A particularly perfidious scam dispenses entirely with a forged imprint: instead, fraudsters copy the commercial register number, the VAT identification number and the company name of a real, established retailer – and pose as that company.
At first glance this makes the shop look completely reputable. Anyone who becomes suspicious and looks up the HRB number in the commercial register does indeed find a valid entry. But that entry belongs to a completely different, usually unsuspecting company. The forgers borrow someone else's reputation to create trust among consumers and cash in advance payments.
Why a genuine HRB number is no proof of safety
Commercial register data is public in Germany. Every registered company, every register number and every address can be viewed freely. That is exactly what fraudsters exploit: they search the imprints of real shops, copy the complete company details and paste them into their fake page. The police, too, expressly point out that criminals take over the legitimate register numbers of real companies.
The mistake many buyers make is to end the check after the first hit. A number exists – so the shop must be genuine. In fact, a valid register entry only proves that somewhere a real company with this data exists. It does not prove that this company runs the shop under which the number appears.
A verifiable HRB number states that a company exists – not that it runs the shop in front of you.
How to check the company details in a few minutes
It is important not just to confirm the details but to cross-check them against each other. Do the company name, address, register number and the actual domain fit together – or do they clearly come from different sources?
- Query the register for free. Since 1 August 2022 (implementation of the EU Digitalisation Directive, DiRUG), viewing the commercial register on handelsregister.de is possible without registration and free of charge. Enter the register number or the company name and compare the registered office and legal form with the imprint.
- Cross-check the company name. Also search the company name stored in the register via a search engine. If it leads to a completely different, often older website with a different domain, that is a clear warning sign of a stolen identity.
- Verify the address. Check the given address on a map application. A residential building, an empty plot or an address belonging to a completely different industry rarely fits a reputable mail-order retailer.
- Look at the domain age. A domain registered only a few days or weeks ago, combined with the data of a company that has existed for years, is contradictory – reputable retailers usually run their domain permanently.
- Note the payment method. If, despite many displayed payment logos, in the end only advance payment by bank transfer is offered, possibly to a foreign account, the utmost caution is advised.
For the VAT identification number, the Federal Central Tax Office offers a confirmation procedure with which the number, name and address can be matched. However, it is aimed above all at companies with their own VAT ID and at EU business – for private individuals the free commercial register query is the more practical route.
These details the law prescribes
Under Section 5 paragraph 1 of the Digital Services Act (DDG, since 2024 the successor to the Telemedia Act), commercial online shops must provide, among other things, the name and address, for legal entities the legal form and the authorised representative (No. 1), the register and the register number (No. 4), and – if available – the VAT identification number (No. 6), in an easily recognisable and permanently available form. If these mandatory details are missing or incorrect, this is an administrative offence under Section 33 DDG that can be punished with a fine of up to 50,000 euros.
In practice this does not deter genuine fraudsters – they formally provide the mandatory details in full, just with someone else's data. Conversely, however: if any of these details is missing entirely, that alone is a reason to abandon the purchase.
What affected companies can do
Retailers who notice that their own company data appears on someone else's shop should act quickly and with documentation. The earlier the abuse is noticed, the smaller the reputational damage and the better the chance of getting the fake page off the net.
- Secure evidence. Create dated screenshots of the fake imprint, the URL and the affected pages before the fraudsters change or delete them.
- File a criminal complaint. Report it to the police – with many state police forces also online via the online police station. Keep a copy of the report.
- Report the fake shop. Inform the hosting provider and the domain's registrar and – in the case of trademark abuse – if necessary a lawyer specialising in further legal steps.
- Warn customers. A brief note on your own website and your own channels protects customers from falling for the fraud.
For business customers, Fakeshop AI monitors company data automatically and raises the alarm as soon as an HRB number, VAT ID or company name appears in an unusual place on the net – so identity abuse can often be detected before the first customers are harmed.
What consumers should do if they had to pay
Anyone who has already paid in advance by bank transfer and notices the fraud should not wait. Even though reversed transfers are rare, every minute counts.
- Contact the bank. Contact your bank immediately and ask for the transfer to be stopped if it has not yet been executed.
- File a report. File a criminal complaint. The police can usually only prosecute fraud through non-delivery if those harmed report the case.
- Respond to reminders. If your data was misused for the fraud and you receive a court order for payment (Mahnbescheid), you usually have to file an objection within two weeks of service.
- Correct entries. If you suspect identity abuse, check for possible false entries at credit agencies such as Schufa and have them corrected.
For consumers the bottom line is: a genuine HRB number alone is no proof of safety. Only the interplay of a consistent register match, a plausible address, domain age, reviews and a comprehensible payment method gives a reliable picture. When in doubt, the simplest protection applies: do not pay by advance transfer and rather abandon the purchase.
