The Ad Isn’t Proof: Fake Stores, Imposter Ads, and the Chatbot That Vouches for Them

Most people decide a store they’ve never heard of is probably fine in one of three ways. They saw it advertised, so somebody must have checked it. The website looks every bit as good as the brand’s own. Or, more and more often, they asked an AI assistant where to buy something and it gave them a name.

None of those was a silly shortcut. For years an ad on a big platform, or a store that looked expensive to build, really did suggest a real business behind it. This season all three signals are being gamed on purpose, and the people they catch are careful shoppers using cues that used to work.

The Federal Trade Commission is now asking, in public, whether the platforms that sell ads should have to check who is buying them. It’s a fair question, and answering it will take a while. Black Friday won’t wait. This guide covers what you can do in the meantime: the checks that still work, why the old ones stopped working, what to do if you already ordered, and how to practice with a parent without making anyone feel foolish. Our holiday scams guide covers the rest of the season, from delivery texts to drained gift cards. This one stays on the store.

Six checks that still work

Each takes a minute or two. If you only have time for two, do the first two.

1. Find the store yourself, not through the ad. Close the ad and type the brand’s address, or open its app. A real deal will be on the brand’s own site. If the only way to reach it is that one ad, treat that as your answer. The FTC also suggests searching the company’s name with words like “scam” or “complaint” before you buy from an ad.
2. Check the address against the brand’s real one. Read the domain slowly, from right to left. Look for an extra word such as “outlet,” “sale” or “official,” an added hyphen, a swapped letter, or a country code that doesn’t match where you live. One of the fakes NordVPN found was simply the brand plus a country, drmartensie[.]com.
3. Read the returns page and the contact details. A real retailer tells you where a return goes, who pays for it, and how to reach a person. If the policy reads as vague or copied, and the only contact is a form or a generic support email, slow down.
4. Treat a price far below market as the warning, not the reward. Brand-name boots at 70% off in a “closing sale” are the bait. Savi Security says an impossible discount shows up in about one in four of the scam stores reported to it. Check the same item at two retailers you already know. If nobody else is close, the price is the tell.
5. Pay by credit card. Not debit, wire, Zelle, a payment app, gift cards or crypto. The FTC calls a credit card the strongest protection here, because you may be able to dispute the charge if the order never comes. Debit card protections are different, and money sent any of the other ways is usually very hard to get back. If the checkout nudges you toward one of them “for a discount,” close the tab.
6. Treat an AI assistant’s store pick like a stranger’s tip. It may be right. It may also be repeating a fake it found on the open web. Before you pay, confirm the store on the brand’s official site, the same way you would if someone at the bus stop recommended it.

Why the old signals stopped working

Each shortcut fails for its own reason, and it helps to know which, because the fix is different each time.

“I saw it advertised”

Anyone can buy an ad, including a scammer using a famous brand’s name. In an August alert the FTC said social media platforms don’t always check the ads you see, or the advertisers behind them, very thoroughly. People told the agency they lost more than $95 million in 2025 to scams that began when they ordered something after seeing a social media ad, and the FTC adds that many people never report at all.

Savi Security, the company behind the Scamwise scam checker, says in its 2026 holiday report that at least one in five fake stores reported to it traced back to an ad on a major platform, with Meta and Google the favorite channels. Its data comes from what Scamwise users chose to submit, so it isn’t a census, but the FTC’s numbers point the same way. In 2025, nearly 30% of people who reported losing money to a scam said it started on social media, and those losses reached $2.1 billion, according to the FTC’s September announcement.

How many scam ads get through is hard to know from the outside. The FTC’s rulemaking notice quotes Reuters reporting on internal Meta documents that estimated users were shown roughly 15 billion “higher-risk” scam ads a day. Those figures come from leaked documents rather than anything Meta published, and Meta disputed the reporting. Even so, the practical lesson holds at any number. An ad in your feed proves that someone paid for it. That’s all it proves.

“The site looks professional”

A good-looking store used to take money and skill. Now it mostly takes a template. In an announcement on November 4, NordVPN said its threat intelligence team traced more than 10,000 counterfeit shop domains to a single cloned template, impersonating 166 fashion and luxury brands across 26 countries. Of those, 1,549 were fully working shops on November 3. Adidas led with 52 lookalike domains, followed by Ralph Lauren, Dr. Martens, Crocs and Massimo Dutti. NordVPN’s chief technology officer said each store is designed to look exactly like the brand’s official site for the shopper’s country. Even the checkout borrows trust: the shops show PayPal and Klarna logos, NordVPN says, but don’t appear to accept either, and take card details instead. A payment logo on a checkout page is only an image.

The photos aren’t a tell anymore either. In WREG’s report on Savi’s findings, 75% of the scam stores Savi analyzed used AI-generated images, media and text. Clothing and apparel topped the list of what they sell, followed by electronics and then tools and equipment. Savi’s summary, as WREG quoted it, was four words long: “Polish is no longer proof.” We wrote earlier this year about how AI took the typos out of scams, and fake stores are the shopping version of the same change.

One more finding tends to surprise people. In Savi’s confirmed cases, the most common domain was myshopify.com, the address Shopify assigns to stores on its platform. That says nothing bad about Shopify’s real merchants, and there are a great many of them. It does mean “it’s on Shopify” or “the checkout looked normal” tells you about the software, not the seller. Our piece on cloned car dealership websites walks through how complete a copy can look, and the two checks a clone can’t pass.

“The AI assistant recommended it”

This is the newest shortcut, and it’s easy to miss that a parent has started using it. You ask a chatbot where to buy Dr. Martens in Ireland and expect it to know. In NordVPN’s testing, Perplexity recommended two shops from the counterfeit network as trustworthy. It listed a fake Vero Moda store among five recommended retailers, right next to real ones such as Zalando and La Redoute, and it presented drmartensie[.]com as the official Dr. Martens outlet for Ireland. NordVPN says ChatGPT and Gemini also cited other shops from the same network.

How does a fake store end up in a chatbot’s answer? Mostly the way it ends up in search results. NordVPN says this network didn’t use paid ads at all. It was built for organic search, with SEO plugins, large sitemaps, product data in a format Google Shopping can read, and 597 domains verified in Google Search Console. Some of its domains were expired addresses that had belonged to someone else and were registered again, which is a common way to borrow an older site’s standing in search. AI search tools read the same web. Being findable isn’t the same as being checked, and an assistant that summarizes the web can repeat a fake just as confidently as a real store.

A note on where this network operates. Most of the examples NordVPN published are European shops on country-code domains like .es, .ie and .it, priced in euros, and Money reported that France and Germany were among the most heavily targeted markets, with 91 domains aimed at US shoppers. So this particular network seems aimed mostly at European shoppers. The method isn’t limited to Europe, and an American asking an AI tool for a deal on boots is using the same kind of tool that recommended those shops.

Figure 01 · Where a fake store breaks ScamDrill

Steps and checks by ScamDrill, drawing on NordVPN’s November 2026 findings on a counterfeit store network, Savi Security’s 2026 holiday scam report, and FTC guidance on paying by credit card and disputing charges. Amber marks the scammer’s moves, red the point of loss, slate the check.

What the FTC is weighing, and what it isn’t doing yet

On September 24 the FTC voted 2-0 to publish an advance notice of proposed rulemaking on its Rule on Impersonation of Government and Businesses. The question is whether the ad tools sold by social media, search engines and online marketplaces help scammers impersonate real companies and agencies, and if so, what platforms should have to do about it. The options on the table include vetting advertisers, monitoring ads, investigating suspected scam ads, removing confirmed ones, and disciplining the advertisers behind them.

The numbers behind the question are large. The notice in the Federal Register says consumers reported losing about $16 billion to fraud in 2025, up 25% from 2024. Impersonation is the fraud people report to the FTC most: more than 1 million imposter reports last year, with nearly $3.5 billion lost.

An advance notice is an early step. It asks questions. It doesn’t create a rule, and nothing about it changes what will appear in your feed this holiday season. That’s the practical point for families: platform vetting may come one day, but for now the checking is yours to do.

If you have an imposter ad story, the FTC has asked to hear it. Comments on the notice (docket FTC-2026-1552) are due by November 30, which happens to be Cyber Monday. When we checked on November 9, the Federal Register page showed the comment period still open, with more than 170 comments posted. You can comment on Regulations.gov. A few plain sentences about what you saw, where you saw it and what happened next are useful, and the FTC’s consumer alert on imposter ads explains what it’s asking.

If you already ordered from a store you now doubt

Don’t wait to see whether a box turns up. The FTC warns that an order from a scam ad may bring a cheap knockoff or nothing at all, and the window for a credit card dispute is counted from your statement, not from the day the package was due. Act on the doubt while the payment is fresh.

1. Call your card issuer. Use the number on the back of the card. Say you believe the store was fake, and ask to dispute the charge and to replace the card if you typed it into the site. For credit cards, the FTC says billing disputes must be made in writing within 60 days of the first statement showing the charge, sent to the issuer’s billing-error address. Call first, then send the letter.
2. If you paid by debit card, Zelle, wire or gift card, call that company today. The FTC notes that debit card protections differ from credit card ones, and a transfer to a stranger is often hard or impossible to reverse. Ask anyway, and ask quickly. Some banks will help, and some can’t.
3. Save everything. Screenshot the ad, the store’s address, the order confirmation and any texts or emails. You’ll want them for the dispute and for the reports.
4. Report it twice. File a report at ReportFraud.ftc.gov, and report the ad on the platform where you saw it, using the report option on the ad itself. If you gave the store more than a card number, such as your Social Security number or a bank login, go to IdentityTheft.gov for a recovery plan.
5. Expect follow-up messages, and don’t act on them. Right after a purchase is when a fake delivery text lands best, because you really are waiting for a package. Open the carrier’s app or site yourself. Our guide to checking a delivery text shows what those messages look like. Be just as wary of anyone who offers to get your money back for a fee, because recovery offers are often a second scam. And if a package you never ordered shows up with a QR code inside, that’s a different scheme, which our brushing scam explainer covers.

We can’t promise the money comes back. Sometimes a card dispute works and sometimes it doesn’t, and moving fast gives you the best chance. For an hour-by-hour plan, start with the first 60 minutes after a scam. Our family recovery guide covers the weeks after.

Bringing it up with a parent without making them feel foolish

If your mom bought a coat from a store she found in her feed, she did what the ad was built to make her do. Start from there. The ads got better. Nobody got worse.

A few things tend to help:

• Lead with your own near miss. Most of us have one, the deal that looked fine until the address didn’t. Telling yours first makes it a shared problem rather than a lecture.
• Ask them to show you how they shop. Sit with them while they look for one gift. You’ll learn whether they start from the feed, a search or an assistant, and you can show the address check on a real page.
• Agree on a small rule instead of a ban. Something like: for any store neither of us has used before, we look it up together before paying. A rule like that keeps them shopping and keeps you in the loop.
• Make the AI part concrete. Plenty of people assume a chatbot’s answer has been checked by someone. Tell them what NordVPN found: the assistant read the web, and the web contained a fake.
• Keep it two-way. Ask them to send you anything that looks odd, and send them yours. People who feel judged stop mentioning things, and the one they don’t mention is the one that costs money.

Shopping is only one of the ways older adults lose money this time of year. For the calls that do the most damage, we keep a short page of warning signs to tape by the phone, and our longer playbook for protecting elderly parents covers accounts, alerts and the money conversation.

A household drill: forward one deal ad

Reading about fake stores doesn’t build the reflex. Running the checks a few times does. Here’s a ten-minute drill for the family group chat. Run it twice before November 27.

1. Pick one real deal ad from your own feed this week. A brand-name item at a big discount is ideal. Take a screenshot. Don’t tap the ad, and don’t forward its link.
2. Send the screenshot to the group. Ask: “Real or fake? Don’t click anything. How would you check?”
3. Everyone runs the six checks. Find the brand’s site on your own, compare the address, look for the returns page, compare the price, and say how you’d pay.
4. Compare notes. Who found the brand’s real site fastest? Who spotted something off in the address? That matters more than who guessed right.
5. Round two, a few days later. Ask an AI assistant where to buy the same item cheaply, and check its top answer exactly the same way.

Keep it light. Give points for the fastest address check and take none away for a wrong guess. What you’re building is the habit of pausing before tapping, which is exactly the step the ad is designed to skip.

For small business owners: when your brand is the one being cloned

If you run a small shop, a restaurant with an online store, or a local brand with a following, the same tooling can be pointed at you. A cloned storefront takes your name, your product photos and sometimes your reviews, then sends your customers somewhere else. Often you find out when someone calls, upset about an order you never took.

What helps, roughly in order:

• Search for yourself the way a customer would. Look up your brand with words like “sale,” “outlet” and “closing,” in a search engine and in an AI assistant. Check the platforms’ public ad libraries for ads using your name, and set an alert for your brand name.
• Report through the channels built for brand owners. Google has a form to report an ad and a separate trademark complaint form. Meta’s Brand Rights Protection tool lets enrolled businesses report impersonation and, since August 2025, suspected scam ads that misuse a brand’s name. Report the site to its web host and domain registrar too.
• Tell customers which address is yours. Put it on your homepage, receipts and social profiles, with a line such as: we only sell at our own domain, and we’ll never ask you to pay by Zelle or gift card. The FTC’s guidance for impersonated businesses starts with notifying customers quickly, and it suggests leaving links out of those warning emails, since a warning full of links looks like phishing.
• Report it to the FTC. Business reports help the agency see patterns, and right now it’s asking specifically how imposter ads work.
• Prepare whoever answers the phone. When a customer calls about an order from a fake store, the first person they reach sets the tone. Give staff a short script: we’re sorry, that site isn’t us, here’s our real address, please call your card issuer about the charge, and could you send us the link so we can report it. Staff shouldn’t take card numbers to “fix” an order that was never yours, and they should log every fake address a customer mentions.

Training matters here for a second reason. The skill your staff use to talk a customer through a lookalike store is the same one they need for their own inbox, where a fake “your ad account is restricted” notice leading to a copied login page is a familiar lure for any business that advertises. ScamDrill for teams practices that by email, with a short lesson for anyone who clicks.

What to do before November 27

• Today: send the six checks to your family group chat.
• This weekend: run the forward-one-ad drill.
• Before anyone shops: agree on the house rule. Unknown store, look it up together, credit card only.
• If something already went wrong: call the card issuer first, then report it.
• By November 30: if you have an imposter ad story, tell the FTC.

The ads will keep getting better. The checks are the part you control, and they work the same on the best-looking fake as on the worst.