The Postal Service only texts you about a package if you asked it to, by entering a tracking number and opting in. And according to the U.S. Postal Inspection Service, those texts will not contain a link. Keep that one fact in your head and a whole category of holiday scam messages stops working on you.
The rest takes a little more effort, because the fake stores are getting better. Shoppers spent $11.8 billion online on Black Friday last year, according to Adobe, and that kind of money draws people who build convincing copies of real retailers. Identity protection company Aura pointed out in late September that AI tools now let a scammer set up a polished fake store in minutes, product descriptions and customer reviews included.
You don’t need special software to protect yourself. You need a short routine you actually run before entering a card number on a site you didn’t type in yourself. Here’s mine, plus the other tricks that show up between now and Christmas.
Where fake stores find you
Very few people stumble onto a fake store by typing an address. They get there from a social media ad, a sponsored search result, a text, or a link a friend forwarded. The FTC has warned that scammers frequently run social media ads showing popular products at unusually low prices, and the pattern is easy to recognize once you’ve seen it: a well-known item at a fraction of its normal price, a countdown timer, and a line about limited stock.
A newer route is the AI answer. Aura cites research from security firm Netcraft finding that about a third of the login links a chatbot suggested for major brands pointed to sites those brands didn’t own. If an assistant gives you a link to a store, treat it the way you’d treat a link in a text message from a number you don’t know.
The two-minute check
Run this before you buy from any store you reached through a link, and before you buy from a store you’ve never heard of.
Minute one: the address and the basics
- Read the domain letter by letter. Copycat stores add words like “outlet” or “sale” to a brand name, swap one letter, or use an unusual ending instead of the address the brand normally uses. If you’re on a phone, tap the address bar so you can see the whole thing.
- Don’t count the padlock. HTTPS means your connection to the site is encrypted. It says nothing about who runs the site, and fake stores have it too.
- Look for a real way to reach them. A legitimate retailer lists a physical address, a phone number or at least a working customer service page. A store with only a contact form, or contact details that don’t match its social media pages, is a warning.
- Open the return policy. Vague, copied-and-pasted or missing return terms are common on fake stores, because they never plan to process a return.
Minute two: outside the site
- Search the store’s name with the word “scam” or “reviews.” Ignore the reviews on the store’s own pages, which are trivial to fake. You’re looking for complaints on forums, consumer sites and social media.
- Check when the domain was registered. ICANN runs a free lookup tool at lookup.icann.org. A site selling a famous brand’s products on a domain created a few weeks ago is not a store you want to test with your money.
- Compare the price with two big retailers. If the same item sells for close to full price everywhere else, a deep discount on an unknown site isn’t a deal. It’s bait.
The fastest fix of all is to skip the link. If an ad shows you a brand’s sale, open a new tab and type the brand’s address yourself, or use its app. If the sale is real, it will be there too.
What the scam usually looks like after you pay
Fake stores end in a few predictable ways. Sometimes nothing arrives. Sometimes a cheap knockoff shows up weeks later, which can make a refund fight harder because the store can point to a delivery. And sometimes the order was never the point: the site existed to collect card numbers, addresses and phone numbers for later use.
That’s why the checkout page deserves one more look. A store that suddenly asks you to pay by gift card, wire transfer, cryptocurrency or a payment app sent as a personal transfer is telling you who it is. Legitimate retailers take credit cards because the card networks make them accountable. Scammers avoid credit cards for the same reason.
Pay with the method that can claw it back
A credit card is the safest way to pay a store you’re not sure about, and federal law is the reason. Under the Fair Credit Billing Act you can dispute a charge for goods that weren’t delivered as agreed, as long as your letter reaches the card issuer within 60 days after the first bill showing the charge was sent. Your liability for unauthorized charges is capped at $50. The FTC’s guide to disputing charges lays out what to put in the letter.
Debit cards come out of your checking account directly, so even when the bank sides with you, the money is gone while the dispute plays out. If your card issuer offers virtual card numbers, use one for any store you’re shopping for the first time. A leaked virtual number can be shut off without replacing your real card.
The fake delivery text
This one peaks when everyone is expecting packages. A text says a delivery failed, the address is incomplete, or a small redelivery fee is due, and it links to a page that looks like a carrier’s tracking site. The page asks for your address, then your card number for the fee.
Go back to the opening fact: USPS texts you only after you’ve signed up with a tracking number, and those texts don’t include links. UPS and FedEx messages can be checked the same way, by opening the carrier’s app or typing its address and entering the tracking number from your original order confirmation. Never use the link in the text. You can forward scam texts to 7726, which spells SPAM, and the Postal Inspection Service also takes reports at [email protected].
The “problem with your order” message
A close cousin of the delivery text is the email or text saying your payment failed, your account is locked, or someone ordered something expensive on your account. It includes a phone number to call to cancel. The person who answers is the scammer, and the goal is to get your card details, a one-time code or remote access to your computer.
The fix is the same habit as before. Close the message, open the retailer’s app or website yourself, and look at your actual order history. If something is wrong, contact customer service through the official site. A real retailer will never need you to read them a verification code or install software so they can “help.”
Giveaways and too-perfect ads
Holiday giveaways are a cheap way to harvest information. A post promises a free gaming console or a gift card to anyone who clicks, shares and fills in a form, and the form wants your address, phone number and sometimes a small “shipping fee.” Aura also flags deepfake videos of celebrities promoting giveaways and discounts. A real brand promotion will appear on the brand’s own verified accounts and website, so check there before you enter anything.
If you already paid a fake store
- Call your card issuer or bank right away, report the charge as fraud or a purchase not received, and ask whether the card should be replaced.
- Follow up in writing if it was a credit card, so you’re inside the 60-day billing error window.
- Save everything: screenshots of the site, the ad that sent you there, order confirmations and emails.
- Change the password on any account where you reused the one you created at that store.
- Report the store to the FTC at ReportFraud.ftc.gov and report the ad to the platform where you saw it.
None of this requires suspicion of every sale. It just means the store gets two minutes of scrutiny before it gets your card number. A legitimate retailer passes that test without trying, and the fakes rarely do.
