How Much Damage Do Fake Shops Cause? The Economics Behind DoppelCart

How much damage do fake shops cause? There are hardly any good figures. There are estimates for individual countries and reports on individual networks, but no calculation that brings the two together.

We realised how big the problem has become during our investigation of DoppelCart: a handful of takedowns for customers led us to 119,000 domains. We were able to observe and analyse the largest publicly documented fake-shop network over several weeks. For this post, we analysed that data again: prices, reachability over time, registration dates, search tests and the time it took to have shops suspended.

The bait: $14 and 70 percent off

We extracted 367,654 prices from 80,428 archived shops. Each of these shops displays crossed-out prices, and almost all apply a flat 65 or 70 percent discount. The median is $14, and 90 percent of prices are below $138. Nobody sells branded goods at these prices. The offers are mainly there to get visitors to enter their card details.

The checkout is designed for exactly that. It collects card details and the bank confirmation code. We found this in our investigation, and BleepingComputer reported on it. DoppelCart does not need a merchant account with a payment provider for this. The order amount may never be charged. The expensive part comes afterwards.

What a stolen card costs

In one DoppelCart case we know of, a buyer's card was added to a mobile payment service without her consent after she entered her card details. This matches a method Krebs on Security described for phishing groups: the page asks for a bank confirmation code, and by entering it, victims actually approve adding their card to Apple Pay or Google Wallet on a phone the criminals control. From then on, the criminals pay with the card without the bank asking for another code. Security researcher Ford Merrill expects $100 to $500 in losses per card.

If a fake shop only takes the order amount, that is the loss: around $50 on average at BogusBazaar. The Finanzguru Fake Shop Report 2024 counted around 301,000 victims in Germany in 2023, with an average loss of €313 and more than €94 million in total.

Banks catch part of the card fraud: in the UK, they stopped 67p of every pound that fraudsters tried to take without consent in 2024, according to UK Finance. In the EU, banks generally have to refund what gets through. Even so, cardholders in the European Economic Area were left with around 38 percent of card fraud losses in 2024 (EBA and ECB), partly because banks argue gross negligence when someone entered the confirmation code themselves.

How much damage DoppelCart causes

We cannot directly see how many people enter their card details at DoppelCart. BogusBazaar provides a reference point: SRLabs documented more than one million orders across more than 75,000 domains in about three years, around 0.37 per domain per month. We work with:

• around 90,000 active shops, the size on October 12, 2026, for a full year,
• 0.1 or 0.4 victims per shop per month,
• $100 or $500 in losses per stolen card.

The calculator lets you compare the four scenarios and change the assumptions yourself. Use the switch at the top to calculate losses for all fake shops worldwide.

Even the lowest scenario adds up to $10.8 million a year, the highest to $216 million. The costs, meanwhile, are very low. 118,787 of the confirmed domains end in .shop, representing 2.72 percent of the .shop domain population we examined in September 2026. On September 29, 2026, Dynadot offered .shop domains for $1.99, and all of the roughly 8,500 domains with a public registration date were registered in 2025 or 2026. At about $2 per domain, the first year of the whole network costs around $240,000. The losses are 45 to 900 times as high.

Per shop, that is not much: in our scenarios, a single DoppelCart shop causes $10 to $200 in losses a month. A case before the Rostock Regional Court shows how much higher the losses per shop can be. There, just over 30 shops, each online for only days or weeks, found more than 10,000 victims and caused €4.34 million in losses (Händlerbund), more than 300 victims per shop. DoppelCart does not rely on yield but on volume: the network runs around 3,000 times as many shops.

Scaled up to all fake shops worldwide

To calculate worldwide losses, we start with the number of victims and use the loss per card from DoppelCart:

• 2.71 billion online shoppers worldwide (Statista, via Oberlo),
• 0.43 percent of them lose money to a fake shop each year, matching the rate among bank customers in Germany reported by Finanzguru,
• $100 or $500 in losses per victim, as with DoppelCart.

That comes to nearly 12 million victims and $1.2 billion to $5.8 billion in losses a year.

The results of two cross-checks fall in the middle of this range. With the average loss from Germany, €313 or around $340, it comes to nearly $4 billion. The US Federal Trade Commission received 383,441 reports of online shopping fraud in 2024, 76 percent of them with a loss of around $1,480 on average (Consumer Sentinel Data Book). That affects 0.11 percent of US adults; applied to all online shoppers, it comes to around $4.4 billion. Two independent data sets, around $4 billion in losses a year.

Switch the calculator to “All fake shops worldwide”

How many fake shops are behind these losses depends on how many victims a shop finds. If they all found as few as in our DoppelCart scenarios, it would take 2.4 million to 9.7 million simultaneously active shops. Published counts for 2026 show far fewer:

How many shops appear on more than one list is not known. For 2026 this gives a range: if the live counts overlap completely, DoppelCart's 90,000 remain; if they do not overlap at all, it is around 115,000. There are two explanations for the gap between these counts and the estimate: there are far more fake shops than appear in published counts, or many shops find far more victims, as in the Rostock case. Most likely, both are true.

Why it pays off for the operators

A new DoppelCart shop costs little more than its domain. 96 percent of the confirmed shops use identical build files. They are spread across 27 backend regions, averaging around 3,900 shops per region; at BogusBazaar, about 200 shops ran on one server, according to SRLabs. Product descriptions are copied word for word from real stores, and the fake shops load images directly from the affected brands' image servers. We extracted more than 44,000 brand labels from the shops.

DoppelCart also avoids two major costs of other campaigns. ERIAKOS, for example, used merchant accounts with payment providers, which can be shut down (Recorded Future); in 2025 alone, Recorded Future identified more than 3,600 fraudulent merchant accounts (Payment Fraud Report 2025). For ERIAKOS, Recorded Future also counted more than 100 Meta ads a day per site in many cases. For DoppelCart, we found no ad click identifiers. The shops get found anyway: in 22 of 26 searches for long product names copied verbatim, at least one DoppelCart shop appeared in the top ten results, mainly in a Bing-based search engine.

What suspensions achieve

Suspensions work fast. For shops we reported that the registry subsequently suspended, one to five days passed between the report and the suspension. The operators keep replacements ready, though: for one brand, we found nine domains rather than the five initially known. Most of the network remains online. More than 105,000 shops were active in early September 2026, around 90,000 on October 12.

The roughly 15,000 shops that have disappeared since early September account for $150,000 to $3 million in monthly losses in our scenarios. For affected brands, that means: do not just report the one shop you know about, but look for all copies and report the domains together. Our public DoppelCart database is one place to start. Our guide on how to remove a fake shop explains who can have a shop suspended and what a report needs to contain.

Until then, the complaints reach the real company: people ask about orders that were never placed with the real store. The guide's section on limiting the damage explains how to prepare customer service.

Frequently asked questions about fake shop losses

Further reading: the DoppelCart investigation and how to remove a fake shop.