Skip to content

Spot a fake shop: eight warning signs and where to find them

A fake shop gives itself away in particular places: at checkout, in the legal notice, in the footer, in the withdrawal policy. For each warning sign you see an invented example, what it means and how to check it yourself. You also see which part Fakeshop AI checks for you.

Check a shopPrefer ticking boxes? Go to the pre-purchase checklist
nordlicht-technik.invalid/produkt/spielkonsole-1tb
Fictional example
Clearance sale ends in00:14:59
NordlichtTechnikYour specialist retailer since 2009

Games console, 1 TB, new

189,00 €549,00 €

All colours in stock · only 2 left

Checkout · choose payment

  • PayPaltemporarily unavailable
  • Credit cardunder maintenance
  • Advance bank transfer3% instant discount

100% safe payment thanks to SSL

Verified online shop

Legal notice, excerpt

Nordlicht Technik Handels GmbH
Musterstraße 1, 00000 Musterstadt
Local court Musterstadt, HRB 000000
VAT ID DE000000000

Withdrawal policy, excerpt

Returns go to our warehouse outside the EU. You bear the cost of the return.

Each number marks a spot in the example shop. A click takes you to the explanation and the checking steps.

Checked shops in the directoryHow we checkAlready paid? What to do now

The warning signs in detail

A single sign proves no fraud. A serious one, such as a checkout without a protected payment method, can still be reason enough not to order.

Where: CheckoutShow in the example shop

1. Only advance payment is left at checkout

https://nordlicht-technik.invalid/kasse/zahlungFictional example

Step 3 of 4: choose a payment method

PayPal
temporarily unavailable
Flagged: Still advertised as a logo on the homepage
Credit card
maintenance, please choose another method
Flagged: The second protected method disappears too
Advance bank transfer
available, with a 3% instant discount

What it means

You cannot reverse an executed bank transfer on your own. With PayPal (Goods and Services), credit card, direct debit or invoice there is a way back. A known pattern: the homepage shows plenty of payment logos, at checkout they are “disrupted”, and only the bank transfer works. The discount on advance payment makes the last step more tempting.

How to check it yourself

  1. Put an item in the basket and go as far as the payment selection. You do not need to order.
  2. Check whether PayPal, credit card or invoice can be selected there.
  3. If only bank transfer remains, stop or check the shop thoroughly first.
We check this: Payment methods

We record which payment methods the shop names on its pages and state in the result when only advance payment, bank transfer or cryptocurrency remain. We cannot always see the final checkout step. That one is best checked by you.

Where: Legal noticeShow in the example shop

2. The legal notice does not match the commercial register

https://nordlicht-technik.invalid/impressumFictional example

Legal notice (Impressum)

Provider
Nordlicht Technik Handels GmbH
Address
Musterstraße 1, 00000 Musterstadt
Register entry
Local court Musterstadt, HRB 000000
Flagged: A different company is registered under this number
VAT ID
DE000000000
Flagged: Not valid in the EU check (VIES)

What it means

A legal notice is quickly written. It only means something once the details match a real register entry. Fake shops leave out mandatory details, invent numbers or copy the data of a real company that has nothing to do with the shop. The last case looks trustworthy at first glance.

How to check it yourself

  1. Enter the company name or HRB number in the free search on handelsregister.de.
  2. Compare company name, seat and number with the legal notice.
  3. Check the VAT ID in the European Commission’s VIES service.
  4. If the registered company runs its own website with a different range, the data is probably borrowed.
We check this: Legal notice, commercial register, VAT ID (VIES)

We read the legal notice, compare the company with the commercial register and check the VAT ID with VIES. If something does not match, the result shows which entry we found.

Term in the glossary
Where: FooterShow in the example shop

3. The trust seal is just an image

https://nordlicht-technik.invalid/Fictional example

Homepage footer

Seal
logo “Verified online shop”
Flagged: Image file without a link
Target on click
none, the page does not change
Issuer’s list
no entry for this domain
Flagged: Certification cannot be verified

What it means

A seal in the footer is an image, and images can be copied in seconds. It only means something if the issuer holds a valid certificate for this domain. Then there are seals from programmes that no longer exist: TÜV Süd “s@fer shopping” has not been awarded since 2021.

How to check it yourself

  1. Click the seal.
  2. Look at the address bar: is the target page on the issuer’s domain?
  3. Does the certificate name this shop and a valid status? If not, the seal does not count.
We check this: Trust seal check

We detect known seals on the page and ask the issuer whether a valid certification exists. You will find the verification route for each seal in our trust seal guide.

Verification route per seal
Where: Registration dataShow in the example shop

4. The domain is only a few weeks old

Example excerpt of the shop page
lookup.icann.org · nordlicht-technik.invalidFictional example

Public registration data

Registered on
14 Sept 2026
Flagged: Created three weeks before the visit
Registrant
redacted for privacy
Claim in the shop
“Your specialist retailer since 2009”
Flagged: Contradicts the registration date

What it means

Fake shops are usually online for a short time and then return under a new address. A very young domain alone proves nothing, because genuine retailers start somewhere too. The sign becomes strong when the shop claims a long history at the same time. A redacted registrant is normal and not a warning sign on its own.

How to check it yourself

  1. Enter the domain at lookup.icann.org and read the registration date.
  2. For .de domains, DENIC does not show a registration date. Check in the Internet Archive (web.archive.org) since when the site has been captured.
  3. Compare the date with what the shop says about itself.
We check this: Domain age

We read the registration date from public registration data and state the domain’s age in the result.

Term in the glossary
Where: Product pageShow in the example shop

5. The price is far below the market

Example excerpt of the shop page
https://nordlicht-technik.invalid/produkt/spielkonsole-1tbFictional example

Games console, 1 TB, new

Price
€189.00
Flagged: Far below the price at known retailers
Struck through
€549.00
Availability
all colours in stock
Flagged: Every variant available even when stock is scarce

What it means

The bait price is the most common lure. For goods with well-known market prices, some fake shops also use prices just below the market that still look plausible. A normal price is therefore no point in the shop’s favour.

How to check it yourself

  1. Enter product name and model number in a price comparison site.
  2. If the price is clearly below the cheapest known retailer, ask yourself where the discount could come from.
  3. Run a product photo through a reverse image search. If it appears at the manufacturer or other shops, it was copied.
We don’t check this

We do not compare prices with other retailers; our check only assesses whether prices and discounts on the site look unrealistic. A price comparison site tells you better than we can whether an offer is plausible.

Where: Withdrawal policyShow in the example shop

6. The return address is in another country

Example excerpt of the shop page
https://nordlicht-technik.invalid/widerrufFictional example

Withdrawal policy

Company seat per legal notice
Germany
Return to
warehouse in a country outside the EU
Flagged: Different country from the company seat
Return costs
borne by the buyer

What it means

If goods have to go back to a country other than the company seat, that points to shipping straight from the Far East or to copied legal texts. It is not automatically fraud, but return postage can exceed the value of the goods. If there is no return address at all, you practically cannot exercise your right of withdrawal.

How to check it yourself

  1. Open the withdrawal policy and search for “return” or “to the following address”.
  2. Compare the country with the legal notice.
  3. If there is no address, ask in writing before you order.
We check this: Return address

We read the return address from the withdrawal policy and compare its country with the company seat in the legal notice.

Where: BannerShow in the example shop

7. A countdown pushes you to pay

Example excerpt of the shop page
https://nordlicht-technik.invalid/Fictional example

Banner above the header

Banner
“Clearance sale ends in 00:14:59”
Flagged: Timer restarts on every visit
Stock
“Only 2 left”
Visit the next day
00:14:59 again, 2 left again

What it means

Time pressure is meant to stop you from checking the other points. Genuine retailers use countdowns and scarcity notices too. They prove no fraud, but they are no reason to pay faster.

How to check it yourself

  1. Reload the page in a private window. If the timer starts again, it is decoration.
  2. Take the time anyway. A genuine offer survives ten minutes of checking.
We don’t check this

We do not treat countdowns as a warning sign of their own. A timer says little about the operator. Its only job is to keep you from looking.

Where: Address barShow in the example shop

8. The padlock is sold as proof

Example excerpt of the shop page
https://nordlicht-technik.invalid/Fictional example

Address bar and payment notice

Padlock
present, certificate valid
Certificate issued
6 days ago, free domain validation
Text in the shop
“100% secure payment thanks to SSL”
Flagged: Encryption presented as trustworthiness

What it means

The padlock shows that the connection to this domain is encrypted. It does not say who is behind the domain. Certificates are free, fake shops have them too. A missing padlock is a warning sign. A present one leaves you as wise as before.

How to check it yourself

  1. Click the padlock and open the certificate details.
  2. Check which domain it covers and who issued it.
  3. Do not draw conclusions about the retailer from it.
We check this: SSL certificate

We check whether a valid certificate from a recognised authority exists. The result states explicitly that encryption says nothing about the operator’s trustworthiness.

Term in the glossary

Not sure about a shop?

Paste its address. We check the legal notice, commercial register, payment methods, trust seals, domain age, return address and more, and say for each point what we found. Free, no sign-up.

Frequently asked questions

Which warning sign weighs most?

A checkout where only advance payment or bank transfer remains, because then you have no way back. A single sign still proves no fraud, and there is no fixed number from which a shop is certainly fraudulent.

Is an SSL padlock enough proof of security?

No. The padlock only shows that the connection to this domain is encrypted. It does not say who is behind the domain, and certificates are free, so fake shops have them too. A missing padlock is a warning sign. It does not replace checking the legal notice, payment methods and trust seals.

Are the examples on this page real shops?

No. All examples are invented and use the .invalid ending, which does not exist on the internet. Real fake shops confirmed by us are on the warning list and, sorted by product group, under “Fake shops by category”.

What should I do if a shop seems suspicious?

Do not order, and check the address with the shop check. It shows what we checked, what we found and where data is missing. Missing data or a good result is no purchase guarantee.

Continue with:Checklist, payment methods and templatesFake shops by categoryPayment methods comparedScams
Dennis Bölling, Founder · QAD SoftUpdated