Fake Shops Steal Bank Codes

A widespread scam operation known as DoppelCart has been identified, linking nearly 119,000 domains that impersonate trusted online retailers. These fraudulent websites lure unsuspecting consumers with deep discounts, sometimes as high as 65%, making deals appear too good to pass up. Researchers discovered that over 105,000 DoppelCart shops were active recently, with the majority still online as of Nebty's latest analysis.

The sophistication of DoppelCart fake shops is a significant concern. These sites meticulously copy product catalogs, descriptions, and branding from legitimate businesses, sometimes even loading assets directly from the authentic companies' servers. This makes them appear highly convincing, blurring the lines between genuine and fraudulent online stores.

During the checkout process, DoppelCart sites pose a severe threat by collecting not only standard payment card details like numbers, expiration dates, and security codes but also highly sensitive one-time bank verification codes. This tactic exploits multi-factor authentication, potentially allowing scammers to bypass security measures for fraudulent transactions.

Legitimate businesses can also suffer reputational damage as disgruntled customers, who unknowingly shopped on fake sites, may contact the real companies seeking support for orders never placed. Nebty's investigation highlighted the extensive reach of this operation, with a substantial portion of .shop domains associated with the DoppelCart cluster, underscoring the pervasive nature of this online threat.