How to spot a fake shopping website before Black Friday

To spot a fake shopping website before Black Friday, pause before checkout and check the exact domain, its registration date, the normal price elsewhere, the seller’s reputation and the requested payment method. A recently registered domain, an implausible discount and a demand for hard-to-reverse payment are strong reasons to close the tab. This check takes about two minutes, which is still faster than explaining the purchase to your card company.

The two-minute fake store check

Use this before buying from a store you do not recognize, especially one reached through an ad, email or text.

1. Open a new tab instead of trusting the ad. Search for the company or type the known retailer address yourself. The FTC recommends researching both the seller’s name and the website URL with terms such as review, complaint or scam. Do not assume the first sponsored search result belongs to the company.

2. Read the full domain. In brand.example.com, the controlling domain is example.com, regardless of how reassuring the word before it looks. Watch for misspellings, extra words and unusual endings. A copied logo does not make famousbrand-clearance-shop.com part of Famous Brand.

3. Compare the price. Check the manufacturer and one or two established retailers. The FTC’s holiday shopping advice warns that impersonators advertise brand-name products at unusually low prices. A modest Black Friday discount is ordinary. A current game console for the price of two pizzas deserves another look.

4. Check when the domain was registered. Paste the domain into ICANN Lookup and select Lookup. Find the Creation Date in the result. A store claiming a long history while using a domain created last week has a story problem.

5. Inspect the payment choices before submitting anything. A credit card is the better option for an unfamiliar seller. Leave if the seller insists that you pay only by gift card, wire transfer, cryptocurrency or a person-to-person payment app.

One weak signal does not prove fraud. A small legitimate business may have a new domain, and a scammer may acquire an older one. Several warning signs together are enough to shop elsewhere.

Read the address, not the artwork

Fake stores can copy product photographs, logos, page layouts and policy text. The browser address bar is harder to decorate away. Compare the domain character by character with the address listed on the brand’s packaging, official social profile or established search result.

Look for https and the browser’s lock or settings icon before entering payment details. That means the connection is encrypted. It does not establish that the seller is honest. The FTC specifically notes that scammers can encrypt their sites too. Treat the lock as a basic connection check, not a certificate of good character.

Domain age is also a clue, not a verdict. ICANN’s lookup service displays available registration data, including the creation date for many domains. Privacy-protected owner details are common and are not proof of a scam. The useful comparison is between the store’s claims and the domain record. A site saying serving families since 2008 on a domain created this month should remain wallet-free.

You can also paste the address into Google’s Safe Browsing site status tool. A dangerous result means stop. A clean result only means Google is not currently warning about that address. It does not verify orders, products or refunds.

Treat social ads as introductions, not endorsements

A polished Instagram, Facebook or TikTok ad can lead to a copied storefront. The FTC says scammers impersonate real companies, advertise steep discounts and send shoppers to sites that may deliver a counterfeit, a very different item or nothing. Social platforms do not always thoroughly check every advertiser, according to the FTC’s guidance about scam ads.

When an ad catches your eye, note the product and retailer, then open a fresh browser tab. Find the brand independently and search for the product there. Compare the domain from the ad with the official one. Do not rely on the logo, follower count or comments beneath the ad. Comments can be filtered, manufactured or attached to an impersonated brand identity.

The same habit helps with links delivered by text or QR code. Our guide to QR, toll-text and package scams covers those routes without repeating them here.

Let the checkout page make its case

The payment method tells you how much confidence the seller has in being found later. Credit cards provide a formal dispute process when merchandise never arrives or differs from what was ordered. That does not guarantee a refund, but it gives you a route that gift cards and cryptocurrency do not provide.

Before paying, check the store’s shipping, return and refund pages. Look for a return window, a return address, restocking fees and who pays return shipping. Search the street address and customer service number independently. A contact form by itself gives you little to work with if the store disappears.

Be skeptical when an unfamiliar seller:

• accepts only gift cards, wire transfers, cryptocurrency or payment apps
• changes the payment recipient to a person’s name
• asks you to finish the purchase through direct messages
• adds unexplained fees only at the final screen
• has policies that mention a different company or product category

Do not rely entirely on reviews displayed by the store. The FTC warns that ratings and reviews can be fake or misleading. Check recent results from several independent places, including complaints that describe whether orders arrived and whether refunds were honored.

If you already paid, act in this order

Speed matters because payment companies have procedures and deadlines. Keep the process factual. You do not need to prove who built the site before reporting a missing order or deceptive charge.

1. Save the evidence. Take screenshots of the product page, advertised price, promised shipping date, checkout page and domain. Save the receipt, order confirmation, emails and the ad that led you there. Write down any attempts to contact the seller.

2. Contact the card issuer or payment company immediately. For a card, use the number printed on the back, the official app or the issuer’s typed website address. In many issuer apps, open Transactions, select the charge and look for Dispute transaction or Report a problem. Labels vary, so call if the option is missing.

3. Describe the transaction accurately. If you approved the purchase but the goods never arrived, report a merchandise or merchant dispute. If you did not authorize the charge, report unauthorized use. Ask whether the card should be locked or replaced if the fake store received its number.

4. Protect your credit card dispute rights. The Consumer Financial Protection Bureau says to call promptly and send a written billing-error notice within 60 calendar days after the charge appeared on the statement. Follow the billing-dispute address and instructions on your statement, keep a copy and pay the undisputed portion of the bill. The CFPB explains the credit card refund and dispute process.

5. Use the recovery path for your payment method. For a debit card, contact the bank or credit union immediately. For a payment app or bank transfer, report the transaction and ask for a reversal. For a gift card, call the issuer using the number on the card, keep the card and receipt, and request a refund. The FTC lists instructions by payment type on its scam recovery page.

6. Report the store and the ad. File a report at ReportFraud.ftc.gov and report the advertisement through the social platform’s ad menu. Include the domain, amount, payment method and screenshots. An FTC report does not itself reverse the payment, so complete the bank or card dispute too.

If you also gave away personal information

Change any password created for the store if you reused it elsewhere. Start with the email account connected to the order, then turn on two-factor authentication. A password manager can generate a different password for every store, while passkeys reduce the need for reusable passwords on services that support them.

If you supplied a Social Security number or discover accounts opened in your name, use IdentityTheft.gov to create a recovery plan. If the site prompted you to install software, run a security scan and change important passwords from a clean device.

For Black Friday, the simplest household rule is to treat every unfamiliar store as unverified until the address, history, price and payment method agree. Share the two-minute check with anyone who shops from social feeds. For broader account and device cleanup, use our weekend family protection checklist.