How to spot a fake online shop before Black Friday

"Artificial intelligence is making shopping scams cheaper, faster and more convincing," the update says. "Scammers use AI to generate product images, build polished websites and craft compelling stories about products and sellers."

It also says a familiar logo, an Australian Business Number and a convincing payment screen "can all be part of the disguise". One example in the report was fake car sales sites showing Australian addresses, phone numbers and business numbers, with photos of cars a real dealer had already sold. Professional looking invoices and contracts made a bank transfer look like a normal purchase.

The good news is that the centre has taken down 20,353 scam websites so far this year, many of them posing as online shops. The bad news is that new ones keep going up, and they tend to arrive with "limited time" sales right before the big shopping weekends.

So let's go through the checks, in order.

Step 1: Don't start from the ad

The single best habit is to never buy from a link someone sent you or an ad that popped up in your feed. Type the shop's address yourself, or find it through a site you already trust.

The centre's advice is to "Visit a retailer's website independently rather than following an unsolicited message or advertisement." Scamwatch's buying and selling scams page adds a warning that catches a lot of people: "Don't assume that the first search result that comes up in an internet search engine is the real website." Scam sites can show up at the top of the list too.

Step 2: Read the web address slowly

Look at the address bar, letter by letter. Scamwatch lists these red flags:

• multiple dashes or symbols in the domain name
• a domain that imitates a business, such as Ap9le
• an Australian business whose address doesn't end in .com or .com.au

If the address is anything other than what you'd expect for that brand, close the tab.

Step 3: Find out how old the site is

A shop that's been "in business for 20 years" but registered its website last month is lying to you. Scamwatch suggests using the free ICANN Lookup tool to see when a site was registered. Paste in the domain and look for the creation date.

If it's a .com.au address, Scamwatch says you can use the Australian Domain Authority's website to see which company or trademark registered it.

Step 4: Check the business number, then check it matches

Scamwatch says to look for the shop's Australian Business Number and check it on the government's business register lookup. But here's the catch from this week's warning: scammers now copy real business numbers. So don't stop at "it exists". Check that the business name on the register matches the shop you're looking at, that it's active, and that the state lines up with the address the site gives.

Then do the same with the physical address. Scamwatch's advice is to "Check that the physical location of a store you find online really exists and that the store really is located there." Pop it into a map and look at the street view. A warehouse showroom that turns out to be a house in a suburban street is a pretty clear answer.

Step 5: Look for the boring pages

Real shops have dull pages that scam shops often skip. Scamwatch says a legitimate website should have information about privacy, terms and conditions of use, dispute resolution and contact details. "No contact information is a sign it's likely a scam," the page says.

Click the contact page. Is there a real phone number? Does it answer? Is the returns policy written for Australia, or does it read like it was copied from somewhere else?

Step 6: Search the shop's name with the word scam

This one's quick. Type the website name and the word scam or review into a search engine, which is exactly what Scamwatch suggests, and read the results carefully. Look for independent reviews on sites that aren't the shop's own. A shop with glowing reviews only on its own pages, and nothing anywhere else, isn't one to trust.

Step 7: Watch how they want to be paid

This is where most money goes missing. Scamwatch warns about being told to pay "in unusual ways including paying by money order, pre-loaded card, or to several different PayIDs or accounts", and about cases where "The account holder doesn't match the person or business you think you are paying."

Pay with a credit card or a secure payment service like PayPal, which Scamwatch names as the kind of option a real shop offers. If a shop gives you a discount for paying by bank transfer or crypto, that's not a bargain, it's a warning. When you do use a bank transfer or PayID, make sure the name that comes up matches the business. Many payments are now instant, Scamwatch notes, and "it's unlikely you will get your money back."

Step 8: Treat a countdown timer as a stop sign

The centre's first piece of advice this week is about pressure. "Treat large discounts, countdown timers and pressure to pay immediately as reasons to pause, not rush," it says.

A real sale will still be there in ten minutes while you do the checks above. A scam needs you to pay before you think.

If you're selling, not buying

This week's report also flagged scams aimed at sellers on the marketplace Vinted. People who listed items got messages saying their item had sold, with a link to "verify" their account or collect payment. The links led to fake pages copying the marketplace, payment services and sometimes the seller's own bank. In one case reported to Scamwatch, $1,800 was taken from a seller's account.

The fix is simple. Keep every conversation and payment inside the platform, and never log in to your bank from a link a buyer sent you. Scamwatch's general advice for marketplaces is the same: use the secure payment methods the platform recommends and keep communications on the platform.

Concert tickets are a special case

The centre also reported fake ticket offers for Olivia Dean and Bruno Mars shows. People were approached on Facebook and TikTok, then moved to WhatsApp, and asked for extra "transfer, authorisation or name-change fees". If someone you don't know is selling you tickets in a chat app and keeps adding fees, walk away. Buy through the official ticket seller or its own resale service.

What to do if it's already happened

Don't feel stupid. The centre says so directly: "Being scammed is not evidence of consumers' failure to miss red flags," it says. Instead, the centre puts it down to scammers getting better at deception as technology advances.

Then move fast:

1. Call your bank straight away if you've paid or shared card details.
2. If you gave a password, change it, and turn on multifactor authentication.
3. Report it to police through ReportCyber and to Scamwatch.
4. If your identity documents were involved, contact IDCARE, the national identity and cyber support service.

Reporting matters even if you don't get the money back. Scamwatch says your report helps it try to stop the scam and warn others.

We've written before about another scam that leans on fake trust, the fake review extortion racket that hit an Adelaide restaurant. And if you want a reminder of how far criminals will go into ordinary shopping, look at the hackers who warmed supermarket freezers in seven countries.

The five minute version

If you remember nothing else, remember this before you pay a shop you haven't used before. Type the address yourself. Check when the site was registered. Check the business number matches the name. Search the name with the word scam. Pay by credit card or PayPal, never a bank transfer to a stranger. And if there's a clock ticking down on the screen, that's your cue to slow down.

If this story helped, you can help keep the paper going: Support the paper.