In February 2022, Émilie H., who lives in Paris, was looking to buy a new leather handbag from the Sœur brand. After typing the name of the model she wanted into the Google search engine, she came across a site offering a tempting price: €71 for a Nottingham bag, normally sold at double the price. She placed her order, without noticing that the website address, architectes-fr.com, was suspicious. "I was less vigilant," she explained to Le Monde, at a time when she was going through a difficult period in her personal life. She never received her handbag.

Tom C., from southwestern France, had the same misfortune. Looking for a specific model of Reebok sneakers, he found an online store – Anthonybannach.com – on Google's Products tab, which seemed to be completely reliable. "I was looking for a rare color that wasn't easy to find," he explained. Luckily, the site had "just the right color and size in stock." He ordered "with complete confidence" and received a tracking number. The package was never delivered, and Tom C.'s requests for a refund went unanswered.

Emilie H. and Tom C. are far from the only ones to have been scammed. Le Monde, Die Zeit and the Guardian had access to multiple leaked documents belonging to a Chinese cybercriminal organization. The German cybersecurity firm SR Labs managed to obtain several gigabytes of internal group documents, which it shared with Die Zeit and its partners.

The figures are staggering: In four years, over 800,000 orders were placed worldwide on the criminal group's websites, including at least 170,000 by French internet users, making France the country most affected by the group's scams. Dubbed "BogusBazaar" by SR Labs, this organization put over 75,000 fake e-commerce sites online during this period, resulting in losses of several tens of millions of euros.

Fake site factory

The sites are created industrially in batches – today, over 22,500 of them are still online – and have until now operated with relative secrecy. In 2023, the cybersecurity company Yarix, a subsidiary of the Italian group Var, was the first to sound the alarm: It identified around 13,000 sites linked to a single operator, which it christened "FashionMirror." SR Labs analyses subsequently identified five times as many. All of them copy the catalogs of genuine online stores, mainly for clothes and shoes, but also for toys and furniture.

The group's internal documents shed light on how the crooks were able to create so many fake sites. Several guides, written for new employees, detail the step-by-step creation of a cloned store. With the help of specialized tools, members of the scheme actively monitor for websites that have recently closed down but enjoyed high Google rankings. They immediately purchase the domain name.

You have 71.86% of this article left to read. The rest is for subscribers only.