Shopping Scams Topped Social Media Fraud Reports. How to Shop Safely.

On October 1, 2026, days before Amazon's October 6–7 Prime Big Deal Days sale, Check Point Research reported that new Amazon- and Prime Day-themed web domains rose 42% from July to 1,284 in September, with about one in 16 flagged as malicious or suspicious. The same day, security firm Group-IB described a phishing kit called Milk Dragon that runs fake discount stores promoted on social media and captures card numbers and one-time passcodes. For holiday shoppers, a polished store and a big discount prove nothing: check who runs a site before paying, pay by credit card, and know that the dispute deadline runs from your statement, not the missed delivery date.

Key takeaways

Shopping scams were the most reported social media scam in 2025, the FTC says; more than 40% of people who lost money to a scam on social media said it started when they ordered something they had seen in an ad.
Growth depends on the measure. FBI complaints about goods paid for but never received rose 13.9% in 2025 and reported losses fell 35.9% from a 2024 peak, yet those losses were still 63% above 2023. Online purchase scams were a slightly smaller share of BBB reports than in 2024.
Security vendors have mapped single fake-shop networks of 20,000 to 75,000 domains built from shared templates.
A credit card gives you a federal right to dispute a charge for goods not delivered as agreed, if the written dispute reaches the issuer within 60 days after the first statement showing it. A debit card purchase you made yourself has no equivalent federal right.
The FTC says a seller that will take payment only by gift card, wire transfer, payment app or cryptocurrency is probably a scam.

What it means for you

Holiday shoppers buying from social media ads: treat the ad as a lead, not a trusted store, and run the checklist below before paying.
Deal hunters searching for brand-name goods: fake shops copy brands' logos and catalogs. Type the brand's own address and compare prices.
Older adults and those who help them: a smaller share of scams start on social media at older ages, but people 65 and over were the most likely to lose money when targeted in BBB data.
If you already paid a fake store: call your card issuer or payment provider now; the dispute clock may already be running.
Small sellers whose brand is being copied: report the domain to its registrar's abuse contact and the ads to the platform's intellectual property channel.

What the numbers actually show

No dataset counts fake stores directly, and the available measures point in different directions. Reports and losses tied to social media and complaints to the FBI rose; the FBI's loss total and the BBB's share fell. Which year you compare with matters.

Source (data type)	Measure	2024	2025	Change
FTC Consumer Sentinel (consumer reports)	Losses on scams that started on social media, all scam types	$1.9 billion	$2.1 billion	About +10%; about eight times 2020
FBI IC3 (complaints)	Non-payment/non-delivery complaints	49,572	56,478	+13.9%
FBI IC3 (complaints)	Non-payment/non-delivery losses	$785.4 million	$503.4 million	−35.9%; +62.6% vs. 2023 ($309.6 million)
BBB Scam Tracker (reports to BBB)	Online purchase scams as a share of all published reports	30.3%	28.4%	−1.9 points; rank rose from No. 4 to No. 3 riskiest

The FTC's April 27, 2026 data release on social media scams found shopping scams were the most reported scam on social media in 2025. Its Data Spotlight says many ads led to unfamiliar sites or brand impersonators and most goods never arrived. The FTC collected no reports during the 2025 government shutdown, so 2025 totals may be understated. As of October 9, 2026, the latest annual data book on the FTC's data page is the 2024 edition. The 2024 Data Book ranked "online shopping and negative reviews" second among fraud categories, with 383,441 reports, $432 million in reported losses and a median loss of $130.

The FBI's 2025 Internet Crime Report, released April 6, 2026, shows more complaints but lower losses for non-payment/non-delivery than in 2024, a category that also covers sellers who are never paid. The 2024 loss figure looks like a spike: in 2023 the FBI logged 50,523 complaints and $309.6 million in losses in this category, so 2025 was higher than 2023 on both counts. The average loss per complaint was about $6,100 in 2023, $15,800 in 2024 and $8,900 in 2025, but a few large losses can swing that average, so it says little about a typical shopper.

The BBB's 2025 Scam Tracker Risk Report, built from reports submitted to the BBB, found online purchase scams the most reported type; 89.3% involved a loss, with a median of $68.

Age matters. Social media was the starting point for 40% of FTC loss reports from people aged 18 to 29, but 14% for those 80 and over. For people 60 and over, the FBI's figures rose on both counts: 9,743 non-payment/non-delivery complaints in 2025, up 27.4% from 7,646, with $127.0 million lost, up 65.4% from $76.8 million. In BBB data, people 65 and over were the most likely to lose money when targeted (43.2%), and older people more often paid by gift card or check.

How fake stores work now

Security vendors describe industrial-scale networks, not one-off sites. These figures are the companies' own research.

Shared templates at scale. SRLabs' 2024 BogusBazaar study traced more than 75,000 domains, about 22,500 of them active in April 2024, and more than 850,000 customers, mostly in Western Europe and the US. The group favored expired domains with a good Google reputation, so a store can look older than its owner.
Cheap domains and copied catalogs. Malwarebytes mapped a network of more than 20,000 fake shops in March 2026, mostly on .shop with near-identical storefronts. Victims got nothing or a cheap knockoff, and their card details could be resold.
Brand impersonation through ads. CTM360 reported more than 30,000 fake fashion-store domains impersonating more than 350 apparel brands, driven mainly by sponsored ads and fake social profiles, in a February 2026 piece CTM360 contributed itself.
Fake checkouts that steal one-time codes. Milk Dragon's fake checkouts pass card details to the operator as they are typed, then show a fake bank verification screen to capture the one-time code and approve fraudulent charges. A fake order confirmation delays the victim from canceling the card. Because real stores also ask for bank codes, a code request cannot tell you a store is genuine.

The FTC's September 1, 2026 alert on cloned car-dealer websites shows the same pattern for big purchases: a real dealer's site copied, often with AI, plus fake testimonials and generous return policies.

Checking a store before you pay

No single check proves a store is real; several failures together are reason to walk away. The list draws on the FTC's online shopping advice and its November 2025 holiday shopping alert.

Search the store's name and web address with "scam," "complaint" or "review." The FTC warns not to rely on star ratings alone, and its dealer-site alert notes that when a real business is being impersonated, searches may turn up that business's glowing reviews.
Look up the domain's registration date. ICANN Lookup is a free tool that queries RDAP, the registration data service that replaced WHOIS for generic domains such as .com and .shop in January 2025. For those domains, RDAP records include the date the domain was registered and the registrar's abuse contact; some country-code domains may return little or no data. A domain registered weeks ago that claims years in business is a red flag. An older date is not a pass: fake-shop groups favor previously used domains, and a domain that changes hands without lapsing can keep its original date.
Check contact details and the return policy. Look for a verifiable address, a working phone number and a return policy that says who pays return shipping. The FTC's Data Spotlight says goods from social media shopping scams were often shipped from China, with return shipping costs that made returns unworkable.
Compare the price with the brand's own site. A deep discount on an item sold out elsewhere is a common lure.
Read the checkout. Stop if the only options are gift cards, wire transfers, payment apps, cryptocurrency or a bank transfer.

How you pay decides your options

What you can recover depends mostly on how you paid. The table summarizes federal rules and FTC guidance as of October 2026; banks, card networks and apps may offer more under their own terms. This is general information, not legal or financial advice.

Payment method	Goods never arrive (you approved the charge)	Card details stolen and reused
Credit card	Billing-error dispute under the Fair Credit Billing Act. You may withhold the disputed amount while the issuer investigates.	Federal protection against unauthorized use
Debit card	No federal billing-error right; ask the bank about voluntary or card-network chargebacks	Regulation E covers unauthorized transfers, including by someone who got the card through fraud
Bank transfer, Zelle, payment apps	Report immediately and ask for a reversal; no guarantee	If someone else sent money from your account, unauthorized-transfer rules can apply; payments you sent yourself generally are not covered
Gift card, wire, cryptocurrency	Contact the issuer, wire company or exchange right away; recovery is hard	Not applicable

The credit card rule, with its conditions

Under the Fair Credit Billing Act (15 U.S.C. 1666) and Regulation Z, section 1026.13, a charge for goods not accepted or not delivered as agreed is a billing error. Your written notice must reach the issuer at the billing-error address it discloses, no later than 60 days after it sent the first statement showing the charge. Late delivery counts, and you do not have to contact the merchant first. The issuer must acknowledge within 30 days and resolve it within two billing cycles, at most 90 days. Many issuers take disputes by phone or app, but the protections attach to a written notice; an online form counts only if the issuer's billing rights statement says it accepts electronic notices. Otherwise, send a letter too.

The debit card gap

Regulation E's definition of an unauthorized transfer excludes transfers you started yourself, so a debit purchase you made from a fake store is generally not covered. Later charges by someone who stole the card number at a fake checkout differ: the official interpretation treats transfers by a person who got the access device through fraud as unauthorized. The FTC's guidance on undelivered orders says debit card users may not get a refund for non-delivery and should ask their bank about voluntary protections. Timing matters for stolen card numbers: under Regulation E's liability rules, if the physical card was not lost or stolen, reporting unauthorized charges within 60 days after the statement showing them was sent generally leaves you owing nothing for them; charges made after that window and before you report can become your loss.

Illustrative example: the 60-day clock

Hypothetical dates and amounts. A shopper buys a $180 jacket from a social media ad on Black Friday, November 27, 2026, with a credit card. The store promises delivery within 30 days. The issuer sends the statement showing the charge on December 4.

Dispute deadline = date first statement was sent + 60 days
                 = December 4, 2026 + 60 days
                 = February 2, 2027

Promised delivery = November 27, 2026 + 30 days = December 27, 2026
Days left after the promised date passes = 37

If "shipping delayed" emails keep the shopper waiting until January 27, six days remain. The safer habit is to note the statement date as soon as the charge appears.

Frequently asked questions

Does a padlock or "https" mean a store is safe?

No. The padlock means the connection to the site is encrypted, not that the business behind it is real. The FTC's online shopping guidance says to look for https before entering payment details, but warns that it alone does not prove a site is legitimate.

Can I dispute a charge if a counterfeit arrived instead?

Often, yes, if you paid by credit card. Regulation Z treats goods "not accepted" or not delivered as agreed as a billing error. The FTC lists wrong or damaged goods among the problems a card dispute can address. Describe how the item differs from the listing and keep photos; the issuer decides based on the evidence.

Is every .shop or .store website a scam?

No. Plenty of legitimate businesses use newer domain extensions. Malwarebytes found most domains in one large fake-shop network on .shop and advises extra scrutiny when an unfamiliar extension is paired with a generic, brand-like name. Treat the extension as one signal alongside the registration date and contact details.

What must a real online seller do if it can't ship on time?

Under the FTC's Mail, Internet, or Telephone Order Merchandise Rule, a seller must ship within the time it advertised, or within 30 days if it stated none (50 days if you applied for its credit to pay). If it can't, it must offer you the choice of accepting the delay or canceling for a refund. Under the rule's definitions, a refund is due within seven working days, including a credit sent to your card issuer if you paid by card; the one-billing-cycle limit applies only when the seller itself extended the credit. Some orders are exempt, including seeds and growing plants and C.O.D. orders.

Will reporting to the FTC get my money back?

Usually not directly. The FTC's Data Book says it does not intervene in individual consumer disputes; law enforcement partners use the reports to spot trends and bring cases. A refund usually comes through your card issuer, bank or payment provider, so contact them first.

If you already paid a fake store

Call your card issuer or bank today using the number on the card or in its app, following the FTC's steps by payment method. Say whether the goods never arrived, whether a stranger is reusing your card, or both. If you typed a one-time code into the store's checkout, ask for the card to be replaced.
Send the written credit card dispute to the billing-error address on your statement, so that it arrives within 60 days after the first statement showing the charge was sent, and keep a copy.
For payment apps, bank transfers, gift cards, wires or crypto, contact the app, bank, card issuer, wire company or exchange immediately and ask for a reversal. Keep the gift card and receipt.
Save the evidence: the ad, site address, screenshots, order confirmation and emails.
Report it at ReportFraud.ftc.gov and to the FBI's Internet Crime Complaint Center at ic3.gov.
Report the ad on the platform where you saw it. Meta's scam reporting page lists the paths for Facebook and Instagram.
If it is your brand being copied, send the domain to the registrar's abuse contact listed in its RDAP registration data, which you can query through ICANN Lookup. Report infringing ads through Facebook's intellectual property ad reporting, which accepts trademark, copyright and counterfeit claims.