Black Friday Fake Shops: 7 Checks Before You Pay, and How to Get Your Money Back

Short answer: before you pay a shop you've never used, spend two minutes on the seven checks below. Pay by credit card if you have one, and never by bank transfer or gift card. If you've already paid a shop that now looks fake, call your bank first and report it second. The order matters, because banks can sometimes stop a payment that's still in progress.

Why this is worth two minutes

The UK's National Cyber Security Centre (NCSC) and Action Fraud said that shoppers reported losing more than £11.5 million to online shopping fraud between November 2023 and January 2024, an average of £695 for each victim. Their Black Friday release counted more than 16,000 reports over that festive season.

Two details in those figures are useful. 43% of reports mentioned a social media platform, and almost 19% mentioned an online marketplace. So a lot of this starts with an advert or a post, not with a search for a shop. The people reporting most often were aged 30 to 39, which doesn't fit the idea that only older shoppers get caught.

Those are the most recent official festive figures we could read ourselves. They cover losses people reported, so the real total is likely to be higher.

Seven checks before you pay

1. Get to the shop yourself. The NCSC's shopping guidance says that if you're unsure about a link, don't use it. Type the shop's address or search for the brand, and read the results before clicking the top one. Then compare the address letter by letter. Look-alike addresses often add words such as "outlet" or "deals", or swap one letter.
2. Search the name with "scam" or "complaint". This is the FTC's suggestion, and it takes seconds. Read reviews on a trusted review site, not on the shop's own pages, and read them critically. The FTC points out that some reviews are fake.
3. Compare the price with shops you know. A price far below everyone else's is the usual bait. Citizens Advice puts "seems too good to be true" at the top of its list of scam signs.
4. Look for an address and a returns policy. Citizens Advice says a missing postal address is a sign a business might not be real. The FTC adds that you should check who pays for return postage and how many days you get.
5. Ignore the countdown. Timers and "only 2 left" warnings are there to stop you doing checks one to four. In the same release, Action Fraud called a false sense of urgency a tell-tale sign of a fraudster.
6. See how it wants to be paid. The NCSC's advice is blunt: never pay by direct bank transfer. Citizens Advice also warns about being asked to pay in unusual ways, such as vouchers or money transfer services. A real shop takes cards.
7. Don't trust the padlock. The padlock and "https" only mean your connection to the site is encrypted. The FTC says that doesn't prove the site is legitimate. Fake shops have padlocks too.

None of these is proof on its own. Small genuine shops sometimes have clumsy websites, and good fakes pass one or two checks. What you're looking for is several warnings together, especially a low price, a rush and an odd way to pay.

If the deal came from an advert or a post

Treat a shop you reached through a social media advert, a sponsored post or a message as unknown, even if it uses a brand you recognise. Don't buy from the link. Open a new tab, find the brand's own site, and see whether the same offer is there. If it isn't, that's your answer.

On marketplaces, stay inside the platform. A seller who asks you to pay by bank transfer or continue the conversation elsewhere is asking you to give up the protection the platform and your card provide. That's our own reading of the NCSC's "never pay by bank transfer" advice, applied to marketplaces.

The safest way to pay

In the UK:

• Credit card first. Which? explains that under Section 75 of the Consumer Credit Act, the card company is jointly liable with the seller. It covers items costing over £100 and not more than £30,000, and it's a legal right. It applies to credit cards only, not debit or charge cards.
• Debit card second. Debit cards rely on chargeback. Which? says claims must be made within 120 days of the purchase, and that chargeback is a voluntary scheme and not law. So it's worth asking for, but it isn't guaranteed.
• Apple Pay, Google Pay and PayPal. The NCSC says to check each service's own terms, because the protection isn't the same as paying by card directly.

In the US:

• Credit card first. The FTC says paying by credit card protects you best if something goes wrong. To dispute a charge, it says to call the card company straight away and follow up in writing, so that your letter arrives within 60 days of the first bill showing the problem.
• Know the shipping rule. The FTC says sellers must ship when they promised. If they gave no date, they have 30 days from receiving your order and payment.

Wherever you are, the NCSC suggests giving a shop as little as possible: fill in only the required fields, check out as a guest if you can, and don't let the shop or your browser save your card details. Keep the order confirmation and any messages, because you'll need them for a dispute.

The scam after the order: delivery texts

Buying from a genuine shop doesn't end the risk. After Black Friday, most people are expecting parcels, which is why fake "missed delivery" texts and emails work so well. The NCSC warns that criminals put malicious links in texts, emails and social media posts.

The fix is the same as check one. Don't tap the link. Open the retailer's or courier's app, or type its address yourself, and look up the order there. In the UK, you can forward a suspicious text to 7726, which is free, and forward suspicious emails to the NCSC's Suspicious Email Reporting Service. The address is on the NCSC page linked above.

If you've already paid a fake shop

1. Call your bank or card company now. The NCSC says to tell your bank straight away, and to contact it through its official website or phone number, not a number from the shop or an email. In the UK, Citizens Advice says you can call 159 to reach your bank.
2. Ask for the right thing. In the UK, ask about a Section 75 claim if you paid by credit card and the item cost over £100, or a chargeback if you paid by debit card or it cost less. In the US, dispute the charge with your credit card company.
3. Report it. The NCSC says to report the crime to Report Fraud if you're in England, Wales or Northern Ireland, or to Police Scotland if you're in Scotland. In the US, the FTC asks you to report at ReportFraud.ftc.gov.
4. Change any password you gave the shop. If you made an account there with a password you use elsewhere, change it on the other sites, starting with your email. This step is our own suggestion. It follows from the NCSC's advice not to reuse passwords and to turn on 2-step verification for important accounts.
5. Watch for the follow-up. People who've been caught once are often contacted again by someone offering to recover the money for a fee. Your bank and the police don't charge for this. That's our own warning, not something from the pages cited here.

If the shop was real but the item never arrived or isn't what you ordered, that's a different problem. The NCSC points to Citizens Advice's guidance on getting your money back.

Frequently asked questions

How can I tell if an online shop is fake?

Check the web address letter by letter, search the shop's name with the word scam, compare the price with shops you know, look for a postal address and returns policy, and see how it wants to be paid. A shop that only takes bank transfer or gift cards is the clearest warning.

Does the padlock mean a website is safe?

No. The padlock and https only mean the connection is encrypted. The FTC says this doesn't prove a site is legitimate, and fake shops can have one too.

Is it safer to pay by credit card or debit card?

Credit card. In the UK, Which? says Section 75 of the Consumer Credit Act makes the card company jointly liable for purchases over £100 and up to £30,000. Debit cards rely on chargeback, which is a voluntary scheme. In the US, the FTC says paying by credit card protects you best.

I paid a fake shop by debit card. Can I get my money back?

Possibly. Ask your bank for a chargeback. Which? says debit card claims must be made within 120 days of the purchase, and that chargeback is a voluntary scheme, not a legal right, so it isn't guaranteed.

I paid by bank transfer. What now?

Contact your bank straight away using the number on its official website or your card, and report it. The NCSC advises never paying by bank transfer when shopping online, because the card protections don't apply.

Where do I report a fake shop in the UK?

The NCSC says to report the crime to Report Fraud if you're in England, Wales or Northern Ireland, or to Police Scotland if you're in Scotland. Scam websites can be reported to the NCSC, and scam texts forwarded to 7726.

Where do I report a fake shop in the US?

The FTC says to try the seller first, then report it at ReportFraud.ftc.gov. If you paid by credit card, dispute the charge with your card company as well.

How we checked this

The checks and reporting routes come from the NCSC's shopping guidance (reviewed July 2024), the FTC's online shopping page (May 2023) and Citizens Advice (last reviewed May 2019, so parts of it are dated). The Section 75 and chargeback rules come from Which? (September 2026). The loss figures come from the NCSC and Action Fraud release of 18 November 2024, which covers November 2023 to January 2024. We couldn't find a newer festive release to read, so treat the numbers as a guide to scale, not this year's total.

We couldn't open the Report Fraud website to confirm its phone number, so we haven't given one. This guide isn't legal or financial advice, and card protections depend on your own card's terms. We also run a Black Friday sale on our own apps, which are sold only through Apple's App Store.

More from Offgrid Studio

Got an Apple Spyware Warning? How to Check It's Real
How to Remove Tracking From Links You Share
How to Limit Apps Selling Your Location