76,000 fake shops uncovered: the industrial scale of global e‑commerce fraud.

# Community of Trust — Bogus Bazar with Matthias Marx

Jean-Marc Noël: How do you explain that? How should we imagine the way this network operates and functions?

Matthias Marx: The network is organised like a real company. There is a clear division of roles and labour.

There is one department responsible for operating the servers. There is another department responsible for stealing data from genuine webshops and pulling things such as product images from them.

We also saw that there are two people who regularly receive payouts from this network. To us, even today, they are only known in Chinese as Mr. Black and Mr. White.

Jean-Marc Noël: Community of Trust, the podcast. Today with Matthias Marx, Pentesting Team Lead at Security Research Labs.

Welcome to Community of Trust. Today's episode is a particularly special one.

I'm Jean-Marc Noël, co-founder and CEO of Trusted Shops, and today I'm speaking with Matthias Marx from Security Research Labs, an outstanding cybersecurity expert.

Matthias, you've done something remarkable. You uncovered a network called Bogus Bazar.

Tell us a little about it. What exactly is it?

Matthias Marx: Hi, and thanks for inviting me.

Bogus Bazar is a network that operates fake shops on the internet on a large, industrial scale.

My team and I stumbled across it more or less by accident, and we had the opportunity to go very deep technically and understand how this illegal network works.

Jean-Marc Noël: How did you come across it?

You say you stumbled upon it. What's the story behind the discovery?

Matthias Marx: It wasn't planned at all.

One of my hobbies, and it has been for many years, is looking for data leaks on the internet.

It's a little like walking down a street, checking which doors are standing open, and then also looking at what's inside those houses — except I'm doing it with servers on the internet.

In doing that, I find plenty of real data leaks at real companies. I report them, the companies close the leak, and sometimes we write about it. That's usually the end of the story.

But then I came across similar datasets belonging to one group that I didn't understand.

All I could see at first was data from webshops lying around.

Those webshops all looked well designed. There were thousands of them from the start, so I knew immediately that this was something large.

At first I didn't really understand what was happening with those shops. I didn't even know yet that they were fake shops.

I could only see that someone was putting a huge amount of effort into operating websites that all looked different but shared the same technical foundation and the same kind of data leak.

Jean-Marc Noël: That's incredible.

So once you'd looked at it and realised something was wrong, how did you proceed? What did you actually do?

Matthias Marx: At first I simply downloaded data from one of these leaks.

It contained the technical infrastructure of a webshop — in this case, a WordPress installation with various plugins and source code.

And there were additional modules that you wouldn't normally find in a standard WordPress installation or ordinary webshop.

There were already direct indications that credit-card data might be leaking because functions had specifically been programmed for that.

Then, for quite a while, the investigation didn't go any further.

Jean-Marc Noël: Before we dive into the technical details, let's establish the scale.

What are we actually talking about here?

Matthias Marx: In the end, we uncovered a network of more than 76,000 fake shops.

Jean-Marc Noël: 76,000 fake shops?

Matthias Marx: Yes. They had operated those over a period of about three years, and they had already been active before that.

When we went public, more than 20,000 were online at the same time.

Jean-Marc Noël: That's unbelievable.

You also said this is an international network.

Where is its focus? Is it operating globally?

Matthias Marx: The network is very clearly operated out of China.

But the webshops primarily target the European market, especially Western Europe, and also the United States.

Jean-Marc Noël: What kinds of fake shops were they? Can you give us examples so people can picture it?

Matthias Marx: Many of them sold things like shoes or clothing — products costing less than €100.

Presumably that's because people are less likely to go to the police if only €50, €60 or €70 has been stolen.

Jean-Marc Noël: Which is interesting, because that's roughly in the range of the average shopping basket in Germany as well.

When you realised that something wasn't right and kept digging, you found 76,000 shops.

That obviously requires infrastructure. This is no longer somebody in a basement building a couple of fake shops as a hobby. It has professional dimensions.

How should we imagine the way the network operates?

Matthias Marx: It really is organised like a company.

There is a strong division of labour.

One department operates the servers.

Another steals data from genuine webshops and extracts things like their product images.

Another department looks for suitable new domains for future fake shops and registers them.

Jean-Marc Noël: And when you say it's like a company, do they operate all of this themselves?

I could imagine this becoming a business model in its own right, where someone says, "I'd like to have a fake shop. How does that work?"

Matthias Marx: There are strong indications that one group provides the core infrastructure as a service, and that other people then buy the fake-shop infrastructure as a service and run their own businesses on top of it.

Jean-Marc Noël: So essentially something like fake-shop-as-a-service.

And because the network is run from China, they obviously still use infrastructure and services elsewhere.

How does that work?

Matthias Marx: The "fake-shop company", if you want to call it that, has servers just like other webshop companies.

They hide their servers behind Cloudflare. Plenty of legitimate companies do that too.

They use services such as PayPal and Stripe.

They use Google to evaluate how well their domains are performing.

So in many ways it looks like a completely real webshop business — except the goods are never delivered.

Jean-Marc Noël: If I land on one of these sites, are there still signs that tell me it's fake?

Matthias Marx: There are very few signs.

Some of the shops eventually had bad reviews.

But the groups monitored performance.

As soon as sales started falling, they would probably just move to the next domain.

That is also why they maintained so many domains at the same time.

Jean-Marc Noël: So they didn't necessarily keep improving the same site.

It really sounds almost like software-as-a-service: you buy the service, perhaps even get marketing support, and operate your fake shop.

Is that a fair way to imagine it?

Matthias Marx: Probably, yes.

There were even manuals describing how to operate the webshop most effectively and how to write descriptions so that more people would buy.

Jean-Marc Noël: Incredible.

You discovered Bogus Bazar in 2024.

Since then, we've seen an enormous evolution — almost a revolution — in AI, especially generative AI.

What does that mean for networks like this?

Matthias Marx: In future, it will become even easier to build even better fake shops.

But it's important to say that this group was already very good before generative AI.

Even without AI, they had already automated almost the entire process end to end. There wasn't that much left to do manually.

Now it will simply get easier.

Product images may become even better.

And the company behind the network that we identified in China may also be able to reduce staffing because AI can generate logos or make other production processes more efficient.

Jean-Marc Noël: Imagine I'm an online retailer and suddenly my own webshop has been copied.

What can I do?

Matthias Marx: It appears to be worth going to a lawyer and trying to get the domain blocked, or making sure that a service such as Cloudflare can no longer hide the infrastructure.

That seems to be one of the few measures that actually works.

And apparently it has an effect when brands do this consistently.

The fake-shop group maintains an internal blacklist containing brands they are not supposed to use.

So, for example, if you wanted to offer Rolex, the system might effectively tell you not to use that brand because Rolex is more aggressive about protecting it.

That suggests it's worthwhile defending your brand consistently.

Jean-Marc Noël: You've uncovered Bogus Bazar with your team.

You've also spoken with other organisations about it.

Even if the network originates in China, it uses infrastructure all around the world.

Can these people actually be stopped?

Matthias Marx: I believe the police could stop them.

We packaged up all the information we had.

We've spoken with the FBI, with authorities in the UK and France, and we've provided information to German authorities as well.

Jean-Marc Noël: So you've done the whole programme.

And still nothing happened?

Matthias Marx: At least the group is still operating.

Jean-Marc Noël: Why do you think that is?

Is the case simply too complicated? Or is it because this is an international organisation and therefore difficult for national authorities to tackle?

Matthias Marx: That's a good question. I'd like to know too.

One reason may be that there are so many individual cases.

The individual affected consumer may not even ultimately bear the financial loss.

If I pay somewhere by credit card and the goods don't arrive, I may be able to reclaim the money from my bank.

For the bank, the individual case may then simply be too small to justify a major investigation.

But for this one group alone, we're talking about damage over three years that is certainly in the seven-figure range and possibly even eight figures.

The problem is that this is distributed across banks throughout Western Europe.

For each individual bank, the amount may not appear large enough.

Jean-Marc Noël: So fragmentation is almost part of the business model.

Each individual loss is small enough that there isn't much incentive for anyone to act.

But the wider damage still exists.

If people no longer know what is real and what is fake, that doesn't only affect the fake shops — it damages legitimate shops too.

It undermines trust.

Matthias Marx: It certainly contributes to people staying with large platforms.

If you've had bad experiences with smaller shops two or three times, you may eventually decide to buy only from the largest platforms.

And in our data, we actually saw people placing orders two or three times — sometimes across different fake shops — because there were so many websites.

Jean-Marc Noël: So some people fell for it repeatedly.

How many consumers were affected?

Matthias Marx: At least 850,000.

Probably more.

Jean-Marc Noël: What happens to the individual consumer?

Matthias Marx: First, when they pay, perhaps €60 is charged to their credit card for a pair of shoes.

The goods never arrive.

We saw emails where people complained. Sometimes they received an answer, sometimes they didn't.

But initially, the €60 is gone.

And then there is the data.

Their address data and credit-card data have also been handed over.

In one test purchase, we saw that roughly a month later, other actors tried to misuse the credit-card details.

So the victim's data may effectively be monetised more than once.

Jean-Marc Noël: Potentially sold on again somewhere in the dark web?

Matthias Marx: We didn't have direct visibility into that.

But if you're a criminal and you have valuable data, naturally you want to monetise it.

Jean-Marc Noël: You mentioned Cloudflare, PayPal and Stripe.

Are there warning signs consumers should look for during the payment process?

Matthias Marx: One thing that was very noticeable with PayPal was that they did not use the normal merchant-payment function.

Instead, users were asked to transfer money using the friends-and-family option.

That was suspicious.

Another sign is that during checkout, you're sometimes redirected to a completely different website, occasionally with a domain that doesn't sound particularly trustworthy.

But overall, it's relatively unobtrusive.

It looks like any other webshop.

Jean-Marc Noël: If you could choose measures to take tomorrow based on everything you've learned, what would you want to happen?

Matthias Marx: First, I'd want the police to take down the infrastructure that is at least located in Europe — and ideally go beyond that.

Second, it would help if more brands, especially the larger ones, took active steps to protect their brands from being used in fake shops.

Jean-Marc Noël: That's something brands can act on.

At Trusted Shops, for example, we protect our own brand.

That works quite well, including through cooperation with infrastructure providers and ISPs.

Sites or companies that misuse our brand can sometimes be stopped directly at the source.

So for online retailers, if you notice that your brand is being abused or that a fake shop is displaying your products, taking action can absolutely be worthwhile.

Let's look further into the future.

We're entering a world in which an online retailer's next customer may no longer be a human but an AI agent.

The agent will visit websites just like a human does.

If the website is fake, that can become a problem for the consumer as well.

What can we do in this new AI world to protect ourselves from fake shops and fake networks?

Matthias Marx: Trust is definitely going to become an increasingly important problem, regardless of whether AI is involved.

We may even take a step backwards on the internet.

Instead of relying entirely on search engines, where anyone can put almost anything online, we may move back towards something more like curated web directories — directories of trusted shops.

Operating an anonymous fake shop that simply never delivers has become too easy.

Jean-Marc Noël: That's striking, because you've spoken to authorities not only in Germany but also in France, the UK and elsewhere, and yet the network is still operating.

If I'm a consumer hearing that, I might feel even less secure.

What should someone do if they realise they've become a victim?

Matthias Marx: They should still definitely go to the police.

Even if the police may have done too little so far, I think investigative pressure would increase if more victims actually reported their cases.

We worked with several newspapers when we published our findings. Those journalists spoke with victims, and practically none of them had gone to the police.

That naturally doesn't help create pressure to investigate.

So report every individual case.

And if you've entered your credit-card details or a password into one of these sites, never use that password again.

If you've reused it elsewhere, change it there too.

And get a new credit-card number.

Jean-Marc Noël: Immediately.

How does this continue for you and your team?

Are you now constantly searching for more fake-shop networks?

Matthias Marx: The fake-shop story actually has relatively little to do with my normal day-to-day work.

Usually, companies hire me and pay me to break into them as part of authorised security testing.

The work on these fake shops was effectively something we did unpaid — as a hobby.

Jean-Marc Noël: As a hobby.

Matthias Marx: Exactly.

And it remains a little bit of a hobby.

Because I've had such deep access and the network is still online, I still look into it from time to time.

I can't quite keep my hands off it.

But I'm also less motivated to go significantly deeper now.

Even if I discover more, I have doubts that authorities would act quickly — so I have to ask myself why I should keep investing so much time.

Jean-Marc Noël: It's an extremely complex case.

The people behind it have built something very sophisticated.

This isn't someone playing around in their basement.

We're talking about companies and professional structures that know exactly what they're doing.

Even the fragmentation protects them to some extent, because police authorities already have a huge workload.

A €100 or €200 individual case may not look like a priority, even though the total damage is enormous.

But what you're doing is important because trust is the foundation for people, businesses and society.

If I no longer know what is real and what isn't, how can I trust anything at all?

You've repeatedly emphasised that Bogus Bazar is one network.

Presumably there are more out there that haven't yet been discovered.

Matthias Marx: We know there are more.

After our publication, other researchers contacted us because they were monitoring other networks.

I've also seen that the programmer involved in our network works for others too.

There are different groups of fake shops out there whose infrastructure looks very similar at the core because it was programmed by the same person.

Jean-Marc Noël: If a business model works, it can be replicated.

If you had a magic wand, what would you most like to find out or change next?

Matthias Marx: I'd still like to find out exactly who is behind this fake-shop network.

We've discovered a great deal.

We identified a company.

We saw employment contracts.

We saw employee performance reviews.

It was all extremely interesting.

But we also saw that two people regularly receive payouts from the network.

To us, even today, they are only known in Chinese as Mr. Black and Mr. White.

I'd like to know more about them.

Jean-Marc Noël: That would mean going even deeper.

It probably isn't entirely without risk.

Have you taken precautions for your own safety?

Matthias Marx: It wasn't the first politically sensitive case I've researched.

And I've been back to China since then — I entered the country and I also left again.

Jean-Marc Noël: Getting back out is the important part.

Are there materials or resources you'd recommend to online retailers who want to learn more about these issues? Books, blogs, tools?

Matthias Marx: First, I think it's good to trust your own judgement.

If an offer sounds too good to be true, it probably is too good to be true.

Beyond that, there are various platforms that maintain lists or directories of fake shops.

We shared our data with consumer-protection organisations as well.

Jean-Marc Noël: What about more technical resources for retailers who are technically interested and want to dig deeper?

Matthias Marx: I don't really have one specific recommendation.

This topic is too far removed from my normal day-to-day business.

Outside this investigation, I haven't historically had much to do with webshops except as a customer.

Jean-Marc Noël: By now, you could almost be called an expert on them.

What you've done is remarkable, especially because this investigation wasn't your core job.

I wish you every success in finding out who Mr. Black and Mr. White really are — and please take care of yourself.

I found what you've told us today about Bogus Bazar extremely illuminating.

It's an international network, and I hope we can continue talking publicly about this kind of activity so that more of it becomes visible.

And one final point.

You mentioned directories of trusted shops.

This question has occupied us for a long time as well: how can we know that the shop or website we're visiting is genuinely the real one?

I've landed on sites myself where I thought: I wish there were a way to know automatically, without having to investigate it myself, that this is really the genuine website.

That's why we've built a solution.

Within our Community of Trust, we have more than 30,000 verified websites used by millions of consumers.

And with #trstd Login, we provide a way for users to verify that they're actually on the genuine website.

It's a small switch. When it's activated, the user can verify the site and receive that reassurance.

That's one reason I find this conversation so inspiring.

We want to provide a solution to exactly this problem.

The fake problem isn't a small issue. It's a very large one, and as you've explained, it's getting bigger.

So we need to keep working on solutions.

Matthias, thank you very much for coming and for this conversation.

Matthias Marx: Thank you for the invitation. It was a great pleasure.

Community of Trust. Subscribe wherever you get your podcasts.