BogusBazaar: The Fake Shops That Stole Card Details Before Taking Payment

A checkout page that fails after you've already entered your card number can feel like a minor inconvenience — the payment didn't go through, so nothing happened. In 2024, researchers showed that assumption is exactly what a large-scale fraud operation was counting on.

Security Research Labs (SRLabs) disclosed a sprawling fraudulent e-commerce operation they named BogusBazaar. Researchers linked more than 75,000 domains to the network and estimated that more than 850,000 people, mostly in Western Europe and the United States, had already been affected.

The storefronts themselves looked ordinary. They advertised shoes and clothing from recognizable brands at prices low enough to catch attention, built on the kind of e-commerce software real small retailers use every day. Researchers found the shops were mainly built using the WooCommerce plugin for WordPress, a legitimate platform, deployed semi-automatically at a scale one operator could never manage by hand.

Two details made the sites harder to dismiss on sight. Many used domains that had previously belonged to real, unrelated websites and had built up a normal browsing history and search-engine reputation before being repurposed for fraud — a used domain doesn't carry the same instant suspicion as one registered yesterday. And the operation wasn't a single storefront run by a single scammer: SRLabs described a structure where a core group built and maintained the underlying infrastructure, while a separate, decentralized network of operators ran individual shops on top of it. A single server was typically able to support around 200 storefronts, with some running closer to 500 — the kind of capacity that turns online shopping fraud into scalable infrastructure rather than a one-off scam page.

SRLabs documented two distinct fraud techniques running through the network. The first, card harvesting, used fraudulent payment pages to collect a shopper's contact details and card information directly. The second, fake selling, took a customer's payment for merchandise that generally never arrived — though researchers noted that in some cases, shoppers received cheap counterfeits instead of nothing at all.

What makes this network worth understanding isn't either technique alone — it's that researchers found the two could run one after another, against the same shopper, in the same checkout. A victim entered their card details into a spoofed payment page. That page then displayed an error and forwarded the shopper to a genuine, working payment gateway to actually process a charge. By the time the second, real payment screen appeared, the card details had already been captured on the first one.

That sequence is the reason a failed payment on an unfamiliar site can't be assumed harmless. The visible failure and the actual theft of your card details were two separate events, and only one of them showed up on screen. SRLabs estimated the network's aggregate order value at more than $50 million since 2021 — a figure that describes the value of orders placed through the network, not a confirmed total of money stolen, since the researchers themselves noted that not every attempted payment succeeded.

Nothing about BogusBazaar required breaking into a bank or a retailer's systems. It relied on shoppers treating an unfamiliar storefront the same way they'd treat a store they already trust. A few habits close that gap:

• Verify an unfamiliar seller independently before paying — search for the store's name outside the store itself, rather than relying only on what the site says about itself.
• Don't treat a padlock icon or HTTPS as proof a business is legitimate. Encryption protects the connection between you and the site; it says nothing about who's actually receiving what you type.
• Be cautious of steep discounts from a store you've never heard of, especially when the page also pushes urgency — a countdown timer, '3 left in stock,' or a deal that expires today.
• If a checkout page errors out after you've already entered card details on an unfamiliar site, don't assume nothing happened. Contact your card issuer and watch your statement, the same way you would after a suspected leak.

• Security Research Labs (SRLabs) — "BogusBazaar: A criminal network of webshop fraudsters," srlabs.de/blog/bogusbazaar (primary investigation)
• BleepingComputer — "Massive webshop fraud ring steals credit cards from 850,000 people," May 8, 2024
• Infosecurity Magazine — "Fake Online Stores Scam Over 850,000 Shoppers," May 9, 2024