Synthetic storefronts copy real stores down to the checkout. Here's how to spot them.

What makes this page different from the scam pages in our last report is that it works. There's no fake error, no phone number, nothing alarming. You fill in your email and shipping address, move on to payment, enter your card, and press the button, exactly as you would on the real Michaels site. That's the point. The more ordinary the checkout feels, the less reason anyone has to stop.

Once a card number is entered, it belongs to the people running the site. They may charge it, sell it, or use it elsewhere. The order itself may never arrive, or something cheap and unlike the listing may show up instead. The FTC warns that many fake shopping sites use photos and logos stolen from legitimate businesses, but won't send you the real product.

The discount is doing the most work here. A $266 cart for $81 is the kind of deal people tell their friends about, and it pulls attention away from the one detail that would give the site away: the address in the browser bar.

What makes a storefront "synthetic"

A synthetic storefront isn't a store that resembles a brand. It's a copy of that brand's own website, built to be indistinguishable at a glance. Because the content is lifted from the real store, the usual advice about spotting a fake shop, like looking for odd product photos or broken links, often doesn't apply. Everything you click on works, because it was copied from something that works.

These sites are also made at scale. Researchers at Security Research Labs documented one network, which they named BogusBazaar, that ran fake shops on more than 75,000 domains and processed over a million orders worth about $50 million in three years. More than 850,000 shoppers fell victim, mostly in Western Europe and the U.S. The researchers found that the shops were set up semi-automatically, and that when a payment page was blocked, the operators could swap in a new one without changing how the store looked.

Crafts shoppers have been targeted before. When Joann announced it was closing its stores in 2025, the company warned customers about imitation websites, and BBB Scam Tracker reported more than 200 reports of fake Joann sites. Popular retailers with loyal customers and frequent sales make attractive targets, because a big discount from them doesn't seem strange.

People usually reach these sites through a sponsored search result, an ad on social media, or a link in a text or email promising a sale. In each case, the link does the steering, and the shopper never types the address themselves.

How to spot a synthetic storefront

A copied store can match the real one almost everywhere. These are the places it can't.

• The web address. This is the one part of a website a copy can't borrow. Look at the address bar before you enter anything, and read the whole name, not just the beginning. A copied Michaels store won't be at michaels.com, though it may use an address that includes the brand name or looks similar.
• A deal far better than the real store's. Compare a price or two against the retailer's own website or app, which you open yourself. If the "same" item costs a fraction of the price, the store isn't the same.
• A discount you didn't apply. Big "promotion" or "special offer" reductions that appear on their own at checkout, with no coupon entered, are a common hook.
• A clock that rushes you. Timers that say your cart is "reserved" for a minute or two are there to stop you from checking. A real store won't make you pay within sixty seconds.
• An unusual way to pay. The FTC says to never buy from sellers who demand gift cards, wire transfers, payment apps, or cryptocurrency. Some copied stores take cards. Others push these methods at the last step.

How to shop safely

1. Start from the store, not the link. Type the retailer's address yourself, use a bookmark you saved, or open the store's official app. If you see a sale in an ad or a message, look for it on the real site.
2. Check the address before you pay. Make it a habit at the payment step. It takes two seconds and works no matter how good the copy is.
3. Pay with a credit card when you can. The FTC notes that credit cards give you more protection and let you dispute charges if what you ordered never arrives.

If you already entered your card

It happens, and it doesn't mean you were careless. These sites copy real stores so well that the difference is often invisible. What matters is acting quickly.

1. Call your card provider using the number on the back of your card. Tell them the card was entered on a fraudulent site, ask them to cancel it, and dispute any charges. The sooner you call, the better.
2. Watch your statements for charges you don't recognize over the next few weeks, including small ones. Scammers sometimes test a card with a tiny purchase first.
3. If you created an account on the site, change that password anywhere else you've used it.
4. Expect follow-up messages. The site has your email address and possibly your home address. Be wary of emails or texts about your "order," refunds, or delivery problems, and don't click their links.
5. Report it. In the U.S., you can report shopping scams to the FTC at ReportFraud.ftc.gov and to the FBI's Internet Crime Complaint Center at ic3.gov. You can also let the real retailer know through its official website.

Why this is happening

The cost, by the numbers

Fake stores feed one of the most frequently reported kinds of internet crime in the United States. The FBI's Internet Crime Complaint Center groups cases where people pay for goods that never arrive under "non-payment and non-delivery," and in 2025 it was among the five most reported crime types.

56,478

complaints of non-payment and non-delivery reported to the FBI in 2025, one of the five most reported crime types

$503 million

reported lost to non-payment and non-delivery schemes in 2025

Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report. Figures reflect only losses reported to the FBI.

Those figures only count people who filed a report. They also miss much of what happens after a card number is stolen, because charges made with that card elsewhere can be reported as other kinds of fraud, or caught by the bank and never reported at all. The real cost of these sites is almost certainly higher.

Why copies are getting better

Copying a website has never been especially hard. What's changed is how little effort it takes to make the copy convincing and to keep making new ones. The FBI has warned that generative AI reduces the time and effort criminals need to deceive their targets, and lists generating content for fraudulent websites among the ways criminals use it.

That matters for fake stores in particular, because the old advice for spotting them leaned heavily on things looking off. A store copied from a real retailer, polished with AI where needed, and rebranded in minutes looks right. That's why the tells in this post focus on what a copy can't fake: the address, the price, and the pressure to pay right now.

Protection built for copied sites

A blocklist can only protect you from a site someone has already found, reported, and confirmed. A synthetic storefront is designed to look like a site that's already trusted, and when one is blocked, its operators can put up another. Every new copy gets a head start: the time between going live and landing on a list.

ASURViO Shield is designed for that gap. Instead of relying only on lists of known bad sites, it checks each page as it loads, so a store copied this morning gets the same scrutiny as one that has been around for months. That's how it flagged the Michaels copy above.