120 Fake Walmart Sites Steal Card Details

How the Attack Worked

A network of more than 120 near-identical websites was built to impersonate Walmart. Each site reused the same WordPress/WooCommerce template, with only the fabricated US business addresses and phone numbers swapped between them. Visitors, most of them browsing on mobile devices, landed on a Walmart-branded homepage and category pages stacked with name-brand liquor discounted 40% to 70%. From there, shoppers were funneled directly to a checkout form requesting a full credit card number, expiry date, and CVV, despite the sites having no connection to Walmart.

Why It Succeeded

The scam relied on a mix of visual credibility and urgency. Reusing a polished ecommerce template gave each site a legitimate look and feel, while the steep discounts on recognizable liquor brands created pressure to buy quickly rather than scrutinize the site. Steep discounts on high-demand goods are effective precisely because they encourage people to act on impulse instead of checking the source.

What to Watch For

• Discounts of 60% to 70% on premium or name-brand products, which are far outside normal retail promotions
• Unfamiliar domains, including uncommon top-level domains like ".shop", instead of a retailer's known web address
• A checkout process that asks for full card details (number, expiry, CVV) on a site that has not been independently verified
• Repetitive site structure across multiple "different" stores, a sign of a templated scam network rather than distinct retailers

How to Build Resistance

Organizations and individuals can reduce exposure to this type of scam by building habits around verification rather than visual trust. Employees, procurement staff, and cardholders should be reminded to check the address bar before entering any payment information, since brand look-and-feel alone is not proof of legitimacy. Anyone who has already entered card details on a suspicious site should treat the card as compromised, contact the issuer immediately, explain what happened, and ask whether the card should be cancelled and reissued. Because these scams target consumer purchasing behavior rather than corporate systems, awareness training that includes personal shopping scenarios, not just work-related phishing, helps close this gap. Retail and ecommerce teams should also be aware that lookalike domains impersonating their brand can appear at scale using low-cost templated infrastructure, which is relevant context for fraud and customer support teams fielding related complaints.

How many fake Walmart sites were found?

Researchers identified more than 120 near-identical domains built to look like a legitimate retailer, all designed to steal card details.

What lure did the fake Walmart sites use?

The sites advertised name-brand liquor at 40% to 70% off, a discount level optimized to attract mobile shoppers and push impulse buying.

What information did the fake checkout pages request?

The checkout forms asked for a full credit card number, expiry date, and CVV.

What should someone do if they entered card details on one of these sites?

They should assume the card has been compromised and contact the card issuer immediately to explain what happened and ask about cancellation or replacement.