A fake store under your brand: how to spot and report it

Before Black Friday, which falls on 27 November this year, more and more stores with irresistible deals appear online. Some of them don’t invent a name of their own but take someone else’s: the logo, product photos, descriptions and a name with one letter changed. The customer pays, the package never arrives, and the complaints and bad reviews go to the real business, because that’s the brand they saw in the ad.

The scale is large. According to the 2025 annual report of CERT Polska (Poland’s national computer security incident response team), published on 8 April 2026, computer fraud accounted for 97% of the incidents it handled, and nearly 245,000 domains were added over the year to its Warning List (Lista Ostrzeżeń) of dangerous websites. I show how to check in a quarter of an hour whether someone is impersonating your business, where to report a fake store and what to write to your customers. I describe the situation as of 6 November 2026: platforms change the names of buttons and forms from time to time.

How a fake store under someone else’s brand works

A credible-looking store today is built from a ready-made template and copied photos. In its guide to fake stores, CERT Polska points out that a scammer can set any price, however low, because they have no intention of shipping anything. A typical pattern:

• a lookalike domain: a name with a typo, an extra hyphen or an added word such as “outlet”, “sale” or “sklep” (store), often with an extension like .shop, .top or .xyz,
• a copy of the website: your logo, photos and descriptions, sometimes even company details copied from the footer,
• ads on Facebook and Instagram: “store closing down”, “-70% today only”, a timer counting down to the end of the promotion,
• a single payment method or pressure to use a specific one, and after payment silence or a cheap substitute in the package.

This has already happened to well-known brands. In November 2023, CSIRT NASK (the incident response team of NASK, Poland’s national research institute) warned about fake websites posing as stores of the Wojas, Cropp, Sinsay and Mohito brands and reminded people that scammers impersonate online stores during the Black Friday and Cyber Monday sales. In July 2025, UOKiK (Urząd Ochrony Konkurencji i Konsumentów, Poland’s Office of Competition and Consumer Protection) described stores posing as Polish clothing and footwear brands, and among the warning signs it listed a well-known name with a typo or an extra hyphen and unusual domain extensions such as .xyz, .lol or .top.

How to check whether someone is impersonating your business

This review takes about 15 minutes and doesn’t require a developer. Repeat it every week until Cyber Monday, that is, until 30 November.

1. Search for your business name on Google together with the words “sklep” (store), “outlet”, “promocja” (promotion), “black friday”, “wyprzedaż” (sale) and “likwidacja” (closing down). Look for addresses that aren’t yours.
2. Check your photos. Google image search (Google Lens) will show where else a photo of your product appears. Start with the 3–5 most distinctive ones.
3. Go through the Meta Ad Library. Set the country to Poland and the category to all ads, then enter your brand name. The library covers ads currently running on Meta platforms, and a new ad appears in it within 24 hours of its first impression. Look at the advertiser: if it isn’t your Page, but the ad shows your logo or photos, you have a problem.
4. Look at the Google Ads Transparency Center. You can search it for advertisers by name or by website address.
5. Type common variations of your domain into the browser: with a hyphen, without the Polish letter, with a doubled letter, with a .com, .eu or .shop extension. For .pl domains, the NASK WHOIS database shows the registration date and the registrar. A domain created a few days ago and a store “with a long tradition” is a bad sign.
6. Set up Google Alerts for your business name and the names of your products. You’ll get an email when Google finds a new page with that phrase.

An IT specialist can also track new SSL certificates for domains containing your business name (Certificate Transparency logs). The fastest signal, however, often comes from customers: every “is this your store?” question from someone you don’t know should reach you right away.

Where to report a fake store

Before you report anything, gather evidence: screenshots of the website and the ads with the address and date visible, a link to the ad, the bank account number or payment link (if the store shows them) and messages from affected customers. A fake website can disappear within a few hours, and a report with evidence is easier to process.

CERT Polska

The most important step is a report at incydent.cert.pl. Choose “Osoba fizyczna / inne podmioty” (individual / other entities) if your business is not an essential or important entity under the ustawa o krajowym systemie cyberbezpieczeństwa (Poland’s National Cybersecurity System Act), and then the category “Oszustwo” (fraud), described as fake online stores and other impersonation attempts. The form asks for a link to the store, how you learned about it, any correspondence, the bank account number for payments and the police case number, if there is one.

Domains found to be dangerous are added to the Warning List. CERT Polska maintains it under the Act of 28 July 2023 on combating abuse in electronic communications (ustawa o zwalczaniu nadużyć w komunikacji elektronicznej). Operators that have joined the agreement, including Orange, Plus, Play and T-Mobile, block listed domains for 6 months. A customer who gets internet access from such an operator will then see a warning page instead of the store. Forward a suspicious text message free of charge to 8080.

Facebook and Instagram

• An ad: click the three dots next to the ad and choose to report the ad.
• A Page or profile posing as your business: according to Facebook Help, open the options menu below the cover photo and choose to report the Page. You can also send a report without an account, through a contact form.
• Copied photos, texts and logo: Meta has forms for reporting intellectual property infringements with a choice of copyright, trademark or counterfeit. A trademark report requires a registered trademark: you give the country and the registration number, one trademark per report, up to 30 links.

Google

• An ad on Google: find the ad in the Ads Transparency Center and click “Report this ad”.
• A website that tricks people out of money or data: report it to Google Safe Browsing. When Google considers a website dangerous, Chrome shows a warning before anyone opens it.

Police

For customers who have lost money, CERT Polska advises notifying the police or the Centralne Biuro Zwalczania Cyberprzestępczości (Central Cybercrime Bureau). You can also file a report as the business whose brand was used. Whether further legal steps make sense, and which ones, is for a lawyer to assess: this guide is not legal advice.

What to write to customers: ready-made texts

Don’t wait for the fake store to disappear. Write to your customers the same day: on your website (a bar at the top or a post), in a pinned post on Facebook and Instagram, and in your newsletter. Calmly and to the point, without scaring anyone.

Notice for your website and social media:

Beware of a fake store. A website at [fake address] is impersonating [company name] and using our photos in its ads. It is not our store. Our only online store is at [your-domain.pl], and our official profiles are linked in the website footer. We never ask for payments to accounts other than those listed on our website. If in doubt, please call us: [number]. We have reported the matter to CERT Polska.

Reply to a customer who paid in the fake store:

Hello, we are very sorry. The store [fake address] does not belong to us: it is impersonating our business, and we have reported it to CERT Polska. Please contact your bank as soon as possible. For card payments, your bank may be able to help you recover the money through the chargeback procedure. It is also worth reporting the fraud to the police and at incydent.cert.pl. Our store operates only at [your-domain.pl].

Under posts and in reviews, reply briefly, e.g. “This is not our store. Our address is [your-domain.pl], and we have reported the matter to CERT Polska.” Don’t delete comments about the scam, because other customers can see from them that the business knows about the problem and is responding. You can also refer affected people to municipal and county consumer ombudsmen (miejscy i powiatowi rzecznicy konsumentów) or to the consumer helpline recommended by UOKiK: 801 440 220 or 22 266 76 76.

Official channels and lookalike domains

Scammers have the easiest time where customers don’t know what the real business looks like. That’s why:

• List your official channels on your website: the store address, social media profiles, phone, email and payment methods. Ideally in the footer and on the contact page, with one sentence: “We operate only at these addresses.”
• Link both ways: from the website to the profiles and from the profiles to the website. A customer who lands on a profile can check the store address right away.
• Create profiles where you don’t have them yet. An unclaimed name on Instagram or Facebook is an open spot for a scammer. A profile with a logo, a description and a link to the website is enough. I set up and configure such profiles as part of the Social media groups and channels service (from PLN 290 net per channel).
• Secure your business accounts with two-step verification. A hijacked real profile is more dangerous than a fake one, because it has your followers. I describe how to do this in the guide on a hijacked Facebook business account.
• Keep an eye on your email and your bank account number. Scammers also impersonate businesses in emails and on invoices. I write about DMARC and verifying account numbers in the guide Swapped bank account number on an invoice.

Buy lookalike domains with care. You can’t buy up every variant, because there are hundreds of domain extensions. Register the ones a customer might type in themselves:

Set up the additional domains as redirects to the main one, turn on automatic renewal and make sure they are registered to your business, not to your contractor. If your brand matters to you, consider registering a trademark with the Urząd Patentowy RP (Patent Office of the Republic of Poland). Meta’s trademark infringement form accepts only registered trademarks, and disputes over .pl domains are handled by, among others, the Sąd Polubowny ds. Domen Internetowych przy PIIT (Court of Arbitration for Internet Domain Names at the Polish Chamber of Information Technology and Telecommunications). Discuss the scope of protection and the costs with a patent attorney.

Black Friday plan: a checklist

• Today: the review from the “How to check” section and Google Alerts for your business name.
• By 13 November: official channels listed in the footer, two-step verification on all business accounts, missing profiles created.
• By 20 November: ready-made notices saved in the team’s notes; agreed who reports fake stores and who replies to customers.
• Every week until 30 November: Meta Ad Library, Google Ads Transparency Center and a search for your business name.
• When you find something: evidence, reports to CERT Polska, Meta and Google, and a notice to customers the same day.

Summary

You can’t completely rule out a fake store under your brand, but you can find it quickly and limit the damage. Check Google and the ad libraries once a week, report fake websites to CERT Polska, Meta and Google, and tell your customers clearly where your real store operates.

If you want to prepare your business before 27 November, write to me. In a security audit (from PLN 990 net), I check, among other things, how the website is protected against scraping and bots, and in the Project cybersecurity service (from PLN 690 net), I secure the server and set up backups and monitoring. I reply within 24 hours.