🚨 119,000 Fake Online Stores Are Stealing Card Details and Bank Codes
AigiShield Report Date: September 11, 2026
Source Classification: Verified Emerging Scam Alert
Scam Type: Fake online stores / payment-card theft / one-time-code interception
What Happened
Cybersecurity researchers have identified a massive fake-shopping network known as DoppelCart. Reporting from BleepingComputer, based on research by German cybersecurity company Nebty, says the cluster involves roughly 119,000 fraudulent shopping domains. Malwarebytes independently reported the same campaign and underlying findings.
The fake stores copy legitimate retailers' product catalogs, descriptions, logos, branding, and images. Some advertise unusually deep discounts to push shoppers into buying before closely checking the website. At checkout, the sites are designed to capture payment-card details and other personal information.
How the Scam Works
A shopper lands on a convincing online store that appears to represent a real brand. The site may look polished because it copies real product images and branding. When the shopper enters card information at checkout, the data can be transmitted to attacker-controlled servers in real time.
Researchers also found checkout flows capable of capturing one-time bank confirmation codes. That matters because criminals may try to use the victim's card while the victim is still completing the fake checkout, then collect the bank's verification code as soon as the victim enters it.
Who Is Being Targeted
The campaign targets ordinary online shoppers, especially people searching for bargains, unfamiliar retailers, or heavily discounted brand-name products. The network reportedly imitates tens of thousands of brands, making this a broad consumer threat rather than a scam tied to one company.
Warning Signs
A brand-name product is offered at a price that is dramatically lower than normal.
The website address is unfamiliar, recently encountered through an ad, or slightly different from the retailer's known domain.
The site copies a legitimate retailer's look but contact details, policies, or company information do not match.
Checkout asks for a bank verification code or one-time passcode in a context that feels unusual.
The store pressures you to act quickly because of a huge limited-time discount.
Independent searches for the website name plus words such as 'scam,' 'complaint,' or 'review' raise concerns or show little credible history.
What Consumers Should Do
Before buying from an unfamiliar store, search for the company and exact website address independently.
Do not assume HTTPS or a padlock means a store is legitimate; scam sites can also use encrypted connections.
Use a credit card when possible because it generally provides stronger dispute protections for fraudulent or undelivered purchases.
Never reuse a one-time bank verification code outside the transaction you independently initiated with a verified merchant.
If you entered card information on a suspicious site, contact the card issuer immediately using the number on the back of the card, review transactions, and ask what protective steps are appropriate.
If you supplied a password that you also use elsewhere, change it immediately on the legitimate service and anywhere else it was reused.
Report suspected shopping fraud to the FTC at ReportFraud.ftc.gov.
Why This Development Matters
Fake shopping sites are not new, but the scale and automation reported in DoppelCart are significant. BleepingComputer reported that more than 105,000 of the identified shops were still active when the researchers checked them, while the fake storefronts reportedly imitated more than 44,000 brands. The ability to capture payment information and one-time confirmation codes in real time makes the campaign especially dangerous for consumers.
Sources
BleepingComputer — 'DoppelCart fraud network uses 119,000 fake shops to steal credit cards' (September 8, 2026): https://www.bleepingcomputer.com/news/security/doppelcart-fraud-network-uses-119-000-fake-shops-to-steal-credit-cards/
Malwarebytes — 'More than 100,000 fake stores are out to steal your card details' (September 9, 2026): https://www.malwarebytes.com/blog/scams/2026/09/more-than-100000-fake-stores-are-out-to-steal-your-card-details
Federal Trade Commission — Online Shopping consumer guidance: https://consumer.ftc.gov/articles/online-shopping
AigiShield Reminder
Think it might be a scam? Let AigiShield check it out for you.
Think Before You Click. Verify Before You Trust.
Comments