This one has become so prevalent that I’m starting its own article.
Victims: You probably want to approach your bank with “I ordered this item from this website and I didn’t get my items and I can’t reach the retailer.”. Approaching it from a “Someone stole my card details and spent my money” may not cover you because you willingly handed over the details. I’m not an expert on that. Citizens advice may be the best people to speak to. Do not give up. Chase it through to the financial ombudsman if the bank is uncooperative. You may wish to remind your bank about their code of conduct about reimbursing scam victims.
Once you’ve dealt with the payment card issues it is important to also report the fraud to ActionFraud: http://www.actionfraud.police.uk/report-a-fraud-including-online-crime
These scam shops advertise on google under numerous white goods and electronics goods keywords. They often claim to have stock of items that most retailers do not and the price is normally well below the normal price.
Upon purchase you are taken to a slick looking credit card page.
The sites they operate under are:
“Techtop Best Online Store” / “Techtop Ltd.” (techtop.shop – Registered 9th January 2021).
“Larris Best Online Store” / “Larris Retail Limited” (larris.shop – Registered 15th October 2020).
“Kentis Best Online Store” / “Kentis Limited” (kentis.shop – Registered 15th December 2020).
“Rettis Best Online Store” (rettis.shop – Registered 24th January 2021).
“Stargon Online Store” (stargon.shop – Registered 7th January 2021).
“Bennis Online Store” (bennis.shop – Registered 4th February 2021).
global-pay.site and global-payment.site
10th February 2021 they’ve moved to using checkout.diespay.com (which seems to be related to a potentially legitimate payment processor “begateway.com”).
Other related indicators / information: “email@example.com” and russian phone number “+794500522551”.
“Techen Best Online Store” (techen.shop – Registered 5th February 2021).
“Ketron Best Online Store” (ketron.shop – Registered 28th March 2021).
“Besten Online Store” (besten.shop – Registered 2nd April 2021).
“Rettop Online Store” (rettop.shop – Registered 6th March 2021).
“Frantis Meilleur Botique En Ligne” (frantis.shop – Registered 23rd March 2021).
“Dextron Best Online Store” (dextron.shop – Registered 27th May 2021).
Also related cloudpayments.services Registered 27th May 2021.
Also related securepay.tinkoff.ru for the back-end card payments using “cargo-rh.com” (CargoRoadhouse, Cargo-roadhouse) merchant account.
Also related api-payments.cc registered 22nd June 2021.
They’ve now moved to using the spoof domain “checkout–diespay.com” (similar to what seems to be a genuine payment service checkout.diespay.com”). Domain only registered 7th July 2021. (One day ago at time of updating this post).
Payment has moved to “spanish-speaker.com”, what looks like a genuine site but the payment gateway is being used to collect payment for the scam online store. The spanish speaker site then redirects the visitor to a genuine card processor company.
“Retten Best Online Store” (retten.shop – Registered 9th June 2021).
“Zerten Best Prices Every Day” (zerten.co.uk – Registered 12th July 2021).
Fake payment site has been setup on “pay-core.com” (Registered 12th August 2021) which then forwards to try to take payment on tinkoff with the account “firstname.lastname@example.org”, “express-trassa.com”, “IP “ATANOV EVGENIY MIKHAYLOVICH””, “+79620033841” which also looks like a fake business.
Fake payment has moved to “pay-alpha.com”.
“KIPSTEN Best Prices Every Day” (kipsten.com – Registered 12th July 2021).
Hosted at “22.214.171.124” but hidden behind cloudflare.
This site seems to be using a checkout system on a fake company “themarketingacademy.biz” (Registered 22nd July 2021) which in turn uses a genuine payment processor “ecommpay.com”.
The fake marketingacademy website seems to be a clone of “londonmcg.co.uk” (also doesn’t look too legitimate itself either!). Whoever set up both had a copy of the website code and database of the original. I suspect whoever made londonmcg stole the code and is using it on the fake marketingacademy site.
“Optitech Best Online Store” (optitech.shop – Registered 27th July 2021).
This site attempts to send PayPal payment to “email@example.com”.
Hosted at “126.96.36.199” but hidden behind cloudflare.
“Wirsten Best Prices Every Day” (wirsten.co.uk – Registered 3rd September 2021).
Hosted on the same CloudFlare account as zerten.co.uk and kipsten.com.
“Lotren Best Prices Every Day” (lotren.co.uk – Registered 29th September 2021).
Also related “bepaid-processing.info” domain being used as a fake card payment screen. Registered 8th December 2021.
“Hintech Best Prices Every Day” (hintech.co.uk – Registered 11th January 2022).
Also related “skill-market.pro” and “cloud-processing.info”.
“Kerten Best Prices Every Day” (kerten.co.uk – Registered 8th February 2022).
“UAETECH Best Prices Every Day” (uaetech.shop – Registered 5th April 2022).
“TECHERT Best Prices Every Day” (techert.co.uk – Registered 24th January 2022).
Also related fake payment gateway / human based credit card relaying “cardpanel”: hxxp://payture.icu/admin/ maybe with a Russian developer named “cosmocoder.site”
Other technical notes: A strange development version of the site is on 188.8.131.52 as of 26th August 2021.
Older technical notes:
Hosted on 184.108.40.206 but hidden behind cloudflare. Payments appear to be partially sent via websockets to “kufar-dostavka.me”.
global-pay.site – just sends your card details to the scammer in Russia via chat service telegram (mikhartamonov1990, Михаил Артамонов, global-pay.site firstname.lastname@example.org)