Online scams are no longer limited to clumsy emails filled with mistakes. New fraudulent sites use polished interfaces, deepfakes of well-known personalities, and a rapid rotation of domain names that makes detection difficult. Assessing the risk before pulling out your credit card on an unknown site requires checking several technical signals, often overlooked by hurried buyers.
Technical signals of a fraudulent site: what the infrastructure reveals
Even before looking at a site’s content, its infrastructure provides actionable clues. A site created just a few days ago, hosted on a temporary subdomain, and lacking complete legal notices accumulates risk markers.
Current fraudulent campaigns rely on a very rapid rotation of domains and subdomains, allowing them to bypass blacklists. A site can disappear in a matter of hours and reappear under a slightly modified address.
Several checks take less than a minute:
- Check the domain creation date via a Whois service: a domain registered for less than three months for a merchant site claiming to have existed for years is contradictory.
- Verify the presence of a valid HTTPS certificate, knowing that a padlock alone guarantees nothing, as free certificates are available to everyone.
- Look for legal notices, general terms of sale, and a SIRET number or equivalent: their absence is a strong warning signal.
- Check the physical address provided through a mapping search: fake sites often display nonexistent or inconsistent addresses.
On classified ad platforms, you should also beware of sites like Faljam that offer abnormally attractive deals and push to finalize the transaction outside the platform’s secure messaging.
Payment scams and phishing: comparison of techniques used
The methods of scammers vary depending on the contact channel. The table below contrasts the two main vectors observed on new sites.
| Criterion | Fake merchant site | Phishing via SMS or email |
|---|---|---|
| Entry vector | Advertising on social networks, paid search | SMS, email, message on WhatsApp |
| Immediate objective | Credit card payment on a mimicked form | Theft of credentials, banking data via fraudulent link |
| Support lifespan | From a few days to a few weeks | A few hours (link deactivated after the campaign) |
| Main warning signal | Prices significantly lower than the market, recent domain | Unknown sender, shortened or disguised URL |
| Most effective protection | Whois check + search for independent reviews | Never click on an unsolicited link |
A common point connects these two approaches: scammers seek to get the victim out of the secure framework (internal messaging of a platform, verified customer area) to redirect them to pages they control. Fake payment or delivery tracking links sometimes mimic official interfaces with frightening accuracy.
Deepfakes and fake testimonials in online advertising
The use of deepfakes involving personalities (influencers, business leaders, media experts) to legitimize offers of new services or financial placements is on the rise. A video showing a known face recommending a product no longer constitutes proof of legitimacy. Checking directly on the official accounts of the person involved remains the only reliable way to confirm or deny the endorsement.
Digital Services Act: what European regulation changes for fraudulent sites
The Digital Services Act (DSA) has been fully applicable since February 17, 2024 to all online actors operating in the European market, including new sites and digital services. This regulation imposes enhanced obligations on platforms for managing illegal content and fraudulent practices.
For consumers, the DSA introduces mechanisms for easier reporting of fraudulent content. Platforms must process these reports within set deadlines and inform the user of the follow-up provided. At the same time, the Digital Fairness Act project aims to further strengthen the protection of digital consumers.
In practice, these obligations mean that a site hosted or accessible in Europe that does not offer any reporting mechanism or information about its moderation operates outside the legal framework. This is an additional indicator of potential fraud.
Protection reflexes before and after online purchases
Security does not rely on a single gesture but on a combination of checks. Before validating a payment on an unknown site, three actions significantly reduce the risk:
- Search for the site’s name followed by “reviews” or “scam” on a search engine: feedback from other buyers usually appears within seconds.
- Prefer payment methods that offer a possibility of dispute (credit card with opposition, third-party payment services) rather than direct bank transfers, which are practically unrecoverable.
- Enable two-factor authentication on all accounts linked to a payment method, to limit the impact in case of credential theft.
After a suspicious purchase
If doubt arises after a payment, immediately contacting your bank to dispute the transaction remains the priority. Reporting on the Cybermalveillance.gouv.fr platform allows you to document the fraud and contribute to the databases used to block identified sites.
The majority of victims of online scams describe a similar scenario: an offer that is too good to be true, time pressure (“last units,” “offer valid for 2 hours”) and a payment made without verifying the seller. Manufactured urgency is the main lever of fraudulent sites. A legitimate seller does not need to force a decision in a matter of minutes.
