The FBI has issued a security alert, stating that there has been a significant increase in reports of people falling victim to online shopping scams. Specifically, according to the reports, victims of online shopping scams found the scammers’ sites either through direct searches on popular web search engines or through advertisements on social media. In addition, victims purchased items from these sites because the prices were consistently lower than those offered by other online retailers.
$420 million lost to online fraud in five years
According to a report published by the FTC in July, it appears that the number of reports of online shopping scams has been increasing continuously since 2015. Indicatively, in 2019, more than 86,000 reports of victims of online shopping scams were recorded, including reports of orders that never reached their destination. Since 2015, approximately $420 million has been lost in total to victims of online shopping scams.
Additionally, during April and May 2020, the FTC received more reports of problems related to online purchases than in any other month, with half of shoppers claiming they never received what they ordered.
Last year, Malwarebytes uncovered a major online shopping scam that used hundreds of “fraudulent” sites to target consumers looking for the best deal on the latest Nike, Adidas, and Off-White sneakers. When shoppers received sneakers from these scam sites, they found that they weren’t the sneakers they had ordered, and many reported that they never even received their order.
What's worse is that those behind this scamalso provided fake sites with malicious Magecart scripts that they used to steal buyers' credit card information.
How to spot an online shopping scam site?
Based on information gathered from victims' reports, the FBI reports that fake online shopping sites had several common elements, including the following:
- The disposable masks sent from China were received regardless of the order.
- Payments were made using an electronic money transfer service.
- The retail sites provided valid but unrelated US under the “Contact Us”, convincing victims that the retailer was located in the US.
- Many of the sites used content that had been copied from legitimate sites. In addition, the same unrelated addresses and phone numbers were found at many retailers.
According to the FBI, all attempts made by the victims of the scams to receive the items they had ordered or to receive compensation were unsuccessful.
The US Department of Homeland Security and Intelligence has also released other information that can allow users to identify shopping sites used to carry out similar scams, including the following:
- Instead of .com, the fake sites used the Internet top-level domains (TLDs) “.club” and “.top”.
- The sites offered merchandise at significantly reduced prices.
- The URLs or web addresses were registered recently (within the last six months).
- The sites used content that had been copied from legitimate sites and often shared the same contact information.
- The sites were advertised on social media.
- The scammers were using a private domain registration service to avoid publishing personal information in the public Internet Whois.
The FBI advises online shoppers to be wary of any online retailers that use free email as a business contact and that offer significantly discounted prices compared to other online vendors. Shoppers are also advised to look for complaints and reviews from other shoppers about any suspicious online portal , as well as contact information pages to ensure that the online retailer is a legitimate business entity.
