- A fake store rarely looks suspicious: it has a template, stolen photos, reviews, and a padlock. The difference is visible in the registration data, domain age, and payment methods.
- Before making a purchase, check the phone number and company data in the registry: in Poland KRS, CEIDG, and the VAT white list (also the account number), in the USA the Secretary of State registry and BBB.
- You can check the domain registration date at dns.pl/whois (.pl) or rdap.org (.com). A store claiming to be “since 2014” with a domain registered three weeks ago is an indefensible contradiction.
- The padlock only indicates an encrypted connection. A trust seal that cannot be clicked is an image, not a certificate.
- Pay by card or through PayPal. A request for a transfer to a private account, BLIK to a phone number, cryptocurrencies, or gift cards is a sign of fraud.
- On OLX, Vinted, and Allegro, protection only works within the platform. Cash on delivery from Facebook Marketplace is not protected.
- Part 1: How to Recognize a Fake Store and Verify the Seller (you are reading now)
- Part 2: What to Do After Payment, Chargeback, Bank, and Where to Report Fraud
- Part 3: Buyer Rights in Poland and the USA, Customs, and Purchases by the Polish Diaspora
Before You Pay at an Unknown Store: Four Things in Five Minutes
- Find the phone number and call. Lack of a phone number is a violation of statutory obligations in Poland, not an oversight.
- Check the domain registration date at dns.pl/whois (for .pl). If it contradicts what the store claims about itself, you should withdraw.
- Pay by card, not by transfer. A card provides a way back. A regular transfer and BLIK to a phone number are practically irreversible.
- Never provide the SMS code from the bank on the store's website and do not pay via a link sent in a message. If the money has already been sent: first call the bank, then report to incydent.cert.pl (Poland) or reportfraud.ftc.gov and ic3.gov (USA), then contact the police. Do not delete anything, take screenshots. Details are described in Part 2 of this series.
A fake store rarely looks suspicious. It has product images, a cart, terms of service, customer reviews, and a padlock next to the address. Often, it looks nicer than a real seller's site because it was created yesterday from a ready-made template, while a real store has been operating on a site since 2016.
The difference lies in four areas that a fraudster cannot replicate: registration data, domain age, payment methods, and what happens after payment. This part of the series shows how to check these things in a few minutes before you pay. What to do when the money has already been sent is described in Part 2.
An important disclaimer at the start: a low price is not proof of fraud. Clearance sales, outlets, and stores with low margins do exist. Warning signals only make sense when considered together. One signal alone usually means nothing, but three at once mean a lot.
The rules of shopping, buyer rights, and reporting paths are completely different in Poland and the USA. Sections pertaining to only one country are clearly marked.
What a Fake Store Looks Like Today
A few years ago, a fake store could be recognized by its cheap appearance. Today, it is the opposite: sites are created from ready-made templates, photos are stolen, and texts are generated by automation. Recognition has shifted from the visual layer to the factual layer.
Clones and One-Time Stores
The simplest scheme: a fraudster copies the content of an existing store and places it at an address differing by one character or a domain extension – instead of .pl, it appears as .shop, .store, .online, or .top. UOKiK lists unusual extensions among warning signals, honestly adding that “.com and .pl also do not guarantee a safe transaction.”
The second category is stores built for one season: a domain from a few weeks ago, an intensive advertising campaign, then silence. The most common narrative is liquidation (“we are closing the warehouse,” “everything must go”) or a request for “support for a new Polish brand.” A variation is impersonating Polishness: a local name, a flag in the footer, a declaration of “family business,” while in reality, the return address is in Asia.
Advertisements on Social Media
The most common path to a fake store today does not lead through a search engine, but through advertising. The FTC described this mechanism in November 2025: fraudsters impersonate real companies and advertise branded products at exceptionally low prices, and clicking leads to a site that takes money in exchange for a counterfeit or nothing. The police (CBZC) describe the same: an unnaturally low price plus time pressure – “only today,” “last pieces,” “promotion -80%.”
Misleading Dropshipping
It is not always a crime, but it usually ends in disappointment. The store looks Polish, prices are in zlotys, and the order goes straight from a supplier in Asia: delivery takes 6–8 weeks, quality is worse than in the photos, returns outside the EU are at your own expense. The goods usually arrive. The problem is that the buyer did not receive the information required by law.
Credibility Props
Hundreds of five-star reviews from one week, logos of “trust certificates” that lead nowhere, a made-up NIP and KRS in the footer, an address where there is no store, a phone number with one digit too few. CERT Polska summarizes it best: before purchasing, check if there is a phone number for the store, if popular payment methods are offered, and if the reviews do not look fake.
Examples of Fraudulent Ads, Sites, and Messages
All the examples below are fabrications: names, domains, and numbers were invented for this material.
Example of a Fraudulent Offer 1: Social Media Advertisement
A well-known shoe brand is closing its operations in Poland! Entire stock is going for 89 PLN per pair (catalog price 749 PLN). Time left: 00:11:24. Last 4 pairs in your size! super-okazje-outlet[.]pl
Three signals at once: unbelievable discount, countdown timer, and false scarcity. UOKiK calls timers “dark patterns.”
Example of a Fraudulent Offer 2: “Liquidation” Store
LIQUIDATION OF WAREHOUSE – EVERYTHING FOR 29 PLN. We must clear the hall by August 31. Payment only by transfer – this is how we keep such low prices. likwidacja-magazynu24[.]pl
CERT Polska indicates that fake stores “very rarely offer popular payment methods.” The statement about low prices due to transfer is the essence of the fraud.
Example of a Fraudulent Offer 3: Fake Payment Gateway
After clicking “Pay,” a page similar to the bank login opens, address mbank-potwierdzenie[.]xyz. The form asks for a login, password, and SMS code “to confirm identity.”
A real payment gateway never asks for an SMS code on the store's page. CERT Polska advises checking if the page the store redirects to is indeed your bank's page.
Example of a Fraudulent Message 4: BLIK to Phone Number
“Cart reserved. Our payment system is down today, so please send BLIK to number 000-000-000 or a transfer to a private account – this is the owner's account. Reservation valid for 30 minutes.”
A real store accepting online payments does not ask for money outside the system. Both methods are irreversible.
Example of a Fraudulent Message 5: Link to “Receive Payment” on OLX
“I’m buying. I’ve already paid through OLX Delivery, please confirm receipt of the money with this link: olx-platnosc-bezpieczna[.]com/odbierz”
OLX states directly that with OLX Delivery “there is no need to click on external links or confirm data or 'receive payment'.”
Example of a Fraudulent Message 6: Moving the Conversation Outside Vinted
“Message me on WhatsApp. If you pay me directly, you won’t pay the commission for Buyer Protection.”
Vinted states directly: “You do not need to leave Vinted to confirm payment or receive an order” and is not responsible for losses from fraud outside the platform.
Example of a Fraudulent Message 7: SMS About Package Surcharge (Poland)
“Your package has been held due to a missing street number on the package. Update your shipping information: hxxps://inpost.pl-admin[.]cyou/PL”
This is a pattern published by the police. Note the lack of Polish characters and that “inpost.pl” is only the beginning of the name – the real domain is pl-admin.cyou.
Example of a Fraudulent Message 8: SMS About Package Surcharge (USA)
“USPS: your package is on hold due to an incomplete address. Update here: usps-redelivery-fee[.]info – fee $0.35”
USPIS calls this smishing: if you did not order package tracking directly from USPS, and the message contains a link – do not click. The amount is deliberately laughably low, as it is just a pretext.
Example of a Fraudulent Offer 9: “Free Sample” with Hidden Subscription
“Cream for free, you only pay 4.90 PLN for shipping.” In the terms and conditions in fine print: after 14 days, a subscription of 249 PLN per month starts, charged to the provided card.
Providing the card number “for just the shipping” is the entire purpose of the transaction. Only in the USA: as of October 2026, the federal “click to cancel” rule does not apply. The rule from 2024 was overturned by a federal court in July 2025. Do not assume that cancellation will be as easy as signing up.
Example of a Fraudulent Offer 10: Request for Cryptocurrency or Gift Card
“Card payment temporarily unavailable. We accept USDT or codes from gift cards – send a photo of the scratch card.”
The FTC formulates this as a rule without exceptions: never buy from a seller who insists that the only payment methods are gift cards, money transfers, payment apps, or cryptocurrency.
Warning Signal Table
| Warning Signal | Why It Is Suspicious | How to Check It | What to Do |
|---|---|---|---|
| Price significantly lower than market | Brands do not sell new goods for 10% of the price; a clearance of the entire assortment at once has no business justification | Compare the price with three other sellers and the manufacturer | The signal alone is not enough. Check registration data and domain age before withdrawing |
| No phone number, only a form | Only Poland: providing a phone number is a statutory obligation of the seller (Article 12 of the Consumer Rights Act) | Look for the phone number in the Contact section and in the terms of service; call before purchasing | Do not buy with a prepayment if no one answers |
| No registration data or inconsistent data | Fake stores provide a made-up or someone else's NIP and KRS | Only Poland: VAT white list, KRS search engine, CEIDG. Only USA: state Secretary of State registry | If the number is not in the registry, withdraw |
| Account for transfer not on the VAT white list | A company registered in Poland reports business accounts to the list; private accounts do not appear there | Only Poland: VAT taxpayer list, search by account number | Do not pay by transfer to that account |
| Domain registered a few weeks ago | A store “existing since 2014” cannot have a three-week-old domain | dns.pl/whois for .pl, rdap.org for .com – created field | Contradiction with the content of the site settles the matter |
| Only prepayment by transfer or BLIK to a phone number | These payments are practically irreversible, which is why fraudsters demand them | Check if there is a card, PayPal, or cash on delivery at checkout | Choose another method or another store |
| Hundreds of identical reviews from one period | Only Poland: posting false reviews has been prohibited since January 1, 2023. Only USA: prohibited by the FTC rule since October 21, 2024 | Check the distribution of dates and look for reviews outside the store's site | Treat reviews on the store's site as marketing material |
Checking the Seller Before Purchase in Poland
Only Poland. This entire section applies to sellers registered in Poland. It takes five minutes and catches most fake stores.
Step 1: Find Registration Data
The seller is legally obliged to provide identifying data of the company with the registration authority and number, address, email, and phone (Article 12, paragraph 1). Look for this in the footer, in the “Contact” section, and in the terms of service. If this data is nowhere to be found, it is not an oversight.
Step 2: Check the Number in the Registry
- Company (KRS number): Court Register Portal, prs.ms.gov.pl/krs. Check if the company exists and if the name and address match what the site provides. The older address search engine krs.ms.gov.pl may be blocked by server security and may not open even in a regular browser.
- Individual business: CEIDG, ceidg.gov.pl. Check if the entry is active.
- NIP: VAT taxpayer list (“white list”), podatki.gov.pl/wykaz-podatnikow-vat-wyszukiwarka/.
Step 3: Check the Account Number on the White List
This is the strongest test for a store that wants a transfer. The VAT taxpayer list allows searching by account number: enter the account provided for the transfer and check if it belongs to the company running the store. If it does not belong to anyone or belongs to another company, do not pay. A request for a transfer to a private person's account settles the matter, as private accounts do not appear on the list.
Step 4: Check Domain Age and Warning List
NASK provides public WHOIS for .pl domains at dns.pl/whois. Personal data is not shown there (this is a requirement of data protection regulations and is not a warning signal), but the date in the created field is always visible. A domain from March 2026 and a declaration of “on the market since 2011” is an indefensible contradiction.
Also check the CERT Polska Warning List (cert.pl/lista-ostrzezen/) – domains on this list are blocked by operators. However, the list operates reactively: absence from it is not a certificate of honesty.
Checking the Seller Before Purchase in the USA
Only USA. In the States, there is no single central business registry, so verification is more dispersed.
State Registry. Companies register with the Secretary of State of their state. A list of search engines for all states is maintained by the National Association of Secretaries of State: nass.org/business-services/corporate-registration. Check if the entity with the given name exists and has an active status. Note: registration confirms existence, not honesty.
Better Business Bureau maintains a business search engine (bbb.org/search) with ratings from A+ to F, a history of complaints, and accreditation status, as well as Scam Tracker (bbb.org/scamtracker) – a database of consumer reports. BBB is a private organization without investigative powers; its value lies in the fact that someone has usually already described the same store.
Domain Age. For .com, .net, .store, and similar, RDAP will work, for example, rdap.org/domain/store-name.com. Owner data is usually hidden, but the registration date is visible.
Address and Phone. Enter the address in maps and turn on street view: if “electronics store headquarters” turns out to be a residence or a mailbox at a service point, that is information. Call the provided number before purchasing.
State Assistance: consumer protection offices – usa.gov/state-consumer; state attorney general – usa.gov/state-attorney-general; consolidated government instructions on complaints about online purchases – usa.gov/online-purchase-complaints.
Domain Age, Padlock, Reviews, and Trust Seals
Why the Padlock Proves Nothing
The padlock indicates that the connection is encrypted, meaning that no one is spying on the transmitted data along the way. It says nothing about who is on the other side. CERT Polska states directly that the padlock next to the store's address “is not a guarantee of safe shopping.” The FBI put it more strongly in 2019: do not trust a site just because it has a padlock icon or “https.” Certificates are free and issued automatically; a fraudster can get a padlock in a minute.
How to Read Domain Age
The registration date remains public despite all changes in data protection. It is the cheapest effective check: for .pl domains – dns.pl/whois, for others – rdap.org/domain/name.com.
Interpret cautiously in both directions: a young domain is a risk signal, not proof of fraud, and an old one proves nothing, as domains are bought back. The signal becomes strong only when it contradicts what the store says about itself.
How to Recognize Fake Reviews
- Distribution over time. Hundreds of reviews from one week and silence for the rest of the year.
- Specificity. Real reviews mention model, size, color, delivery issues. Fake ones are general.
- Distribution of ratings. A real store has some threes and ones; only fives are unnatural.
- External source. Look for reviews outside the store's site. CERT Polska also advises checking if “they definitely relate to this store, with exactly that website address,” as fraudsters copy others’ reviews.
Trading in fake reviews is illegal on both sides of the Atlantic. Only Poland: since January 1, 2023, posting or commissioning false consumer reviews is an unfair market practice prohibited under any circumstances, and UOKiK has already imposed penalties for it. Only USA: since October 21, 2024, the FTC rule regarding consumer reviews and endorsements is in effect.
Certificates and Trust Seals
There is neither a Polish state nor a European quality mark for online stores. All marks are issued by commercial companies, usually for a fee. They are not official certifications. The only sensible test is mechanical: click the seal. It must lead to the issuer's site, in its domain, and show this specific store as currently valid. If the graphic is not a link, it is an image, not a certificate.
How to Pay at an Unknown Store
At an unknown store, pay by card (preferably credit) or through PayPal. Not because the store is definitely scamming, but because these methods provide a way back that a transfer does not. And if the only method is a transfer or BLIK to a phone number, treat it as information about the store, not about technology.
A comparison of payment methods (credit and debit card, PayPal, cash on delivery, transfer, BLIK, cryptocurrencies) with how to recover money in each case can be found in Part 2.
Shopping on OLX, Vinted, Allegro, and Social Media
Protection on classified ad services exists, but only when the transaction takes place entirely within the platform.
OLX. The most common scheme is a link to “receive payment” or “pay for shipping.” OLX documents variants: link, QR code, SMS, a call from a supposed employee, a request for a “verification transfer of 1 PLN,” receipt of a shopping voucher. The goal is always the same – login data or card details. The service states directly that its employees never ask for this data or to click a link. Report: the “Report” button next to the ad, reason “Fraud.”
Vinted. Buyer Protection covers “Buy Now” purchases: the item did not arrive, arrived damaged, or significantly differs from the description. It is paid (the fee is shown at checkout) and mandatory. The deadline is very short: you must press “I have a problem” within 2 days of notification of delivery – after that, the order is closed, and the money goes to the seller.
Allegro. The program is now called Allegro Buyer Protection (formerly Allegro Protect) and claims refunds up to 20,000 PLN, although compensation does not always cover 100% of costs. The application can be submitted from the 14th day to 2 years after purchase, and if the product did not arrive, already after 7 days from reporting the problem. The program does not cover cash payments upon personal pickup.
Facebook and Instagram. Meta has Purchase Protection for Marketplace, but the scope is narrow and systematically narrowed: it mainly covers purchases through checkout on Facebook, while transactions through external sites, personal pickups, and payments in messengers do not qualify. In practice, the most popular mode, cash on personal pickup, is not protected at all. Report in two ways: separately for the ad or profile, separately for the advertisement.
Common Rule. Protection ends exactly where the platform ends. A request to switch to a messenger, pay “directly,” click a link confirming payment, or BLIK is equivalent to a request to waive protection.
Myths and Facts
Myth: A padlock next to the address means the store is safe. Fact: The padlock only indicates an encrypted connection. CERT Polska states that it is not a guarantee of safe shopping, and the FBI warns not to trust a site just because it has a padlock.
Myth: Since the store has thousands of positive reviews, it is trustworthy. Fact: Reviews on the store's site are controlled by its owner. Trading in fake reviews has been prohibited in Poland since January 1, 2023, and in the USA since October 21, 2024.
Myth: Facebook will refund me for fraud on Marketplace. Fact: Meta's protection mainly applies to purchases made through checkout on Facebook. Cash on personal pickup, the most popular mode, is explicitly excluded.
Myth: A request for a surcharge for a package is always fraud. Fact: In 2026, real customs surcharges became common on both sides of the Atlantic. The suspicious factor is not the surcharge itself, but the link to payment sent in a message.
How to distinguish a real customs charge from a fake one is discussed in Part 3.
Key Rules
- Pay by card, not by transfer. This is the only decision before purchase that really changes your situation after fraud.
- Check three things before payment: whether there is a phone number, whether there are normal payment methods, whether the reviews do not look fake. This is the CERT Polska list.
- Check the domain registration date. It takes thirty seconds and catches one-time stores.
- Only Poland: check the account number on the VAT white list. An account outside the list with a “company” is the end of the conversation.
- The padlock proves nothing. Neither a certificate nor a trust seal that cannot be clicked.
- Never pay via a link in an SMS or email. Real customs charges are collected by the carrier upon delivery.
- Do not leave the platform. OLX, Vinted, and Allegro protection ends at the first message on WhatsApp.
- Never provide the SMS code from the bank on the store's website.
- A low price is not proof of fraud. Proof is the coincidence of several signals at once.
Checklist Before Purchasing from an Unknown Store
- The store provides the full company name, address, email, and phone number
- The phone number is complete and someone answers it
- Only Poland: NIP and KRS or entry in CEIDG match the registry
- Only Poland: the account number for the transfer is on the VAT white list and belongs to this company
- Only USA: the company is listed in the Secretary of State registry of its state
- Only USA: I checked the store in BBB and Scam Tracker
- The domain registration date does not contradict what the store says about itself
- The store is not on the CERT Polska Warning List
- The terms of service are coherent, in Polish, and pertain to the same company as the header of the page
- I know the return policy: deadline, who pays for the return shipping, return address
- The return address is not outside the European Union (or I consciously agree to this)
- Payment by card or PayPal is available
- The price compared with at least three other sellers
- Reviews have a reasonable distribution over time and ratings, and are specific
- The certificate seal, if present, links to the issuer's site
- There is no countdown timer or message “last pieces”
- The store does not ask for BLIK to a phone number or for a transfer to a private account
Frequently Asked Questions
Is a store without a phone number definitely a fraud?
Not definitely, but it is a serious signal. Only Poland: providing a phone number is part of the seller's informational obligations under Article 12 of the Consumer Rights Act, so its absence means that the store is already breaking the law from the start. CERT Polska lists the lack of a phone as one of three things to check before purchasing. Treat this as a reason not to pay in advance by transfer.
How to check if the store really exists as a company?
Only Poland: take the NIP and KRS number from the footer or terms of service and check them in the KRS search engine, CEIDG, and the VAT taxpayer list at podatki.gov.pl. Separately enter the account number provided for the transfer – if it does not belong to this company, do not pay. Only USA: check the Secretary of State registry of the state provided by the store, and you can find the list of search engines for all states at nass.org/business-services/corporate-registration.
Does the padlock next to the website address guarantee anything?
It guarantees only that the connection is encrypted, meaning that no one is spying on the transmitted data along the way. It says nothing about who owns the site. CERT Polska states directly that the padlock is not a guarantee of safe shopping, and the FBI warned not to trust a site just because it has a padlock or “https.” Certificates are free and issued automatically.
I bought on Facebook Marketplace and was scammed. Will Facebook refund my money?
Probably not. Meta's protection primarily covers purchases made through checkout on Facebook and explicitly excludes transactions through external sites, personal pickups, and payments in Messenger and other messengers. It separately notes that items exchanged in person for cash are not covered by protection. Report the ad and advertisement, and seek your money through the bank if you paid by card.
Sources
As of October 23, 2026. This guide is for informational purposes only and does not constitute legal or financial advice. Registries, platform regulations, and laws change frequently, so check the current page of the relevant institution before acting. For individual matters, contact your bank, the consumer advocate (Poland), the consumer protection office of your state (USA), or a lawyer. Examples of ads, messages, and website addresses are fictional.
Comments (0)
No comments yet. Be the first!