Network of 120+ Fake Walmart Sites Scams Shoppers for Credit Card Details
A sophisticated scam operation has deployed over 120 fake Walmart websites, luring unsuspecting shoppers with deep discounts on liquor and stealing their credit card information.
Cybercriminals have established a widespread network of over 120 counterfeit Walmart websites designed to defraud consumers by mimicking the legitimate retailer's branding. These fraudulent sites lure shoppers with enticingly low prices on popular liquor brands, offering discounts ranging from 40% to 70%. The primary objective of these fake stores is not to sell products, but to harvest sensitive credit card details, including the full card number, expiration date, and CVV code, from unsuspecting victims.
The scam leverages the strong brand recognition and trust associated with Walmart. By using identical WordPress/WooCommerce templates, the fake sites present a familiar and convincing facade, complete with the retailer's logo, colors, and layout. This visual authenticity lowers the guard of shoppers who might otherwise be suspicious of unfamiliar online stores. The deep discounts serve as the main lure, encouraging impulse purchases before consumers scrutinize the legitimacy of the website.
Each fake domain within the network employs fabricated contact information, including U.S. business addresses and phone numbers, to enhance the illusion of legitimacy. However, these details are entirely fictitious and serve only to deceive potential victims. The underlying technical infrastructure is consistent across all sites, utilizing the same product catalogs, pricing, and images, with only minor variations in the fake contact details.
Researchers at Malwarebytes Labs identified this extensive network and warn that any shopper who has entered their credit card details on one of these sites should assume their card information has been compromised. The attack vector is straightforward: a convincing Walmart-branded homepage leads to category pages featuring heavily discounted liquor, culminating in a checkout form that requests full payment card information.
To avoid falling victim to such scams, consumers are advised to be skeptical of discounts that deviate significantly from a retailer's typical promotional offers, especially for high-value items like liquor or electronics. It is crucial to verify the website's URL in the address bar before entering any payment details. Legitimate sales from major retailers like Walmart will not direct customers to unfamiliar domains, particularly those ending in less common extensions like '.shop'.
Security tools such as Malwarebytes Browser Guard can automatically block known phishing and scam websites. For mobile users, Malwarebytes Mobile Security offers similar protection by preventing access to malicious domains before they are reached. If a user suspects they have entered their card details on a fake site, they should immediately contact their card issuer to report the incident, request card cancellation, and monitor their accounts for any unauthorized transactions.
Reporting fraudulent websites through browser features and to consumer protection agencies like the FTC (in the U.S.) is also encouraged. Ultimately, the most effective defense is a healthy dose of skepticism: if an online retailer appears to rely on a lookalike domain to conduct business, it is highly likely to be a scam.