Shoppers have been warned to be aware of tens of thousands of scam websites which are impersonating big retailers such as Tesco and Amazon online.
New research by Which? uncovered more than 28,000 unsafe website addresses in January, asking visitors for personal information under the guise of trusted brands.
One of the most common methods to catch online shoppers out is called ‘typosquatting’, the consumer chamption found. This is where scammers register domain addresses that are common misspellings or mistypings of big-name companies, posing as the genuine landing page when people accidentally visit online.
Which? found Amazon, Google, Microsoft, Gemini and ChatGPT to be amongst the most impersonated brands as the popularity of AI services soars.
The research was carried out in partnership with tech company Decodo. Separate research from the group last month found that instances of ‘digital squatting’ website scams were up 68 per cent from 2021 to 2025.
Over this period, name disputes with the World Intellectual Property Organization skyrocketed, reaching 6,200 in 2025.
It is also common for people to be directed to these fake websites via a scam text claiming to represent the company, a method often called ‘digital squatting’.
One of these came from a scammer pretending to represent Tesco, who told recipients that they had ‘points’ to review as part of a ‘2026 reward program’. A link provided in the message to redeem these points by verifying a phone number.
Top tips to avoid fake websites:
- Look for typos in web addresses – a giveaway for a fake site
- Was the page created recently? You can check on who.is
- Dead links – does ‘about us’ or ‘contact us’ lead anywhere?
- Poor spelling and grammar, or low quality images
- Prices or offers too good to be true are a common giveaway
Entering a bogus number, Which? researchers found that they were sent to a page telling them that they had 12,379 points to redeem in exchange for products like phone chargers, blood pressure monitors and furniture.
Clicking one of these invited users to input their full name, email address and home address – hallmark details stolen for identity fraud.
This site was created in March 2026, another giveaway that it is fraudulent. Online shoppers who are uncertain about a website they have been directed to can check its creation date on website who.is.
Amazon is another company that scammers commonly imitate as one of the most-visited sites in the UK and worldwide. Which? identified another scam text that led to a website which looks strikingly similar to the legitimate site.
Once on the page, visitors are invited to either create a new account or log in, both requiring details like email and phone number.
Another example was a fake page pretending to be the official Boots website, which asked customers to complete a survey in exchange for five best-selling skincare products. Again, this was a sophisticated way of harvesting private information.
Rocio Concha, Which? head of policy and advocacy, said: “Criminals are always on the lookout for new ways to part people from their hard-earned cash and these copycat sites are one of the latest examples of their evolving tactics.
"Which? is calling for online platforms to proactively scan all uploaded content for signs that it might be fraudulent, as part of their responsibilities under the Online Safety Act, including links to fraudulent websites. We are also calling on telecoms companies to identify and block text messages which include links to known scam websites.”
Trump offers few details as he says data centers deal will lower electricity costs
Amazon not working for thousands of customers — follow for live updates
Amazon warehouse worker fired while recovering from surgery for hernias he got on job
What changes are coming to credit score files and what does it mean for you?
Pensioner with Alzheimer’s convicted over unpaid bill in car insurance mishap
Andrew Mountbatten-Windsor to retain City of London Freedom honour
