Shop smart

How to Spot a Scam Online Store Before You Pay

A disposable storefront is built to last weeks, not years — and that economics leaves fingerprints. The domain is new, the reviews are perfect, the sale never ends, and the refund policy has an exit fee. Each tell takes about a minute to check.

PUBLISHED 2026-08 · REVISED —

By the Better Business Bureau's count, online purchase scams grew from 13% of its Scam Tracker reports involving lost money in 2015 to 64% by 2021 — the single largest category of reported fraud with a monetary loss. The mechanics behind that number are not sophisticated. A storefront template can be filled with someone else's product photos in an afternoon, advertised on social feeds by the evening, and abandoned before the first complaint lands. The BBB's study of fake online retailers put it plainly: if an ad or website is taken down, scammers can immediately replace it with a new one.

That disposability is the weakness. A shop built to vanish cannot afford the things a real shop accumulates — an old domain, mixed reviews, stable prices, its own photography, a returns address that answers. So every corner it cuts is visible, if you know where the corners are. What follows are the tells, in order of value, and a ten-point checklist to run before any card number leaves your hands.

01The domain's age — the highest-value check

Run this one first, because it is the hardest signal for a scammer to fake. Every domain name has a public registration record, and ICANN — the body that coordinates the domain name system — runs a free lookup at lookup.icann.org. Paste in the store's domain, find the Dates block, and read the line marked Created — the day the domain came into existence. No account needed, no interpretation required.

A registration date is not a verdict on its own; legitimate shops open every day, and a new domain selling at ordinary prices with ordinary policies may simply be new. What the date does is test the store's story against the registry's. A site whose footer says "trusted since 2016", whose About page describes a decade of family craftsmanship, and whose domain was registered eleven weeks ago has been caught in a documented lie before you've read a single review. Fraud-industry reporting describes these as ghost stores: temporary storefronts that collect payments, never ship, and disappear within weeks — which is precisely why the domains are always young.

02The review wall that's too clean

Real review sections are untidy. Products people actually receive collect complaints about sizing, slow dispatch, and colours that photographed warmer than they arrived — even excellent products. A storefront showing hundreds of five-star ratings, all recent, all fluent in the same enthusiastic register, is not displaying satisfied customers; it is displaying purchased content. Merchant Fraud Journal, a trade publication covering e-commerce fraud, states the heuristic outright: a store with 200 perfect reviews posted over two weeks is almost certainly fake.

The scale of the problem is not fringe. One analysis of 720 million Amazon reviews, cited by the chargeback-management company Chargeflow, concluded that around 42% of reviews on the platform in 2020 were unreliable — and that is on a marketplace with a moderation budget. On a scammer's own storefront there is no moderator at all: the shop writes its own applause. The practice is squarely illegal in the United States — in August 2024 the FTC finalised a rule banning the sale and purchase of fake reviews, including AI-generated ones from reviewers who don't exist, with civil penalties attached — but a storefront designed to vanish in eight weeks is not deterred by a rule enforced in months.

The countermeasure costs one search. The FTC's standing advice is to read reviews from a wide variety of sources rather than the seller's own pages, and to search the store's name together with the words "complaint" or "scam". A shop with real customers leaves traces across the wider web — forum threads, third-party review sites, social posts, the odd grumble. A shop with none of that, but three hundred ecstatic reviews at home, has an audience of exactly one: you.

03The sale that never ends

Permanent discounting is the disposable storefront's native pricing. Every item sits at 60–80% off a struck-through "original" price that no customer has ever paid; the discount isn't a reduction, it's a costume the real price wears. Often a countdown timer runs beneath it — and here is a test that takes three seconds: reload the page. A timer that resets, or a "closing down sale" that has been closing for months, is not measuring time. It is measuring your willingness to skip the other checks on this page.

Price is also a plausibility check in its own right. A leather handbag involves hide, hardware, cutting, and stitching that cost real money before anyone's margin — the leather-grades guide covers what those inputs actually are. When a "$450" bag is offered at $39, the honest reading is not that you found an inefficiency in the global leather market. It is that the bag was never a $450 object, or was never going to arrive at all.

04Photos that belong to someone else

A disposable storefront rarely owns its own imagery, because photography requires possessing the product. The BBB's fraud study found that scam retailers routinely steal images and content wholesale from legitimate businesses — the pictures are real, the products are real, and neither has anything to do with the site you're looking at.

Reverse image search turns this theft into a tell. Take the store's flagship product photo and run it through Google Lens or TinEye. If the same image appears on a dozen unrelated storefronts, on a wholesale marketplace at a fraction of the price, or on an established brand's site under a different name, you now know what you were actually being sold: someone else's photograph. Supporting tells cluster around this one — mixed lighting and watermark fragments across a supposedly single product line, model shots whose style varies wildly between items, and an About page whose "founders" or workshop imagery also reverse-searches to stock libraries.

05The policy page with an exit fee

The refund policy is the one page a scam storefront must write carefully, because it is where the trap is set. US federal law does not grant a general right to return something you merely regret — with narrow state-law exceptions, returns are whatever the policy says, which the FTC's guidance reflects: a site must state whether you can return an item for a full refund, and it tells buyers to check who pays return shipping, how many days you have, and whether a restocking fee applies. The returns guide goes through the reading routine in full.

Read the policy for three things before checkout. First, an actual return address — a street, not a form. Second, plain full-refund language, rather than "exchanges only", "store credit", or refunds "at our discretion". Third, any mention of partial refunds as a resolution, which on a disposable storefront is not a compromise but the intended outcome. The BBB's study adds the sobering coda: even scam websites that claim a return and refund programme rarely honour it. A generous-sounding policy on a site that fails the other checks here is copy, not commitment.

06How the disposable storefront economy works

None of this requires a criminal mastermind, which is why there are so many of these shops. Dropshipping — taking orders on your own storefront and having a third-party supplier ship directly to the customer — is a legitimate and common retail model; a trade-press estimate from Merchant Fraud Journal puts it at roughly 27% of online stores. The seller never touches inventory, which is efficient when done honestly and nearly frictionless when done dishonestly. The scam variant simply removes the last honest step: charge for the product, and either ship nothing, or ship the cheapest distant cousin of the photo — a $3 catalogue item standing in for the "$89" original.

Because the storefront holds no stock, its only real assets are the ad campaign and the template, and both are disposable by design. When complaints, chargebacks, and platform reports catch up with one domain, the operation reopens under another with the same photos and the same reviews. The industrialisation is accelerating: fraud reporting now describes new storefronts fronted by AI-generated influencer personas, many of them built to sell dropshipped goods. The social-ad watch-brand anatomy walks through one well-documented version of the funnel, from invented founder story to $7 catalogue watch.

Understanding the model explains the tells. The week-old domain, the rented reviews, the stolen photos, and the exit-fee refund policy are not separate mistakes — they are the same fact, seen from four angles: nothing about the shop is built to still exist when your parcel fails to arrive.

07Pay so that you can undo it

The last check is the payment method, and it is the one that determines whether a mistake is recoverable. The FTC's guidance is unambiguous: never buy from online sellers who insist you can only pay by gift card, wire transfer, payment app, or cryptocurrency — these methods exist on scam checkouts precisely because they are hard to reverse. Pay by credit card where possible. If you're charged twice, billed for goods that never arrive, or sent something defective, US card rules let you dispute the charge; the FTC advises contacting the card company promptly, and in writing within 60 days of the first bill showing the error. A separate FTC rule requires sellers to ship when their ads promised — or within 30 days if no time was stated — which gives a non-delivery dispute a legal footing, not just a grievance.

Two small cautions close the loop. The padlock and the https prefix mean your card number is encrypted in transit — nothing more; as the FTC notes, scammers know how to encrypt sites too, so a padlock is table stakes, not a trust signal. And keep records: screenshots of the product page, the price, and the refund policy as they appeared on the day you ordered. A storefront that edits its policy after your purchase — or vanishes entirely — has just met the one customer who kept the receipts.

Nine of those ten points cost nothing but minutes, and the tenth is just choosing the right card. How the sources behind them were chosen and weighted is set out in how we work; the short version is that the load-bearing claims above trace to a regulator, the domain registry, or named fraud-industry reporting.