How Much Damage Do Fake Shops Cause? The Economics Behind DoppelCart

How much damage do fake shops cause? Existing estimates cover individual countries or networks. A calculation that brings the two together is still missing.

The scale became clear during our investigation of a fake-shop network we call DoppelCart. We started with individual fake shops we had reported for customers. Shared features in their source code and infrastructure led us to more shops, and we eventually linked 119,000 domains to the network. We were able to observe and analyse the largest publicly documented fake-shop network over several weeks. For this post, we analysed that data again: prices, reachability over time, registration dates, search tests and the time it took to have shops suspended.

The bait: $14 and 70% off

nebty examined saved pages from 80,428 DoppelCart shops and analysed 367,654 prices. Each of these shops displays crossed-out prices, and almost all apply a flat 65 or 70% discount. The median is $14, and 90% of prices are below $138. These prices for branded goods are unrealistic. The offers are intended to entice visitors to enter their card details.

The checkout is designed for this: it collects card details and the bank confirmation code. nebty documented this in its investigation, and BleepingComputer reported on it. DoppelCart does not need a merchant account with a payment provider for this. The order amount may never be charged. Losses can arise from the subsequent misuse of the card details.

How much damage does card fraud cause?

A nebty customer reported a case raised by a consumer with its support team: after she entered her card details in a DoppelCart shop, her card was added to a mobile payment service without her knowledge. This matches a method Krebs on Security described for phishing groups: the page asks for a bank confirmation code, and by entering it, victims actually approve adding their card to Apple Pay or Google Wallet on a phone the criminals control. From then on, the criminals pay with the card without the bank asking for another code. Security researcher Ford Merrill expects $100 to $500 in losses per card.

If a fake shop only takes the order amount, that is the loss: around $50 on average at BogusBazaar. The Finanzguru Fake Shop Report 2024 counted around 301,000 victims in Germany in 2023, with an average loss of €313 and more than €94 million in total.

Banks catch part of the card fraud: in the UK, they stopped 67p of every pound that fraudsters tried to take without consent in 2024, according to UK Finance. In the EU, banks generally have to refund what gets through. Even so, cardholders in the European Economic Area were left with around 38% of card fraud losses in 2024 (EBA and ECB), partly because banks argue gross negligence when someone entered the confirmation code themselves.

How much damage DoppelCart causes

nebty cannot directly measure how many people enter their credit card details in a DoppelCart shop. BogusBazaar provides a reference point: SRLabs documented more than one million orders across more than 75,000 domains in about three years, around 0.37 per domain per month. Our estimate is based on the following assumptions:

• Around 90,000 shops were still active on October 12, 2026. The model holds that number constant for a year.
• The model assumes 0.1 or 0.4 victims per shop per month.
• Each compromised card causes $100 or $500 in losses.

Our calculator lets you compare the four scenarios and change the assumptions yourself. The “All fake shops worldwide” switch opens an extrapolation for all fake shops, including those outside DoppelCart.

The fake-shop operators’ domain costs are low by comparison: 118,787 of the confirmed domains end in .shop, representing 2.72% of the .shop domain population we examined in September 2026. On September 29, 2026, Dynadot offered .shop domains for $1.99, and all of the roughly 8,500 domains with a public registration date were registered in 2025 or 2026. At about $2 per domain, first-year domain costs for the whole network come to around $240,000. This excludes software and hosting. The losses are 45 to 900 times as high.

Per shop, that is not much: in our scenarios, a single DoppelCart shop causes $10 to $200 in losses a month. A case before the Rostock Regional Court shows how much higher the losses per shop can be. There, just over 30 shops, each online for only days or weeks, found more than 10,000 victims and caused €4.34 million in losses (Händlerbund), more than 300 victims per shop. DoppelCart does not rely on yield but on volume: the network runs around 3,000 times as many shops.

Scaled up to all fake shops worldwide

To calculate worldwide losses, we start with the number of victims and use the loss per card from DoppelCart:

• 2.71 billion online shoppers worldwide (Statista, via Oberlo),
• 0.43% of them lose money to a fake shop each year, matching the rate among bank customers in Germany reported by Finanzguru,
• $100 or $500 in losses per victim, as with DoppelCart.

The results of two cross-checks fall in the middle of this range. With the average loss from Germany, €313 or around $340, it comes to nearly $4 billion. The US Federal Trade Commission received 383,441 reports of online shopping fraud in 2024, 76% of them with a loss of around $1,480 on average (Consumer Sentinel Data Book). That affects 0.11% of US adults; applied to all online shoppers, it comes to around $4.4 billion. Two independent data sets, around $4 billion in losses a year.

Switch the calculator to “All fake shops worldwide”

How many fake shops are behind these losses depends on how many victims a shop finds. If they all found as few as in our DoppelCart scenarios, it would take 2.4 million to 9.7 million simultaneously active shops. Published counts for 2026 show far fewer:

How many shops appear on more than one list is not known. For 2026 this gives a range: if the live counts overlap completely, DoppelCart's 90,000 remain; if they do not overlap at all, it is around 115,000. There are two explanations for the gap between these counts and the estimate: there are far more fake shops than appear in published counts, or many shops find far more victims, as in the Rostock case. Most likely, both are true.

The additional harm to legitimate shops

Our extrapolation covers direct financial losses from fake-shop fraud and card misuse. After refunds, banks and merchants bear part of those losses. The economic consequences for legitimate shop owners extend further and are not included in our figures.

Reputational damage and customer service costs. Someone who orders from a copied shop and receives no goods may blame the real company. Complaints then reach the original shop’s support team. Its staff have to investigate orders from which the business earned nothing. Disappointed buyers may lose trust in the real brand. A 2021 Mimecast survey reported by Tech Monitor illustrates the stakes: 65% of UK respondents said they would stop spending with their favourite brand if they fell victim to a scam impersonating it.

Uncertainty can cost unrelated shops customers too. A study by the Austrian E-Commerce Trustmark describes how strongly shoppers favour providers they already know. A buyer who avoids unfamiliar stores out of fear of fake shops and chooses a familiar large platform instead is a lost customer for independent retailers. In our view, fake shops can therefore cost businesses sales even when their own stores have never been copied.

Additional competition increases marketing effort. We documented competition in search results for DoppelCart. For fake shops more broadly, the Federation of German Consumer Organisations also documents advertising on Google and Meta. Legitimate shops therefore compete with fraudulent offers for visibility. Additional competition in ad auctions can affect click prices. There is also the work of search engine optimisation to remain visible alongside fake shops in search results.

Lost sales, reputational damage and additional marketing costs increase the overall economic harm. Our DoppelCart data cannot quantify the combined value of these additional effects.

Why it pays off for the operators

A new DoppelCart shop costs little more than its domain. 96% of the confirmed shops use identical build files. They are spread across 27 backend regions, averaging around 3,900 shops per region; at BogusBazaar, about 200 shops ran on one server, according to SRLabs. Product descriptions are copied word for word from real stores, and the fake shops load images directly from the affected brands' image servers. We extracted more than 44,000 brand labels from the shops.

DoppelCart also avoids two major costs of other campaigns. ERIAKOS, for example, used merchant accounts with payment providers, which can be shut down (Recorded Future); in 2025 alone, Recorded Future identified more than 3,600 fraudulent merchant accounts (Payment Fraud Report 2025). For ERIAKOS, Recorded Future also counted more than 100 Meta ads a day per site in many cases. For DoppelCart, we found no ad click identifiers. The shops get found anyway: in 22 of 26 searches for long product names copied verbatim, at least one DoppelCart shop appeared in the top ten results, mainly in a Bing-based search engine.

What suspensions achieve

For DoppelCart shops that nebty reported and the registry subsequently suspended, one to five days passed between the report and the suspension. The operators keep replacements ready, though: for one brand, we found nine domains rather than the five initially known. Most of the network was still online on the last measurement date: more than 105,000 shops were active in early September 2026, around 90,000 on October 12.

The roughly 15,000 shops that disappeared between early September and October 12, 2026 account for $150,000 to $3 million in monthly losses in our scenarios. For affected brands, that means: do not just report the one shop you know about, but look for all copies and report the domains together. Our public DoppelCart database is one place to start. Our guide on how to remove a fake shop explains who can have a shop suspended and what a report needs to contain.

Until then, the complaints reach the real company: people ask about orders that were never placed with the real store. The guide's section on limiting the damage explains how to prepare customer service.

Frequently asked questions about fake shop losses

Further reading: the DoppelCart investigation and how to remove a fake shop.