Fake shops 'decline' your card on purpose to collect more cards

Security firm Sicuranext has uncovered a network of fake online shops that pretend your payment failed so you will type in another card. The card is never charged. The details are already gone. A clean bank statement after a failed checkout does not prove your card is safe.

How the trick works

The shops copy a real brand's name, logo and product photos. The web address changes only one or two letters, such as an "l" in place of an "i". A second address starting with "checkout." handles payment, and shoppers rarely notice the switch.

When you click "Pay", the shop sends your card number, expiry date, security code, name, email, phone, addresses and IP address to the scammers. Only then does it show an error. Every order is marked failed. The message says "Payment failed. Please try another card." After a few tries it suggests PayPal, but that is only a line of text.

Each retry hands over one more card. Researchers counted 9,857 orders and about 23,900 card submissions, more than two per order.

A shop factory

The records show an assembly line. Create a site, paste in a template, change the address, request a security certificate. The fastest shop went from nothing to working in under 15 minutes. Two to four people or computers seemed enough to run it. On October 13, 569 fake addresses copied 71 brands. Cosmetics were the biggest target, with half the brands and six in ten addresses. Most brands are American, and two are Italian.

Who it affects

Anyone who shops online is exposed, especially for cosmetics and skincare. Sicuranext says nothing points to a breach at the copied brands. The scammers only needed a name, a logo and photos, so the brands' own customer data does not appear to be at risk.

Not every clone worked this way. Some passed shoppers to a real checkout with prices in dollars, where a payment could actually go through. There, an unexpected charge is the warning sign.

What to do

The alert box above lists the steps. The most urgent one applies if you entered a card on a shop that then failed: call your bank and replace the card.

What happens next

Shutting down single addresses will not stop this. With dozens of variants per brand, Sicuranext says closing one changes little. The server was also poorly secured, and other intruders took over some of the sites from late September. Sicuranext passed its list of copied brands to the companies concerned. The material does not say how many cards were actually misused or who is behind the network.