Online Deception: Navigating the Perils of Fake Website E-Commerce Scams

This week, I stumbled upon a rabbit hole of online scams that shook me to the core. It began with a casual conversation with my brother, where he mentioned a new entrant in the Turkish market, Polene, offering unbelievable discounts. This raised suspicion for two reasons: Polene hadn't ventured into the Turkish market, and discounts were unheard of in their history. Curiosity piqued, I delved deeper into the matter, embarking on a week-long investigation to uncover the truth behind these fraudulent activities.

To verify the website's authenticity, I organized all the questions I had in mind on a mind map. Initially, my focus was on scrutinizing the domain, site layout, pricing, and contact information. Upon analyzing the domain name, polene.com.tr, it initially appeared legitimate, given its alignment with Polene's potential business expansion into Turkey. However, upon navigating the site, it became evident that numerous elements, including videos, product listings, and visuals, were directly replicated from Polene's original website. Despite the attempt to mirror Polene's aesthetic, subtle disparities indicated a lack of sophistication compared to the authentic platform.

The most glaring red flag emerged when I observed the pricing discrepancies. Products that typically retail for $450 on Polene's official website were inexplicably listed at a mere $67 on this dubious platform. Such a significant price difference raised immediate suspicion, hinting at the fraudulent nature of the website. Moreover, upon accessing the contact page, my skepticism intensified upon encountering a Gmail account as the primary point of contact, a stark departure from the professional standards expected of a reputable brand like Polene.

These glaring inconsistencies collectively confirmed my suspicions, solidifying the realization that we were indeed dealing with a fraudulent scheme requiring urgent intervention.

The next pressing question revolved around understanding the mechanics of this fraudulent operation. Were they peddling counterfeit bags, engaging in credit card theft, or pursuing some other nefarious scheme? To gain insights, I turned my attention to their Instagram account, a common tool for luring unsuspecting victims. Posing as a potential customer, I reached out to inquire about purchase details and delivery timelines. Astonishingly, their response arrived within a mere two minutes, complete with estimated delivery schedules and assurances of sourcing products from outside Turkey. Their prompt and seemingly legitimate responses further masked their deceit, adding layers of complexity to their scheme.

Undeterred by their apparent legitimacy, I proceeded to make a purchase on their website. However, my suspicions persisted, prompting me to scrutinize the backend code of the website.

As anticipated, the website operated on the Shopify platform, where financial transactions are securely managed by Shopify's finance module. This revelation allayed concerns of credit card data theft, as the website owners lacked visibility over such sensitive information. Nevertheless, the possibility of non-delivery loomed large, indicating a potential loss of funds.

Confirming this suspicion, a subsequent examination of my bank account revealed another transaction linked to a suspicious website based in England, mirroring the Turkish site's dubious nature. Desperate for clarity, I attempted to reach out to the provided customer service email, only to be met with deafening silence for two consecutive days.

As I dug deeper into this investigation, I realized that these scammers couldn't keep up their charades forever. Eventually, someone would catch on, and their operation would be shut down.

However, I suspected that they were likely running similar schemes for multiple brands to sustain their illicit business. With this hypothesis in mind, I decided to investigate other brands that could potentially fall victim to such scams, similar to Polene's case.

I explored brands like Strathberry, Chanel, and Louis Vuitton, but initially found nothing suspicious. However, my efforts paid off when I stumbled upon Songmont, an emerging brand in the leather goods industry. To my dismay, I discovered that the scammers had replicated their fraudulent tactics for Songmont in Turkey. The website, songmont.com.tr, was a mirror image of the original site, offering identical products with enticing discounts. Moreover, the contact details, including the dubious Gmail address and fake Instagram account, mirrored those used in the Polene scam. This revelation confirmed my suspicions that the same individuals were behind these fraudulent activities, targeting multiple brands simultaneously. It left me wondering how many more brands they were exploiting in parallel, underscoring the magnitude of their deceitful operation.

With this discovery, I realized the situation was more serious than I thought, and I needed to find out who these people were and how to hold them accountable. So, I decided to trace their digital footsteps. First, I tried to find out who owned the website domain. I did a WhoIs search, but the owner had hidden their name, so I couldn't get any information.

There was a UK phone number on the website, but when I tried calling, it didn't connect to anything. I couldn't find any name linked to the phone number either. Next, I tried to search for the owner of the Gmail account on the website, but I couldn't find any details. Then, I looked into their Instagram account and found that it had changed its name twice in the past two weeks. It was created just this month, in April 2024, so it was a new scam.

Lastly, I searched for the address listed on the website and discovered it was a shared office space in London. However, this didn't lead to any useful information either. It seemed like I had hit a dead end, so I decided to step back and reconsider my options.

I recalled a fascinating YouTube video featuring a hacker who infiltrated a scammer's system and exposed their entire operation in India. It was both entertaining and enlightening, prompting me to consider the possibility of enlisting a hacker's expertise to uncover the masterminds behind the fraudulent websites. Despite reaching out to several contacts in search of a skilled hacker, I was unable to find one willing to assist with the investigation. However, a friend in the cybersecurity field shared an intriguing solution—an American company offering specialized tools to combat website impersonation.

Eager to assist, I relayed this information to the teams at Polene and Songmont, hoping it might aid in their efforts to combat the fraudulent websites. Realizing the need for legal intervention, I decided to seek assistance from the authorities. This involved reaching out to the affected brands, consulting with a lawyer, and contacting relevant entities such as Turkey's domain registration office and Shopify.

However, my interactions with Shopify revealed a disheartening reality. Despite numerous complaints about fake websites, Shopify appeared indifferent to the issue, citing a lack of action without direct involvement from the brand owners. Disappointed by their response, I sought legal advice from my lawyer in Turkey, who explained the limitations of privacy laws in obtaining domain registration details. Nevertheless, I reported the matter to the Cybercriminal department, hoping they would investigate further.

In parallel, I informed my contacts at Polene about the situation and offered to share my findings to support any legal action they might pursue. Their gratitude was evident, highlighting the importance of collaborative efforts in combating such scams. Despite the challenges posed by legal constraints and platform disinterest, our collective determination to take action remained steadfast.

After exhausting all avenues of inquiry, I found myself unable to uncover the individuals behind these fraudulent websites. Nonetheless, I promptly reported my findings to the respective brands, Shopify, Instagram, and the .com registry in Turkey, hoping for swift action to shut down these deceptive platforms within the next day or two.

However, this investigation led me to ponder why such scams seem to thrive in Turkey. It appears that some individuals are enticed by the allure of easy money, taking advantage of the trust of unsuspecting consumers who fall for seemingly irresistible deals. Moreover, Turkey's economic challenges and lax legal structure provide fertile ground for such illicit activities to flourish. For instance, I witnessed a major gas station store openly selling counterfeit luxury bags adorned with "Made in Turkey" labels —an alarming indication of the impunity with which these scams operate.

Despite reporting such incidents to Turkish authorities, little action seems to be taken, allowing these fraudulent activities to persist unchecked. Unfortunately, this lax response contributes to Turkey becoming a haven for these crooks.

While I lacked the hacker skills to directly expose these criminals, I remain hopeful that reports from Polene and Songmont will prompt Shopify to take down the fake websites. However, history suggests that these scams may resurface under different guises. Hence, it's essential for consumers to exercise caution and skepticism in online transactions. Remember, if a deal seems too good to be true, it probably is.

Looking For Collaboration: If you possess the skills I lack to conclude this investigation, please don't hesitate to get in touch with me. I would welcome the chance to collaborate with you in unveiling these scammers whenever the next opportunity arises.

In conclusion, navigating the online shopping landscape requires more than just caution; it demands collective vigilance and concerted action. While the battle against online scams may seem daunting, every report filed, every awareness raised, and every collaborative effort brings us one step closer to a safer digital environment. As we await the resolution of ongoing investigations, let us remain vigilant and resilient in the face of adversity.