Fake shops with AI: highly professional, fast-rising fraud.

# Community of Trust — Deutschland sicher im Netz (DsiN) with Isabelle Rosière

Isabelle Rosière: There are basically no longer any reliable indicators that you can use today, in the age of AI, to identify a fake shop.

Dr. Carsten Föhlisch: No, that's probably fair to say. Honestly, there really aren't.

Things have changed very quickly.

Welcome to Community of Trust. Today's guest is Isabelle Rosière, Managing Director of Deutschland sicher im Netz e.V.

Dear listeners, welcome to a new episode of our Community of Trust podcast.

I'm Dr. Carsten Föhlisch from Trusted Shops, and today's topic is fake shops and how consumers can protect themselves.

We have a fantastic guest with us. Welcome, Isabelle Rosière, Managing Director of Deutschland sicher im Netz — the association for digital education and cybersecurity under the patronage of the Federal Ministry of the Interior.

I'm very pleased you're here. Hello, Isabelle.

Isabelle Rosière: I'm very happy to be here.

Dr. Carsten Föhlisch: Before we get into the topic, could you briefly introduce DsiN — Deutschland sicher im Netz? What do you do, for whom, and with what goal?

Isabelle Rosière: First of all, Carsten, thank you very much for having me and for giving us the opportunity to talk about this important subject.

Deutschland sicher im Netz is affectionately abbreviated to DsiN. It's not necessarily an abbreviation you arrive at immediately, but the name has become well known over the past 20 years.

Dr. Carsten Föhlisch: You've been doing this for that long?

Isabelle Rosière: Yes. We've been around for 20 years under the trusted patronage of the Federal Ministry of the Interior.

What we do is promote digital education by building people's skills.

Digitalisation has been with us for quite some time now, and it has changed enormously over the last 20 years.

We try to reach a very broad range of target groups: consumers, young people, older people, political stakeholders, and also small and medium-sized businesses.

Cybersecurity is really at the heart of what we do. It's part of our DNA.

But cybersecurity isn't exactly a word you can take out onto the street and expect everyone to say, "Great, I'd really love to get involved with that."

So we try to approach it through language and formats that fit the respective target groups, so that people actually want to behave more securely and are able to use digital applications safely.

Dr. Carsten Föhlisch: That's incredibly important.

Education and awareness are one part, alongside protection mechanisms provided by politics, regulation and industry. We'll come back to that.

You're close to people who are affected by online fraud. Has the situation changed over the past few years? Has it become worse?

Isabelle Rosière: We come very much from the prevention side.

That means we try to get ahead of the wave — ideally before something happens.

We want to prevent people from falling for email scams or fake shops.

And yes, the figures show that fraud schemes of every kind have increased.

It's not only the sheer number — the next fake shop popping up again and again — but also the sophistication and perfection of fraud schemes, whether in the financial sector or in online shopping.

That has increased dramatically.

Dr. Carsten Föhlisch: So in qualitative terms, the scams have become much more convincing.

Do you also have figures for the scale? We often get asked how many fake shops there are or how many fraud cases there are.

Isabelle Rosière: We don't collect those figures ourselves.

There are other sources for specific fraud or fake-shop numbers, including SCHUFA.

The BSI also publishes its annual situation report, which looks at cyberattacks more broadly.

And our own DsiN Security Index shows very clearly that attacks on consumers are increasing overall.

That includes phishing and fraud more generally.

Another thing our research shows is what we call a knowledge-behaviour gap.

People often believe they know how they could behave more securely, but they don't actually behave that way.

Dr. Carsten Föhlisch: I read that, according to SCHUFA, roughly one in four Germans has already been a victim of online fraud.

That's remarkable.

I wouldn't have expected it to be that high.

And as you said, it often comes down to offers that are simply too good to be true.

I know people who bought from shops because the site looked so professional, the design looked convincing and the price was incredibly attractive — but there were no real security mechanisms behind it.

Isabelle Rosière: That's something we need to say very clearly.

You already mentioned the quality.

The sheer quantity is one issue, but the visual and technical quality of these shops has reached a level where they are often barely distinguishable from legitimate ones.

And I think it's important to talk openly about that.

I nearly fell for a scam myself recently.

It wasn't a fake shop but a classic scam on Kleinanzeigen.

It was simply very well done.

That's exactly what these scams rely on: you act almost unconsciously because everything looks so authentic that you never even reach the point of questioning it.

Dr. Carsten Föhlisch: That has happened to me too.

I once wanted to buy tickets for the play-offs — Cologne against Eisbären Berlin.

There were no tickets available anywhere, and then suddenly someone on Kleinanzeigen had them at the normal price.

It looked perfect.

But then I was asked to pay in advance using the "friends and family" option.

That made me suspicious.

Then they asked me to pay again, and suddenly it was a different email address.

At that point I said no.

But I was really close to transferring €300 or €400 because I wanted those tickets for my sons and myself.

So this really is a mass phenomenon, not something limited to isolated cases or one particular age group.

Isabelle Rosière: Exactly. That's extremely important.

There is still this idea that perhaps only older people fall for fraud or fail to recognise fake shops.

That simply isn't true.

It cuts across every social group and every age group.

And of course generative AI has accelerated this enormously over the past few years.

Fake shops can almost be bought as a crime-as-a-service package now — effectively fake-shop-as-a-service.

It could be a teenager trying to make some extra money, but what we usually see is that there are large structures behind it.

Dr. Carsten Föhlisch: Organised crime.

Isabelle Rosière: Exactly. Organised crime.

So for us at Deutschland sicher im Netz, the question becomes: what kind of toolkit do people actually need?

The classic advice used to be: look at the legal notice.

You should still do that.

But it doesn't necessarily work as well as it used to.

It is still extremely important to enable people and make them aware that these criminal schemes exist.

And my favourite sentence remains: if it looks too good to be true, it probably isn't true.

Dr. Carsten Föhlisch: That leads directly to my next question.

What should consumers actually look for before buying from an unfamiliar shop?

Consumer advice organisations often say: check the legal notice, see whether there's an address.

But all of that can be faked.

Even the language is no longer a giveaway. In the past, bad translations or an unprofessional appearance could expose a fake shop.

Today, everything can look extremely professional.

So what can people realistically still do?

Isabelle Rosière: There isn't really one classic checklist anymore.

One thing I often say is: listen to your gut feeling.

Ask yourself why this pair of shoes is dramatically cheaper on this site than everywhere else.

That should make you cautious.

And even that isn't always enough, because sometimes the goods simply never arrive.

Another simple recommendation is: sleep on it for a night.

Don't make rushed purchases late in the evening.

And of course you should still take a look at the legal notice, the shop itself, how broad the range is, and whether you've ever heard of the business before.

If you haven't, be more cautious.

The key thing is to avoid impulse purchases.

Dr. Carsten Föhlisch: I find that difficult.

We know the Fakeshop-Finder from the consumer advice centres very well. Verbraucherzentrale NRW is represented on our advisory board, and we've discussed it at length.

But I always say openly: a green traffic light there still doesn't mean you can shop there with certainty.

It can tell you not to shop somewhere, but the harder question is: where can I shop safely?

That's why our approach has increasingly been to highlight the positive — starting with the Trustmark and reviews, and now with #trstd Login, where you can verify the authenticity of the website itself.

You can confirm that you're really on the genuine site.

I think that's a good combination.

It's difficult to focus only on telling people where they shouldn't shop.

At some point you also need to show them where they can.

Isabelle Rosière: I agree.

Consumer organisations are often somewhat cautious about directly recommending providers, but trusted signals have become much more important because of the enormous growth in fake shops.

I think several things need to work together.

You need security by design — technical mechanisms that can verify whether a shop is genuine.

I'm not a technical expert myself, but verification matters.

And then there is the wider issue of trust.

Every fake shop and every bad purchasing experience damages trust in the whole system.

That applies particularly to e‑commerce, but it goes much further.

You see the same thing when people hesitate to use digital identity solutions or an electronic patient record because their feeling is: "Somehow none of this is secure."

So established brands also take on a different role as trusted brands.

They need to invest in their brand awareness, accept responsibility, invest in security infrastructure for their own websites and help rebuild trust.

That can also help them win back customers.

But of course that doesn't mean only large shops are secure.

We shouldn't discredit smaller shops.

It's a combination.

Dr. Carsten Föhlisch: I would even put it more provocatively: the large brands are often particularly vulnerable to being faked.

Well-known brands are cloned precisely because people already trust them.

That's certainly our experience.

And fake shops often sell branded products or include names like Adidas in their domains without actually being Adidas.

So for me, it's about making the genuine brands visible.

That's what we try to do with a tamper-resistant mechanism.

You log in and have your personal #trstd Secret.

You activate #trstd Login on the genuine website and then see a pop-up containing your name, a personal date you've chosen and a colour.

A fake shop cannot reproduce that combination.

There are also computer-science studies around the strength of combining several personal markers.

So you know: I'm on the right site for the real brand.

The larger the brand, the greater the risk of being copied.

There are medium-sized businesses that literally put banners on their sites saying, "Warning: these are our 120 fake shops. Don't buy there."

For me, the goal is to make the good — the trustworthy — visible, because fake shops have become so professional that you simply cannot reliably identify every criminal site from visual clues.

Isabelle Rosière: That's very interesting.

Would consumers have to create a separate login for every shop?

Dr. Carsten Föhlisch: No.

You register once with us, free of charge for consumers, and define your #trstd Secret.

Shops that have #trstd Login integrated then allow you to verify directly on their site whether you're really on the genuine website.

You only need to register once.

We're also doing more education around that.

Consumer organisations have traditionally recommended clicking on the Trustmark.

That advice has to evolve too, because we need a contemporary product in an age where AI can generate very convincing fakes.

Let me ask another question.

Are there groups that are particularly at risk?

Are there experienced online shoppers and less experienced ones? Do you give different advice to different people?

Isabelle Rosière: The entry point may differ, but our DsiN Security Index deliberately doesn't divide people simply by age or demographic profile.

We distinguish between different user types instead.

There might be the cautious user, the fatalistic user and so on.

And within those groups, you find a mixture of ages.

There are digitally very capable older people who help other older people use technology more securely — a peer-to-peer multiplier approach.

What's important is to address people's actual lives.

A 70-year-old naturally uses digital services differently from someone who is 15 or 18.

Older users may be much more cautious, which can actually be an advantage here.

With the younger generation, people often say: they're digital natives, they know all of this much better.

Sometimes people jokingly call them digital naives.

Young people simply move much faster.

Anyone with teenagers sees that: swipe, click, move on, everything happens at high speed.

I'm digitally capable myself, but my 15-year-old daughter will stand next to me and say, "You need to go faster — click there."

I say, "Wait a moment."

That speed also means people click "buy", click on a competition, or react to an offer much more quickly.

And that becomes more challenging because these young people are growing up.

We need to invest a lot in helping them understand the types of scams that exist and that fake shops exist.

With teenagers, it's often something like: "I absolutely need these shoes — I saw them for €50 instead of €130."

Dr. Carsten Föhlisch: So on one hand, it's about education.

But education alone probably isn't enough.

You also expect platforms and providers to take responsibility.

You mentioned that brands need to invest in security.

What do you expect from platforms and providers as their contribution to safety?

Isabelle Rosière: The most important thing is that we start treating this as a shared responsibility instead of constantly passing the blame from one party to another.

Our members show that this can work.

We're under the patronage of the Federal Ministry of the Interior, but we are not financed by it.

We work closely with the ministry at political level, but our members make our work possible.

These are companies that believe strongly that businesses need to take responsibility — both by supporting the infrastructure for digital skills and by looking closely at the security requirements of their own products and services.

Politics naturally also plays a major role.

I don't want to turn this into a long discussion about regulation.

Regulation alone cannot be the solution.

The Digital Markets Act, the Digital Services Act and the upcoming Digital Fairness Act are all important instruments.

But legislation is always behind reality.

You simply cannot regulate as quickly as new systems, new dark patterns and new technologies appear.

Two years later, you may already have to start all over again.

We believe it is extremely important to build a broad infrastructure for digital competence.

That means teaching these skills to young people, older people and consumers more generally.

Politics can help drive that.

We run projects for specific target groups with various ministries, including the family ministry and the consumer-protection ministry.

We also have projects in Bavaria, for example, where we train political stakeholders on dealing with disinformation.

The field is incredibly broad.

Fake shops are just one manifestation of the much larger phenomenon of "fake" that characterises our time.

It's a shared task.

Innovation is also essential.

That's where companies and platforms come in — showing what is technologically possible and moving things forward.

Dr. Carsten Föhlisch: I had a discussion just yesterday with chambers of commerce about dark patterns and, of course, the Digital Fairness Act.

I always find it interesting that people call for new regulation even though the existing regulatory framework is already extremely dense.

For years, especially medium-sized shops have struggled just to comply with all of it.

What we actually want to regulate are things like Temu, Shein and similar actors.

But the existing rules often aren't properly enforced.

So I think this is frequently more an enforcement problem.

It's easy for politicians to say, "We'll create another consumer-protection law."

But we already have many laws. They need to be enforced.

If we regulate European SMEs even more strictly while Chinese providers simply ignore the rules, then that becomes counterproductive.

That's why I like the education approach — and also the idea that industry contributes through assistance mechanisms and security mechanisms.

Our example shows that these can even be commercially viable.

We're a business. We earn money through trust because there is demand for it.

But I'd like to come back specifically to AI.

We've already mentioned it several times.

Fake shops as a service are becoming more convincing and more authentic because of AI.

You no longer have badly written terms and conditions or missing information.

Within seconds you can generate a very convincing clone of Otto, Booking, Zalando or another major brand.

What does that mean for your educational work?

Have you adapted your recommendations specifically for that?

And agentic commerce is another new topic developing at enormous speed.

Isabelle Rosière: The issue of trust runs through the whole AI discussion.

We also deal with it at a high level, but many consumers aren't yet at that point.

I've talked to people about ChatGPT and they've reacted as if they'd never even heard the name.

There is still an enormous gap.

On one side are people who are frightened by AI systems in general and feel that everything is about to overwhelm them.

On the other are people who casually share all kinds of sensitive information with whichever LLM they happen to use.

What we see very clearly, because the potential damage is so significant, is that online fraud, digital scams and fakes have become one of our central topics.

We discuss a great deal what this means for digital competence.

It cannot mean adopting a pure zero-trust mindset.

That would be fatalistic.

We can't simply say, "Turn off the internet because nothing is safe anymore and everything is fake."

So we also need the law-enforcement side — the police and the relevant authorities — to keep up.

There are reporting systems, but by the next day three new sites may already be online.

And if you try to report a fraud, often not very much happens.

Part of the business model is that the individual amounts are often kept relatively small.

But what may look like a small amount to an authority can still be a major loss to the individual.

More needs to happen there so fraud becomes less attractive and the operators or designers of fake shops cannot simply walk away.

Dr. Carsten Föhlisch: I don't think it's only about the amounts.

We used to see a lot of trademark infringements involving our Trustmark, especially around Christmas.

That still happens.

The Trustmark would simply be copied.

At first, I reported those cases to the public prosecutor.

But as soon as the case crossed a national border, that was basically the end of it.

"We can't pursue this any further."

And of course it often comes from outside Europe.

So law enforcement hasn't helped us very much there.

That means it really is a combination of education and private-sector protection mechanisms.

State regulation and prosecution often stop at the border.

These are rarely cases where someone is sitting around the corner and can simply be arrested.

We've already covered quite a lot of my questions.

So there really are no identifying features that consumers can reliably depend on anymore when it comes to fake shops in the age of AI.

Isabelle Rosière: No. Honestly, there really aren't.

Dr. Carsten Föhlisch: And that changed very quickly.

So what can consumers themselves still do?

Even if I know all the usual advice — don't simply pay in advance without protection such as Trusted Shops Buyer Protection or PayPal Buyer Protection — that already requires quite a bit of knowledge.

Isabelle Rosière: But that's already a lot.

If people simply avoid unprotected advance payments and don't use "friends and family" payment methods for purchases, that already makes a difference.

Even fake shops may tell you to use those methods.

You simply have to be cautious.

At the same time, we have to acknowledge the limits of what we can reasonably ask consumers to do.

Their individual room for manoeuvre is becoming smaller.

That's why awareness matters so much.

First of all, people need to know: this exists. Be careful. This is what it can look like. And anyone can be affected.

There is another major factor, beyond all the technical possibilities AI creates: the criminals also understand human psychology.

People shop late at night.

They make quick purchases.

Shopping can trigger dopamine and offer a brief moment of satisfaction, even if they regret it the next day.

Scams exploit that speed.

"You need to enter this now. This payment didn't work. Try another one."

Within three or four minutes, you may have entered three different bank details, PayPal and another payment method.

And then there is another factor: shame.

People think, "My God, how embarrassing. How could this happen to me?"

They don't want to talk about it or report it.

They may think they're being punished for their own stupidity because they've lost €200 or some other amount.

That's why it's so important to make clear that responsibility does not lie solely with the consumer.

All the relevant actors need to work together to break these patterns.

Dr. Carsten Föhlisch: Two weeks ago, I heard a very interesting talk by Markus Gabriel, the professor of philosophy in Bonn.

He has written about emotional intelligence and said that a large proportion of AI queries — perhaps 70 or 80 per cent — are actually relationship-related.

They are emotional relationship questions.

People form relationships with AI. AI reflects us back to ourselves.

There's also the film Her from 2013.

When GPT-4o was launched, I think Sam Altman simply posted "Her" that day.

We're resonance bodies.

AI triggers our emotions, and emotions are a major factor in purchasing decisions — which is exactly where people can fall for fake shops.

Have you already encountered agentic commerce?

Are consumers already telling you that they searched through Gemini or another AI and bought directly from there, or even sent an agent to purchase something for them?

Isabelle Rosière: Not that I'm aware of.

I don't think it's reached the mainstream yet.

But it definitely will.

Everyone is working on it.

I think it will still take some time before it's part of everyday life for a broad section of the population.

Dr. Carsten Föhlisch: Mastercard recently announced what I believe was one of the first agentic transactions in Germany — perhaps a ticket or travel purchase.

We've also developed something for this ourselves: the #trstd <protocol>.

The idea is that AI agents receive verified trust signals so they know where they can transact safely.

I think this will develop extremely quickly, like everything else around AI.

Isabelle Rosière: There is another point I'd add.

Convenience is not necessarily the thing that delivers the highest level of security — whether we're talking about food, digital products or anything else.

We want people to make sovereign decisions about what they use.

We don't tell people, "Use this, don't use that."

If someone is comfortable sharing a lot of data because they find personalised advertising useful, that isn't automatically something to condemn. It can be pleasant and practical.

But with agents, many systems and datasets have to be connected.

That creates interfaces, and those interfaces may not always be equally secure.

Without making a specific recommendation here, I think that's one of the things many people are still concerned about.

It would be incredibly convenient to connect my email programme, calendar and everything else to an agent.

But in doing so, I'm also exposing a very large amount of data.

That debate needs to happen openly.

We need to understand where people are, where trust in certain services begins and where it reaches its limits.

Dr. Carsten Föhlisch: That's perhaps a parallel to the discussion about Chinese platforms.

Everyone says there are unsafe products, that they may not meet our standards — and yet people still buy them because they're cheap, simple and fun, with all the gamification around them.

I can imagine something similar happening with data and agentic shopping because it is simply so convenient.

If I'm buying a new iPhone, I may still want to compare everything and choose for myself.

But if I need vacuum-cleaner bags, why shouldn't I send an agent to buy them?

That's not exactly an emotional shopping experience.

Isabelle Rosière: Exactly.

Dr. Carsten Föhlisch: Isabelle, thank you very much.

One final question.

What would you like to see from business — including companies such as Trusted Shops — in the fight against fake shops?

What can we do, or what are we already doing well?

Isabelle Rosière: I think your overall approach already does a lot.

And you've been doing this for a long time — 25 years, if I remember correctly?

Dr. Carsten Föhlisch: Exactly.

Isabelle Rosière: So we've both been working in this field for quite a while.

Even if agentic shopping and similar developments aren't mainstream yet, they will come.

The important thing is to engage with them early and accept responsibility.

Of course companies want to sell products, operate commercially and make profits.

But we need to recognise that this only works as a shared system.

Responsibility cannot lie solely with the consumer.

Technological solutions and innovation also need to be considered from the perspective of users.

And I think it's extremely important to conduct that discussion openly, with all the pros and cons.

Technology companies often say, "Everything is wonderful, this is all going to be fantastic."

But there are always two sides.

We need to talk about both of them openly.

And from the perspective of Deutschland sicher im Netz, we want to find companies that actively engage with us.

That may mean developing their own initiatives together with us, or helping us communicate more broadly.

As a non-profit organisation, we simply don't have the reach or budget to run a huge nationwide advertising campaign.

That costs a lot of money.

So we don't just depend on support — we explicitly want companies, including the many great companies already involved with us, to continue engaging jointly in this mission.

Dr. Carsten Föhlisch: Thank you very much, Isabelle.

We're very happy to contribute to that together.

We'll continue helping people shop more safely through our products, and you continue educating consumers.

I think that's a very strong combination.

That's it for today's podcast.

If you enjoyed the episode, give us a thumbs-up, leave us a good rating and perhaps even subscribe.

We have more exciting episodes coming in the future.

Thank you for listening.

Subscribe to Community of Trust wherever you get your podcasts.