Suspected fake online shop: saving evidence, securing accounts and reporting fraud

The prevention checks in our genuine online-shop guide help before payment. This page begins when an order, advert, payment or login already looks wrong. It is general information, not legal, financial or cybersecurity advice.

Leave the suspicious page safely

Do not continue entering information to “test” the site. Do not download invoices, remote-support tools or security software offered in chat. Close the page, preserve the exact URL from browser history and use a separate trusted route for every next contact.

If a download ran or remote access was granted, disconnect as appropriate and seek competent security help. Do not use the potentially compromised device to change high-value credentials until risk is assessed. A factory reset is not the first universal answer because evidence and backups matter.

Contact the payment provider promptly

Describe exactly whether the payment was authorised, unauthorised, a card purchase, bank transfer, wallet or other method. Those facts affect the provider’s process. Do not demand one statutory remedy before explaining the transaction. Ask what evidence, deadlines and temporary account controls apply.

For card purchases, our card-payment protection guide explains chargeback and Section 75 boundaries. A payment dispute and a fraud report are separate processes; doing one does not necessarily complete the other.

Secure accounts in the right order

Start with the email account that can reset other services, then banking, payment wallets, mobile account and reused retail passwords. Type the known address or use the official app. Choose unique passwords and enable multi-factor authentication where suitable. Sign out unknown sessions and review recovery email, phone and forwarding rules.

If card details were exposed, follow the issuer’s instructions. Deleting a retailer account does not remove copied credentials or reverse a payment. Monitor statements and alerts for follow-on activity, but do not rely on monitoring instead of reporting.

Choose the official reporting route

GOV.UK’s current scam guidance directs people in England and Wales who lost money or were hacked to Report Fraud. In Scotland, report the crime to Police Scotland. Northern Ireland has its own police route. Immediate danger or a crime in progress requires the emergency guidance for the jurisdiction.

Suspicious emails can be forwarded to the NCSC reporting address and suspicious texts to 7726 under current GOV.UK guidance. Report misleading adverts to the platform and, where relevant, the Advertising Standards Authority. Keep confirmation references.

Marketplace or independent trader?

Identify who took payment and who the contract names. A marketplace may host a third-party seller, process payment, provide buyer protection or act as retailer depending on the transaction. Preserve the listing and seller identity before it disappears. Our marketplace responsibility guide helps separate roles.

Use the platform’s official dispute route from a known app or typed address. A direct message asking you to continue on another service, pay again or close a dispute is a warning, not resolution.

Goods missing versus fraud

A late parcel is not automatically a fake shop. Check the promised date, tracking source and trader response. If a genuine trader has missed delivery, use the process in our late or lost parcel guide. If identity, payment or contact details are fabricated, escalate the fraud concern separately.

Do not let a fake tracking page reset the evidence clock. Save it, verify the carrier through its own known website and ask the payment provider how delivery evidence will be assessed.

What if a parcel arrives?

Photograph the unopened package, label and contents during opening when there is a dispute. Do not use counterfeit, unsafe or materially different electrical, cosmetic or ingestible goods. Keep packaging until the provider or enforcement route explains what is needed.

Do not return goods to an unverified address or pay a new “customs”, “insurance” or “release” fee without independently confirming it. A delivery does not erase false identity, misdescription or unauthorised payment concerns.

Bank route or report route?

Recovery scams target recent victims

After reporting, unsolicited callers may claim they can recover funds, trace cryptocurrency, serve legal documents or release a frozen refund for an upfront fee. Do not share report references, one-time codes or remote access. Verify any contact through the organisation’s published route.

Publicly posting the full evidence pack can expose personal data and attract recovery fraud. Share only with the bank, police, reporting service, platform, adviser or regulator that needs it.

Identity and credit follow-up

If identity information was exposed, record exactly what was disclosed and ask relevant organisations what protective steps apply. Check credit files through the recognised agencies if advised and challenge unfamiliar applications. Do not pay an unknown monitoring service contacted through the scam.

Keep the case timeline until payment, account and identity issues are resolved. Store it securely; redact copies used for ordinary complaints. For later retailer complaints, our returns and refund rights guide explains the civil consumer route.

Build a dated action log

Write one timeline using local time: when the advert was seen, when the order was placed, what payment confirmation arrived, when suspicion began and every action taken afterwards. Record case numbers, the organisation contacted, the channel used and the promised next step. Keep original files as well as screenshots; a screenshot of an email does not preserve all its technical information. Do not alter a receipt to highlight a point—make a separate annotated copy and retain the original.

A clear log reduces repeated explanations and exposes conflicting messages. If a supposed bank, courier or investigator calls later, compare the contact against the official case route rather than trusting knowledge of the transaction. Criminals may already know the amount, retailer name and last digits shown in a compromised message. Familiar details are not authentication. End the call and use a trusted number or authenticated app independently.

Communicate without weakening the record

Use factual, concise wording: what was authorised, what was received, what appears false and what outcome is requested. Avoid accusations that go beyond the evidence. Do not threaten publicity, accept a private refund outside the payment route or close a dispute merely because a seller promises action. Ask the provider what happens if goods arrive or a merchant refund appears after a claim starts, then follow that instruction.

Keep communication inside a marketplace or payment system where possible. Moving to private messaging can remove platform evidence and protection. If documents contain a full card number, passport image, bank statement or address, upload them only through the provider’s verified secure route and only when necessary. Redact copies sent elsewhere without destroying the original. Treat any request to install remote-access software, move money to a “safe account”, buy vouchers or share a one-time code as a new fraud warning.

Review the incident after the urgent phase

Once accounts and payment routes are secured, identify the entry point without blaming the victim. It may have been a copied shop, malicious advert, compromised marketplace account, reused password or convincing delivery message. Remove saved payment details where appropriate, review browser extensions and devices, and check whether the same password or security answer was used elsewhere. Continue monitoring for follow-up contact because stolen information may be used later even if the initial payment is recovered.

Balanced verdict

A fast, ordered response preserves options: trusted provider contact, account security, evidence, official reporting and monitored follow-up. Do not spend the first hour debating a suspicious seller or trying to prove the entire fraud yourself.

Different payment types and UK jurisdictions have different processes. State the facts precisely and follow case-specific instructions. Browse General Buying Advice for related evidence and dispute guides.