Published today, October 20, 2026, a first-of-its-kind study by Savi Security's Scamwise has quantified just how industrialized online shopping fraud has become: users report a new fake store roughly every 3 minutes — about 500 a day. The report, drawn from more than 1 million consumer submissions including 250,000+ e-commerce sites, delivers one uncomfortable headline for this holiday season: scammers no longer fake a single product. With generative AI, they fake the entire store.
With Black Friday (November 27) and Cyber Monday (November 30) weeks away, the red flags shoppers were taught no longer work. Here's what the report found — and what actually protects you in 2026.
The report in 60 seconds: 500 new fake stores a day
The Scamwise 2026 Holiday Shopping Scam Report (press release via GlobeNewswire, October 20, 2026) analyzed anonymized consumer submissions from March to October 2026. Its headline numbers:
- A new fake store reported every 3 minutes — about 500 a day.
- Fake holiday-themed stores up 5x in the last 60 days. The store that scams you on Black Friday most likely does not exist yet.
- 7 in 10 fake stores are seen once and never again; nearly 40% are under 90 days old when first reported; 85% are gone within two weeks.
- At least 1 in 5 fake stores was traced back to an ad on a major platform — Meta and Google are the preferred channels.
- "Too good to be true" still appears in 1 in 4 scam stores — but during Cyber Week, when real retailers advertise 50% off or more, impossible discounts become camouflage.
The report also launched a free Scamwise Chrome extension that checks sites as you browse, and opened early access to a "Scamwise MCP" server for AI shopping assistants.
"They fake the whole store" — AI turned scammers into big-box retailers
Five years ago, shopping scams were crude single-product cons: fake COVID tests, shady puppy breeders, counterfeit luxury bags with a PayPal button. The report's core claim is that generative AI has changed the unit of fraud: scammers now spin up polished, professional-looking retailers with department-store-size catalogs, sincere-sounding mission statements, return policies, and real ad campaigns.
"Generative AI has turned scammers into big box retailers of bogus products," said Savi Security co-founder and CEO Patrick Coughlin in the announcement. "The instincts shoppers have relied on for years, like 'it looks sketchy' or 'check the reviews,' don't catch these sites anymore."
That matters for timing, too. Savi's partner The Media Trust detected a sharp September surge in ad threats ahead of the usual holiday escalation — scammers are entering this shopping season with a head start.
The most surprising finding: myshopify.com is the #1 scam domain
Of all confirmed scam cases in the dataset, the most common domain wasn't Amazon, eBay, Etsy, or Walmart — it was myshopify.com, outranking all four combined.
This is the "trusted platforms, untrustworthy sellers" pattern. A legitimate storefront platform lends credibility: a myshopify.com subdomain, a Google or Meta ad, a polished template. The platform isn't the scammer — the sellers abusing it are. But the data shows scammers prefer riding trusted infrastructure over building their own.
For shoppers, the lesson cuts both ways: a familiar platform domain is not a trust signal, and a slick Shopify storefront is no more trustworthy than any other unknown site. In Europe, where cross-border shopping means buying from sellers in countries whose consumer protections you may never invoke, this deserves extra caution — the EU's Digital Services Act requires platforms to act on illegal traders, but a scam store that vanishes in two weeks is gone before any report reaches it.
Real ads, fake stores: how 1 in 5 fake shops found their victims
At least 1 in 5 fake stores traced back to an ad on a major platform, with Meta and Google the preferred channels. Think about what that does to consumer behavior: most shoppers treat an ad they found on Facebook, Instagram, or Google as implicitly vetted. It is not. Ad platforms are not verification services — they sell placement, and scammers buy it.
Holiday timing makes this worse. During Cyber Week the ad auction is crowded, ad volume explodes, and a fake store's sponsored post sits between real retailers' ads. The report explicitly retires "being advertised doesn't mean it's legitimate" as a red flag that too many shoppers still treat as green.
This is also why enforcement is gaining teeth in parallel: in the US, the FTC's fake-review rule allows civil penalties against deceptive practices, and in the UK, the CMA is now running live fake-review investigations into companies including Just Eat, Autotrader and Feefo, Dignity, and Pasta Evangelists, with £12M+ in fines over 18 months. Ads and reviews are both under real regulatory pressure — which is exactly why scammers moved to whole-store fraud, the part neither system catches quickly.
The red flags that no longer work (and why)
The report formally retires the old checklist. These no longer separate real from fake:
- "It looks sketchy." AI-built stores look polished — full catalogs, return policies, mission statements.
- "It has good reviews." The reviews on a fake store's own pages are written by the same operation running the shop. There is no platform moderation catching them.
- "It's advertised on a real platform." See the Meta/Google ad pipeline above.
- "The discount isn't insane." During Cyber Week, real stores advertise 50%+ off, so scammer discounts blend right in.
What the report's "Checkout Check" replaces them with:
- Polish is not proof. A professional-looking site can still be fake.
- Look up the store, not just the deal. Check how long the site has existed and whether anyone outside its own pages has heard of it.
- Stay alert after checkout. Fake delivery texts, order confirmations, and refund scams spike after big shopping days.
- When in doubt, check it first — on a neutral third-party checker, before you enter payment details.
AI shoppers are the new mark
One of the report's most forward-looking findings: as consumers hand shopping over to AI assistants like ChatGPT and Claude, scam sites are already being surfaced to them. The old warning signs are failing for machines as well as humans.
That's why Savi Security is opening early access to its "Scamwise MCP" — a Model Context Protocol server that lets AI assistants check websites, messages, and links against scam intelligence before recommending or acting on them. The implication for shoppers: until AI assistants carry their own fraud checks, a link your AI shopping helper suggested deserves the same verification as any random ad. AI can recommend; it cannot verify — at least not yet.
The 2026 checkout check: verify the store before you pay
Before you buy from any unfamiliar store this holiday season, run this five-step check:
1. Run the store through a website scam checker. Our free website scam checker examines the domain age, contact details, business identity, and other trust signals — the exact things fake stores try to hide. Remember the report's number: nearly 40% of fake stores were under 90 days old.
2. Search the store name plus "scam" or "reviews." Real victims post warnings. A store running big ads with zero outside mentions anywhere is itself suspicious.
3. Check the domain, not the ad. Treat stores found through social media ads with extra caution, especially new ones. Read our full guide to verifying any online store: https://fakereviewdetector.org/blog/is-this-website-legit-how-to-check-online-store-safe
4. Inspect the reviews on the store's own pages. Glowing testimonials with identical phrasing, no specifics, and all five stars are often written by the scam operation itself. If they look manufactured, paste the review text into our free fake review checker — it reads the language patterns that separate genuine write-ups from fabricated ones. One honest note: the checker reads review text you paste in — it does not fetch store pages or analyze links on its own. Learn the warning signs in our AI-generated fake reviews guide: https://fakereviewdetector.org/blog/how-to-spot-ai-generated-fake-reviews
5. Pay with protection. Use a credit card or PayPal with buyer protection — never wire transfers, gift cards, or crypto. If a store only accepts irreversible payment methods, walk away. See also our holiday-season deep dive on AI scam shops: https://fakereviewdetector.org/blog/fake-holiday-stores-ai-scam-shops-2026
Already bought from a fake store? Do this now
Act fast — fake stores disappear in days, and the report says 85% are gone within two weeks:
1. Stop further charges. If you saved your card on the site, remove it from your account there and watch your statements; call your bank immediately about any follow-on charges.
2. Request a chargeback. Credit cards and PayPal offer buyer protection for items never received or not as described — in the EU you have the same rights against the card issuer for cross-border purchases.
3. Report it. In the US, file at reportfraud.ftc.gov; in the UK, report to Action Fraud; in the EU, contact your national consumer center. Reports feed exactly the kind of consumer-submission datasets this report was built from.
4. Freeze or monitor your identity if you created an account. Fake stores harvest email addresses and passwords — change the password anywhere you reused it, and watch for phishing follow-ups (fake delivery texts and refund scams spike after big shopping days, per the report).
FAQ
Q: Is a myshopify.com store automatically a scam?
A: No — Shopify is a legitimate platform used by millions of real businesses. The report only found that among confirmed scam cases, myshopify.com subdomains were the most common domain. Treat the platform as neutral and verify the individual seller with the checks above.
Q: Are fake holiday stores really up 5x?
A: That figure comes from Scamwise consumer submissions over the 60 days before October 20, 2026 — fake holiday-themed store reports grew fivefold. It's submission data, not a total count of all scam stores, but it matches the seasonal pattern of holiday shopping fraud.
Q: Do Meta and Google ads only show legitimate stores?
A: No. The report traced at least 1 in 5 fake stores to ads on major platforms. Ad placement is sold, not vetted like a product review.
Q: Can AI shopping assistants spot fake stores?
A: Not reliably — the report says scam sites are already being surfaced to AI assistants. Until assistants carry their own fraud checks, verify any AI-recommended store yourself.
Sources
- Savi Security / Scamwise, "The 2026 Holiday Shopping Scam Report" — press release via GlobeNewswire, October 20, 2026 (report based on 1M+ consumer submissions, 250,000+ e-commerce sites, March–October 2026).
- Quotes: Patrick Coughlin, co-founder & CEO, Savi Security; Chris Olson, co-founder & CEO, The Media Trust.
- UK CMA enforcement context: CMA live investigations and £12M+ in fines over 18 months (ICLG / corp-intl reporting, October 2026).
- FTC fake review rule civil-penalty authority (US).
Explore the evidence behind your next question.
Start a website check