle the question, and a page that promised certainty would be lying to you.

Some fake stores are well made. They buy an aged domain, publish a plausible return policy, answer the phone for a week, and ship a few real orders to build reviews before the exit. Some are not fake stores at all but real sellers that fail, which looks identical from the outside until the refund does not arrive.

Recovery is the harder limit. A credit card dispute is a process with a defined path, not a promise of money back, and the outcome depends on the evidence and the timing. Payments by wire, gift card, cryptocurrency, or a transfer to a person are rarely recovered. Any service that offers, for a fee, to get your money back from a store that took it should be treated as the second scam of the day.

It is also worth saying that these stores are built by people who test what works on thousands of shoppers. Being taken in by one is not a failure of attention. It means the ad found you on the day you were looking for that exact thing.

Online shopping scam FAQ

How can I tell if an online store is legitimate?

Check four things before you pay: a street address and a working phone number, a return policy that names who pays return shipping and where returns go, the age of the domain against the years in business the store claims, and what people say about the store somewhere the store does not control. Then look at checkout: a store that pushes you toward a gift card, wire transfer, cryptocurrency, or a person-to-person payment app is failing the most important test.

What is the safest way to pay an online seller I do not know?

A credit card, because federal billing error rules give you a written dispute process for goods that never arrive or arrive not as described, and Regulation Z caps liability for unauthorized charges at fifty dollars. A debit card puts your own cash at risk first and the protections work differently. Gift cards, wire transfers, cryptocurrency and person-to-person payment app transfers have no comparable dispute process, which is why scammers ask for them.

The store never shipped my order. What are my rights?

Under the FTC’s Mail, Internet, or Telephone Order Merchandise Rule, a seller that gives no shipping time must have a reasonable basis to expect it can ship within thirty days, and if it cannot ship on time it must notify you and offer you the chance to cancel for a full refund. If the seller ignores that, take it to your card issuer as a billing error, in writing, within sixty days of the first bill showing the charge.

Can I get my money back after paying a fake store?

Sometimes, and it depends almost entirely on how you paid and how fast you move. A credit card charge can be disputed with the issuer through a defined process, though the outcome depends on the evidence. Wire transfers, gift cards and cryptocurrency are rarely recovered. Contact the payment provider first, then report to ReportFraud.ftc.gov and ic3.gov. No one can promise recovery, and anyone who charges a fee to promise it is running another scam.

A package arrived that I never ordered. Do I have to pay for it?

Generally no. The FTC says merchandise you did not order is yours to keep and you are not required to pay for it. If a bill or a text follows demanding payment or a fee, treat it as a claim to verify rather than a debt, and check your card and account statements, because unordered packages are sometimes tied to an account or an address being used without your knowledge.