TMCnet News

JC3 and APWG Report: Fake Shopping Websites a New and Growing Menace to Consumers
[June 12, 2018]

JC3 and APWG Report: Fake Shopping Websites a New and Growing Menace to Consumers


The Japan Cybercrime Control Center (JC3) and the global counter-cybercrime association, the Anti-Phishing Working Group (APWG), released a report today detailing the enormous, rapid growth in fake shopping websites pretending to be retail shopping sites, using data from the Japanese National Policy Agency (NPA (News - Alert)).

These "fake store" websites accounted for about 7,000 reports of consumers in Japan being victimized by the theft of money or their personal information between June 2016 and June 2017.

In order to take preemptive countermeasures against fake shopping sites, JC3 examined the reported fake stores and determined the characteristics that are common to them all. These details were used to identify new fake shopping websites that could cause additional harm to consumers. Working together JC3 and APWG combined resources to block and remove these sites.

APWG Secretary General Peter Cassidy said, "APWG is proud to have worked on this effort with JC3 and NPA, a program in which law enforcement uses data analysis to predict cybercrime - and suppress it before it happens. Seeing real-life cybercrime prevention in action is thrilling and working with our respected friends at JC3 and NPA is always an honor."

JC3's analysis of fake store websites provided insight into the common characteristics of such websites used to trick customers into believing they are visiting a legitimate retail shopping website. Those characteristics are as follows:

  • Feature 1 - A site that pretends to be a shopping site where users are automatically redirected by embedded codes in a tampered site (often by a banner ad with malicious Javascript).
  • Feature 2 - a site that pretends to be a shopping site which changes the content to deceive users, such as a company profile that changes when new visitors arrive from different points of origination on the Web.
  • Feature 3 - A site pretending to be a shopping site that does not have a description of an authorized company profile, either missing altogether or clearly fictional. (For commercial transactions, Japanese law requires a company outline and description).

This new report, published jointly by JC3 and APWG, an international non-profit organization fighting cybercrime and fraud, details the facts on fake shopping sites found in these analysis and surveys.

According to this report, in the future APWG will identify fake shopping websites as a specific category of cybercrime website, different and distinguishable from a typical phishing website or a malware-dropping website. Further, APWG will promote this new definition of fake store among industry correspondents and cybercrime reporters to ease discussions durin investigations and to be clear in warning retail shoppers and enterprises that encounter fake store websites.



APWG already categorizes 'Fake Store' as a specific kind of malicious website that employs a domain name for a fictional company purporting to serve either retail customers or enterprise clients. That category is used to distinguish fake shopping and fake business-to-business websites within the APWG eCrime eXchange (eCX) via a malicious_domain API endpoint.

APWG will convene its members to establish and publish a formal definition of "Fake Store" that will encompass both fictional retail shopping websites as well as fake stores used to defraud businesses, industrial enterprises, farmers and individual business owners.


"JC3's report is a milestone in defining fake stores. It comes at a time when APWG correspondents globally are reporting increasing numbers of fake stores. These sites are targeting businesses, manufacturers and farmers using alluring catalogues of non-existent goods at provocative discounts. It's time to update our formal glossary to ease communication between industry interveners, the targeted victims and law enforcement about this burgeoning threat," said Mr. Cassidy.

APWG expects that JC3's contributions will be of great use for all countries and regions that have to manage the threats of retail and enterprise fake store websites. This report will contribute to alleviation of this new cybercrime threat with the same analytic methods in each country that experiences it.

About the APWG

The APWG, founded in 2003 as the Anti-Phishing Working Group, is the global industry, law enforcement, and government coalition focused on unifying the global response to electronic crime. Membership is open to qualified financial institutions, online retailers, ISPs and Telcos, the law enforcement community, solutions providers, multi-lateral treaty organizations, research centers, trade associations and government agencies. There are more than 2,200 companies, government agencies and NGOs participating in the APWG worldwide. The APWG's <www.apwg.org> and <education.apwg.org> websites offer the public, industry and government agencies practical information about phishing and electronically mediated fraud as well as pointers to pragmatic technical solutions that provide immediate protection. The APWG is co-founder and co-manager of the Stop. Think. Connect. Messaging Convention, the global online safety public awareness collaborative <https://education.apwg.org/safety-messaging-convention/> and founder/curator of the eCrime Researchers Summit, the world's only peer-reviewed conference dedicated specifically to electronic crime studies <www.ecrimeresearch.org>. APWG advises hemispheric and global trade groups and multilateral treaty organizations such as the European Commission, the G8 High Technology Crime Subgroup, Council of Europe's Convention on Cybercrime, United Nations Office of Drugs and Crime, Organization for Security and Cooperation in Europe, Europol EC3 and the Organization of American States. APWG is a member of the steering group of the Commonwealth Cybercrime Initiative at the Commonwealth of Nations. Among APWG's corporate sponsors are: Among APWG's corporate sponsors include: AhnLab, Area 1, AT&T (T), Afilias Ltd., Avast!, AVG Technologies (News - Alert), Axur, Baidu Antivirus, BANDURA Systems, Bangkok Bank, BBN Technologies, Barracuda Networks, BillMeLater, Bkav, Blue Coat, BrandMail, BrandProtect, Bsecure Technologies, CSC Digital Brand Services, Check Point Software Technologies, Claro, Cloudmark, Comcast, CrowdStrike, CSIRTBANELCO, Cyber Defender, CYREN, Cyveillance, DNS Belgium, DigiCert, Domain Tools, Donuts, Duo Security, Easy Solutions, PayPal, eCert, EC Cert, ESET, EST Soft, Facebook, FeelSafe Digital, FEBRABAN, Fortinet, FraudWatch International, F-Secure (News - Alert), GetResponse, GlobalSign, GoDaddy, Google, Hauri, Hitachi Systems, Ltd., Huawei, ICANN, Identity Guard, Infoblox, IronPort (Cisco), Infoblox, Intel (INTC), Interac, IT Matrix, iThreat Cyber Group, iZOOlogic, KnowBe4, LaCaixa, Lenos Software, LookingGlass, MX Tools, MailChannels, MailJet, MailChimp, MailShell, MailUp, MarkMonitor (TRI), Melbourne IT, MessageLevel, Microsoft (News - Alert) (MSFT), MicroWorld, Mimecast, Mirapoint, NHN, NZRS, MyPW, nProtect Online Security, Netcraft, Network Solutions, NeuStar, Nominet, Nominum, NZRS Limited, Public Interest Registry, Panda Software, Phishlabs, PhishMe, Planty.net, Prevalent, Prevx, Proofpoint, Psafe, RSA Security (EMC), Rakuten, RedMarlin, Return Path, RiskIQ, RuleSpace, SalesForce, SecureBrain, SendGrid, S21sec, SIDN, SilverPop, SiteLock, SnoopWall, SoftForum, SoftLayer (News - Alert), SoftSecurity, SOPHOS, SunTrust, SurfControl, Symantec (SYMC), TDS Telecom, Telefonica (TEF), ThreatSTOP, TransCreditBank, Trend Micro (TMIC), Trustwave, UITSEC, Vasco (VDSI), VADE-RETRO, VeriSign (VRSN), Wombat Security Technologies, ZIX, and zvelo.


[ Back To TMCnet.com's Homepage ]