How to Remove a Fake Shop That Misuses Your Identity

Usually someone else spots it first. A customer asks about an order you have no record of, or a colleague forwards you a link. At the other end is a fake shop that looks like yours: your name, your product photography, your copy. Sometimes it carries your full company details and legal notice too.

It feels personal when you first see it. It is also something plenty of retailers are dealing with, and there is a well worn path for getting these sites taken down. This guide covers which lever actually moves things, why the obvious first steps rarely get the shop removed, and what a report has to look like to land with the provider.

Not an isolated case, and not out of your hands

The first time you see a shop wearing your identity, it looks like someone came after your company specifically. Usually they did not. Whoever runs these sites works at volume, lifting shop templates, product images and company details off the web and standing up a batch of sites at a time. Domains and content cost so little that a few victims per shop are enough to make it pay. We do the maths in our post on the economics behind DoppelCart.

That cuts both ways. You are dealing with a practised operation, but the response to it is just as practised. None of this has to happen in a panic. Start by documenting the shop properly, and the section on evidence below covers what that involves.

Why a lawyer or a police report will not switch the shop off

The first two moves most people make are calling a lawyer and filing a criminal complaint. Both are worth doing. Neither tends to be the thing that gets the shop offline, and the reason is straightforward.

Legal action is aimed at the operator, and with fake shops the operator is usually anonymous and based in another country. There is nobody within reach who can be made to shut anything down. A trademark assessment is still worth having. It is simply working toward something other than taking the site down.

A criminal complaint works the same way. Investigations move slowly here, especially when the providers involved sit in other jurisdictions, which makes it a poor tool for getting a site down quickly. As a record of what happened, it can still be worth filing.

Who can actually take the shop offline

The difference comes down to who you are actually talking to. You will not get to the people behind the shop. The infrastructure they depend on is almost always within reach.

Every fake shop needs somewhere to run: a host, a domain through a registrar, usually a shop platform, often a payment provider. Those companies have names and addresses, and they have terms of service that a fraudulent shop breaks. An abuse report tells them something unlawful is running on their infrastructure. That is a different exercise from a legal dispute with the operator, and it is generally not a law firm's core business either.

In practice, these are the places to report to:

• Host: the provider whose servers run the shop. If Cloudflare or another proxy sits in front, that is not the host. Cloudflare still accepts reports through its own form and forwards them.
• Registrar: the company the domain was registered through. It can suspend the domain, and the shop is then unreachable at that address.
• Shop platform: if the shop runs on a platform like Shopify, the platform has its own form for reporting violations of its usage policies.
• Google Safe Browsing: reporting the URL makes Chrome and other browsers warn visitors while the shop is still online.
• Ad platforms: Google, Meta and TikTok take reports about ads separately from the website.

Which provider to approach first, and what each one can realistically do, is laid out step by step in our website takedown guide. If you are not sure who sits behind a domain, our hosting lookup is the place to start.

Cut off the money: banks and payment providers

A fake shop exists to collect payments. Take away its way of getting paid and it becomes worthless, even if the website stays up for a while. This lever is often forgotten, and you can pull it in parallel with the report to the host.

If the checkout or the order confirmation shows a bank account or IBAN, report the account to the bank that holds it. An IBAN tells you which bank that is: the country code and bank code are part of it, and an IBAN checker shows the name. Banks follow up on fraud reports because they have to examine suspected money laundering, and they can freeze an account. Attach screenshots of the shop and, if you have them, complaints from affected buyers.

If the shop takes payments through a service like PayPal, Stripe or Klarna, report the merchant account there. These providers have their own channels for reporting fraudulent merchants and close accounts that break their terms.

For your customer service: buyers who paid by credit card or PayPal can often get their money back through a chargeback or buyer protection. After a bank transfer, they should contact their bank right away. The sooner, the better the odds.

Good evidence makes the decision easy for the provider

This is where a report succeeds or fails. Most people document as though they were building a court case. In practice you are writing for someone quite different: a support agent at the provider who knows nothing about your situation and has a queue to work through. That first pass may well be handled by an automated system.

So the rule of thumb is simple. Put the report together so the fake is obvious at a glance and nobody has to take your word for it.

• The specific URLs concerned, not just the domain.
• Dated screenshots showing the shop as it looked when you reported it. Our website scan does this for you and stores the screenshot, the page text, and the source under one link you can attach to the report. It is public, though: if the shop carries a copied legal notice naming a real person, take the screenshots yourself instead.
• A side by side comparison: your original page next to the copy, your product photos next to the lifted ones.
• Proof that you hold the rights, such as your trademark certificate or the original image files.
• The exact term of service being broken, rather than a general accusation of fraud.

If your company details were copied, say so in the report. It is quick for anyone to verify and hard to argue with.

Where going it alone breaks down

Straightforward cases are worth handling yourself, and that is what our guide is there for. In practice, though, three things tend to get in the way.

• The proxy in front of the host. A WHOIS lookup often returns nothing but a service like Cloudflare, which sits in front of the actual host rather than being it. Until you work out who the real host is, you are a step removed from the people who can act.
• The format of the report. It is common to put several hours in and still have the report bounce, because the documentation is not in the shape that particular provider expects.
• Every provider works differently. Forms, processes and requirements vary, sometimes country by country, so what you learn the hard way with one of them often does not transfer to the next shop.

In parallel: limit the damage

Orders keep arriving for as long as the shop is live. Two things are worth doing straight away, independently of the takedown.

Brief your customer service team. When people write in about orders you have no record of, the team should know what is happening and what they are allowed to say. If your company details were copied, those customers will come to you by default. A short notice on your site or your channels takes a lot of the heat out of it. Name the fake shop's address in it explicitly: anyone who searches for the shop name to check it will then find your warning.

Report the shop to consumer protection as well. In Germany, that is the Verbraucherzentrale, which collects these reports, warns the public about fake shops and runs a fake shop checker for buyers. Other countries have their own consumer protection or fraud reporting services.

Check whether the shop is being advertised, too. Fake shops often run on paid ads, and those can be reported separately from the site itself. Our research on fake shops in Google Ads shows how common that is.

It rarely stays at one shop

There are no reliable figures on this. What we see in our own casework is a pattern: these shops turn up in clusters. Several sites around one theme, with overlaps you can spot by eye, likely run by the same people.

One case we looked at closely shows how large such a cluster can grow. The DoppelCart network spans around 119,000 domains on the same technical foundation and copies the catalogs of real stores. You can check whether your brand is affected in the public DoppelCart database.

Which means one takedown rarely settles the matter. The work you did once comes round again with the next shop, often with different providers and different requirements. After the first case it usually makes sense to switch to continuous monitoring rather than starting over every time.

If you would rather not do this yourself

This is the part we take on. nebty works out which providers are actually responsible, including when a proxy sits in the way, prepares the evidence in the form each one expects, and runs the takedown across jurisdictions until it is finished. Your team does not have to absorb the legwork.

We only charge for takedowns that succeed, so a difficult case does not turn into an expensive one. What we take on and what it costs is on our fake shop takedown page.

Frequently asked questions