Scammers Relaunch Fake Stores in Hours

Akamai documented scam operations that use large numbers of look-alike shopping and ticketing websites to steal payment and identity information. The operators can quickly replace a removed site with another domain connected to the same payment-data collection system. Other campaigns used social-media adverts and fake recruitment content to send victims to malicious app downloads or phishing forms.

Key findings

• One retail scam used more than 1,200 look-alike .shop domains on a shared IP address and reused payment-page designs to harvest card data.
• Fake ticketing and hospitality portals for a major sporting event requested payment details and, in some cases, passport or identity-document information.
• A documented paid social-media campaign sent consumers to a counterfeit app marketplace where they downloaded a malicious app.
• Recruitment scams used fake hiring content on major social platforms to direct applicants to phishing forms.
• Operators can use dormant domains, compromised websites, reused phishing kits, and shared infrastructure to replace removed scam sites within hours.
• Stolen credentials can be tested across services to access accounts with saved payment methods, rewards points, and personal information.

Who’s being targeted

• Commonly targeted roles: All employees, Employees who purchase tickets, travel, or hospitality services, Finance and procurement staff, Human resources and recruiting teams, Employees seeking jobs or using personal mobile devices.
• Affected industries: Retail and e-commerce, Ticketing and hospitality, Sports and entertainment events, Recruitment and hiring, Financial services and payment processing.
• Attack channels: website.
• Impersonated: An official ticketing or hospitality portal for a major sporting event, An app marketplace, A recruiter or hiring organization.

Awareness takeaways

• Use only official, independently verified ticketing and event websites, and treat requests for identity documents during checkout as a warning sign.
• Do not install apps from links in social-media adverts; obtain mobile apps only through the organization’s approved or official app stores.
• Verify job opportunities through the employer’s official careers page before submitting personal information.
• Use unique passwords for every service and enable stronger account protections, because criminals test passwords exposed in other breaches.

Red flags to watch for

• The site requests passport or identity-document details during a ticket checkout flow.
• The website may be a look-alike of an official ticketing or hospitality portal.
• A payment page can be moved to a new domain quickly after the previous site is removed.
• The advert sends the user to a marketplace that is not an official app store.
• The downloaded app requests sensitive information or unnecessary device permissions.
• A paid social-media advert is not proof that an app or marketplace is legitimate.
• The hiring content directs applicants away from an official careers site to a form.
• The application asks for sensitive information that is not needed at the initial stage.
• Recruitment content on social platforms may lead to a phishing form rather than a legitimate application process.