119,000 Fake Online Stores Are Stealing Card Numbers Right Now

A Fake Store Is Probably Selling Your Favorite Brand Right Now

You find a deal. Forty percent off a watch you've wanted for months. The site looks real, the photos are sharp, the checkout flow is smooth. You type in your card number and the one-time code your bank just texted you.

That's it. That's the whole attack. Your card details are already gone.

How Does a Fake Store Actually Work?

Criminal groups build sites designed to mirror real retailers so closely that most people can't tell the difference. The operation that security researchers at the German firm Nebty uncovered in September 2026, which they named DoppelCart, did something especially clever: many of its fake stores loaded product images directly from the real brands' own servers. SodaStream's photos, Daniel Wellington's watch images, Velasca's shoes, pulled straight from the legitimate companies. The store you're looking at is a shell. The pictures are real. That combination is what makes it convincing.

At checkout, the site captures two things. Your full card number. And the one-time confirmation code your bank sends to your phone. That second piece matters. Banks added those codes specifically to stop fraudulent transactions. DoppelCart sites ask for that code during checkout, framed as normal verification. Once they have it, they can authorize purchases before your bank has any reason to flag the charge.

The discounts are the hook. Many DoppelCart listings advertised up to 65% off. Deals that big exist sometimes, but they also exist because scammers know bargain-hunters move fast and think less.

How Big Is This Operation?

Nebty identified 118,787 fake .shop domains tied to DoppelCart, making it the largest publicly documented fake-shop network by domain count. Those domains clone roughly 44,182 real brands. When Nebty published its findings, more than 105,000 of those sites were still live.

The scale sounds almost too large to be organized. It is organized. 96% of confirmed shops share identical underlying code and route transactions through just 27 commerce backends. Twenty-seven. For over a hundred thousand websites. That points to a single criminal operation running a highly automated factory, not a loose collection of individual scammers.

Think about what that means practically. One criminal group has built infrastructure capable of impersonating tens of thousands of brands simultaneously. They update it, maintain it, and collect from it. This is not opportunistic fraud. It is a business.

What Should You Do Right Now?

If you think you may have shopped on a fake store recently, move quickly. The FTC advises contacting your card issuer immediately. Here is the full sequence:

1. Call your bank or card issuer now. Tell them you may have entered your card number on a fraudulent site. Ask them to freeze or replace the card. Don't wait to see if a charge appears first.

2. Report the one-time code exposure separately. If you entered a bank-texted confirmation code on the site, tell your bank that too. They need to know that the code may have been used to authorize a transaction.

3. Check your statements the same day. Look for any charge you don't recognize, including small test charges of a dollar or two. Fraudsters often run a small charge first to confirm the card is live.

4. File a dispute for any unauthorized charge. Your card issuer can reverse it. Keep a record of everything you tell them.

5. Consider a credit freeze. If your full name, address, and card number were captured together, the damage could go beyond this one card. A credit freeze is free at all three major bureaus and stops anyone from opening new credit in your name.

How Do You Spot a Fake Store Before You Pay?

Check the domain carefully. Fake stores use .shop, .store, .online, and other cheap extensions. Real brand stores almost always operate from .com domains or regional equivalents. If the domain looks slightly off, it is.

Search the brand name directly. Go to Google and search the brand name. The real store appears in the results. If the site you landed on doesn't match, close it.

Look for contact information that makes sense. Fake stores often have no phone number, no physical address, or an address that doesn't resolve to anything real when you check it on a map.

Treat deep discounts as a signal, not a reward. Sixty-five percent off is unusual. Not impossible. But on a site you've never heard of, it should trigger skepticism, not excitement.

Use a virtual card number for unfamiliar retailers. Most major banks and credit card providers offer virtual card numbers through their app. The virtual number is tied to your account but can be cancelled without replacing your real card. Use it anywhere you're not certain.

The Deeper Problem

Here is the uncomfortable truth. DoppelCart ran more than 100,000 fake sites simultaneously and most people had never heard of it. The tools to build and operate fraud at this scale are cheap and widely available. Detection is hard. Takedowns are slow. The criminal operation identifies a new batch of domains, stands them up, and harvests card numbers faster than enforcement can respond.

Individual vigilance is not a complete answer. But it is the fastest protection available to you right now.

Do this now:

• If you shopped somewhere unfamiliar recently, review your last 30 days of card statements today
• Call your bank immediately if anything looks off, including small test charges
• Set up transaction alerts on every card you own so you see charges in real time
• Freeze your credit for free at Experian, Equifax, and TransUnion if you have any reason to think your full details were captured
• For any future purchase on an unfamiliar site, use a virtual card number or pay through a payment service that doesn't expose your real card to the merchant

Sources

• bleepingcomputer.com
• malwarebytes.com