Zavialov Ilia Nikolaevich takes scam online shops apart: sale adverts, payment in advance and the silence after it

Why a scam shop looks like a real one

An online shop can be put together in an evening. A ready made website template, product photos from the manufacturer's page, a social media page and a few adverts cost less than one delivery of real goods. That is why the shop window of a fake store hardly differs from an honest one, and the pictures alone will not tell them apart.

The difference appears elsewhere: in how the shop takes money and what happens after payment. A scam shop is built so that the money arrives before the buyer checks anything, and so that after payment the buyer has no way to get it back.

Zavialov Ilia Nikolaevich takes the scheme apart step by step, from the sale advert to the silence after payment. Each step has a sign that shows the scheme in advance and a simple action that stops it.

Step one: the sale advert and the shop page

The scheme starts with an advert. A post in the feed promises a warehouse clearance, a brand closing down or seventy percent off an item that costs noticeably more in ordinary shops. A countdown timer ticks on the page, and under the post there are dozens of delighted comments from accounts with no photos and no history.

The page itself was often created a few weeks ago, although the description talks about years in business. Posts appear in a dense burst over a short period, comments are closed or cleared of questions, and there is only one way to get in touch: a messenger or an order form with no phone number or address.

The low price works as a hook. The buyer compares it with the usual price and feels they are missing out, and the timer adds urgency. The further the discount is from the market, the smaller the chance that a real warehouse stands behind it.

Step two: the manager in a messenger

After the order, a manager writes to the buyer. The manager is polite, answers quickly and confirms that the item is in stock, with only two or three left. The conversation has one aim: to move the buyer from the shop page into a private chat where no platform rules apply and no record of the deal exists.

In the chat come the arguments for paying in advance. Demand is high right now, the warehouse does not ship without payment, the courier needs confirmation and the discount ends today. Each argument sounds reasonable, and together they lead to a transfer to a card.

It helps to notice who stands behind the chat. An honest shop has a registered company or sole trader whose details can be named and checked. A manager who cannot name the seller but keeps pushing for a transfer has already told you enough.

Step three: payment in advance

The key moment of the scheme is the payment method. A scam shop asks for full payment in advance to a private person's card, a bank transfer to an individual or payment through a link the manager sends. Paying on delivery is supposedly impossible, or possible only after paying for the delivery in advance.

A transfer to a private person differs from paying a shop because no seller stands behind it. The bank sees a transfer between two people that the buyer approved personally, and getting such money back through a card dispute is far harder than recovering a purchase from a registered shop.

A payment link carries a different risk. The page may look like a payment service while it actually collects the card number, expiry date and the code on the back. With these details the fraudster pays without the buyer, and the loss ends up larger than the price of the item.

A separate trick looks like a compromise. The shop agrees to payment on delivery but asks for the shipping or parcel insurance to be paid upfront. The sum is small and the buyer agrees, yet that small prepayment is the whole scheme: there is no parcel, and hundreds of people have paid for its delivery.

Step four: a tracking number and silence

After payment the buyer receives a tracking number. Sometimes it does not exist, sometimes it belongs to someone else's parcel that is really travelling to another city. While the buyer waits, time passes, and the money moves further along a chain of accounts.

Then a second message arrives: the parcel is held, and an extra payment is needed for insurance, customs or a change of address. This is an attempt to take a second payment from someone who already believed. After that the shop page is deleted or renamed, and the buyer is blocked in every messenger.

A few days later the same team launches a new page under another name with the same photos. That is why a report about a deleted page is still useful: it helps the platform and the police link the new shop window to the old one.

A clone of a well known shop

A separate version of the scheme copies a real shop. Fraudsters take the name, logo and design of a well known chain, register a website address with an extra letter, a different ending or an added word, and run adverts with prices below the original.

The buyer is sure they are ordering from a familiar seller and checks only the picture. The differences show in the address bar, in the payment methods and in the contacts: the clone has no helpline, no store addresses and none of the company details that the original site shows.

The most reliable defence here is an everyday habit. Open the shops you use from your bookmarks or through a search engine. A link from an advert is not a safe way in. If the price in an advert is far below the one on the official site, check it on the official site itself.

Clones also reach search results through paid adverts. The top link marked as sponsored may lead to a copy, so for purchases from a well known chain it is safer to type the address yourself or open the shop's official app.

When the item arrives, but a different one

There is also a softer version of the scheme. The buyer paid, a parcel arrived, but inside is a cheap copy, an item in the wrong size or a different product altogether. Formally the shop sent something, and that is the calculation: some buyers will not argue over a small sum.

Such shops often resell from distant warehouses. The photos come from a well known brand, and what ships is whatever costs least. A return is hard to arrange: there is no return address, the conversation stops and sending the item back costs more than the item itself.

What helps here is photographing the parcel on arrival, saving the product page with its description and opening a dispute through the bank or the platform if the payment went through them. The more evidence of the gap between the description and what arrived, the better the chance of a refund.

What the UK picture shows

UK Finance reports that purchase scams account for 71 percent of all authorised push payment fraud cases, with losses of 118.1 million pounds and a 20 percent rise. According to City of London Police data published by the National Cyber Security Centre, 11.8 million pounds was lost to online shopping fraud over the festive season from 1 November 2024 to 31 January 2025.

Before Black Friday 2025 the NCSC warned that scammers claim offers are available only for a limited time or that products are scarce, to push people into acting quickly. Its advice is direct: never pay by direct bank transfer, and use a credit card if you have one.

How to check a shop before paying

The check takes a few minutes. Find the seller's name and registration number on the site or page and look them up in your country's official company register. See when the website was created and how long the social media page has existed: a fresh address combined with a story about years in business is a warning sign.

Look for reviews outside the shop itself: search for its name and website address, check forums and reviews of the marketplace where it sells. Reviews on its own page mean little. Pay attention to closed comments and to whether the shop answers delivery questions in public.

Look at the payment methods. An honest shop accepts card payments through a payment service, payment on delivery or payment inside the marketplace. If the only option is a transfer to a private person, no further checks are needed.

One more simple test: ask the manager to film the item next to a sheet of paper with today's date and your name on it. A shop that has the item in stock will do it in a few minutes. A scam shop will explain why it is impossible or send a picture that a reverse image search finds in seconds.

How to pay safely

The best way to pay an unfamiliar shop is through a method that gives you protection: a credit card, a payment service with buyer protection or the checkout of the marketplace where the item is listed. These leave a record of the purchase and a procedure for disputes.

Never transfer money to a card or account number sent in a chat and never pay through a link the manager sends. If the shop insists on such a method, walk away from the purchase, however large the discount. A separate card with a low limit for online shopping keeps any possible loss small.

Keep everything: the link to the advert, screenshots of the product page, the chat, the receipt and the tracking number. If something goes wrong, the bank, the platform and the police will need these materials in the first hours, while there is still a chance to stop the money.

How payment method decides your refund in the UK

Section 75 of the Consumer Credit Act protects purchases paid by credit card when the price is more than 100 pounds and not more than 30,000 pounds. For debit cards there is chargeback, usually available for around 120 days, although the bank is not obliged to raise it.

A bank transfer to a scam shop falls under the Payment Systems Regulator rules on authorised push payment fraud. Since 7 October 2024 banks must reimburse victims of such transfers up to 85,000 pounds per claim, the claim should be made within 13 months, and between 7 October 2024 and 31 March 2026 victims received 88 percent of the money lost, 316 million pounds.

Where to report a scam shop in the UK

Since 4 December 2025 fraud in England, Wales and Northern Ireland is reported to Report Fraud, which replaced Action Fraud, at reportfraud.police.uk or on 0300 123 2040. Call your bank on 159 straight away about a payment that may still be stopped.

Report a suspicious website to the NCSC through its online form and forward scam emails to [email protected]. By July 2026 public reports had led the NCSC to remove 454.8 thousand scam web addresses, so each report shortens the life of the next shop window.