Is online shopping safe in 2026? What our store scans found

Is online shopping safe in 2026? What we found after scanning thousands of online stores

Black Friday falls on 27 November this year, and many shoppers will buy from stores they have never heard of. So, is online shopping safe in 2026? Mostly, yes. But one in four online stores that went through the PCrisk Website Scanner this year got a warning, and the risky ones looked surprisingly alike.

This article shares what we found after scanning 2,926 online stores: how many passed, what the flagged stores had in common, and what the wider 2026 data says about fake shops. It ends with a short check you can run before you pay.

Check a store with PCrisk Website Scanner

Table of Contents:

• Introduction
• Key findings
• What we scanned and how
• Most stores passed, one in four did not
• Brand-new domains carry most of the risk
• Thousands of products on a site that is days old
• Copied policies and borrowed brand names
• Why a clean antivirus result is not enough
• Some domain endings carry more risk
• What the wider 2026 data says
• Before Black Friday: 5 checks before you pay
• Run an online store? Make it easy to trust you
• In closing
• Frequently asked questions (FAQs)

Key findings

• Most stores passed. 73.8% of the 2,926 online stores in our data scored 70 or higher and got no warning.
• One in four did not. 26.2% were rated suspicious, dangerous, or phishing. Among stores that people checked three or more times, 44% got a warning.
• New domains carry most of the risk. In a sample of flagged stores, 71% used a domain registered less than 30 days earlier. The median flagged store was 9 days old.
• Fake stores are built in bulk. A third of the flagged stores listed over 1,000 products on a domain only days old, and 17% used return or privacy text copied from another store.
• Antivirus engines catch only part of it. 72% of the flagged stores had no antivirus engine detection at all. Other checks, such as domain age and page content caught them.
• The domain ending matters. 48% of .shop stores got a warning, compared with 27% of .com stores and 6% of .co.uk stores.

[Back to Table of Contents]

What we scanned and how

The PCrisk Website Scanner checks a website from the outside. It runs the address through more than 90 antivirus engines and threat databases, checks the domain's age and certificate, scans the page code for injected scripts and redirects, and, for online stores, looks for common signs of a fake shop. The result is a trust score from 0 to 100.

Between April and 9 November 2026, the scanner checked 37,898 different websites in 62,289 scans. We counted each website once and kept the 2,926 that are online stores. To see what the flagged stores had in common, we then took a random sample of 260 flagged stores and 150 stores with no warnings, all scanned between September and November, and reviewed the reasons for each score.

Two things to keep in mind. First, people usually scan a store because something about it made them unsure, so these stores lean toward the risky side compared with the web as a whole. Second, the scanner has recently started automatically checking newly registered stores, so very new stores appear more often in the last few weeks of data. A warning means a store showed signs of risk. It does not prove that the store is a scam.

[Back to Table of Contents]

Most stores passed, one in four did not

Of the 2,926 online stores, 2,160 (73.8%) got no warning. Another 579 (19.8%) were rated suspicious, 153 (5.2%) dangerous, and 33 (1.1%) phishing. The average store scored 73.6 out of 100.

So the honest answer to "is online shopping safe" is that most stores people check are fine, but one in four is not one you should pay for without looking more closely. The share was higher for stores people kept coming back to: of the 151 stores scanned three or more times, 44% received a warning. A store that many different people feel the need to check is often one that gives them a reason to doubt it.

[Back to Table of Contents]

Brand-new domains carry most of the risk

The clearest pattern was age. In our sample, the median flagged store had a domain registered just 9 days before the scan, and 71% were under 30 days old. Only 10% had been around for three years or more.

Stores with no warning were older: their median age was 30 days, and 29% were three or more years old. They are young too, because the sample includes new stores the scanner checked automatically, which shows that a new domain alone does not make a store bad.

The reason age matters is simple. Many fake shops do not live long. They run ads for a few weeks, take orders, get reported and disappear, and the same people open a new one on a new domain. An honest store that has been selling for years leaves a trail; a store that appeared last Tuesday has not had time to do so.

[Back to Table of Contents]

Thousands of products on a site that is days old

A third of the flagged stores (33%) listed more than 1,000 products on a domain only days old. A real new business usually starts with a few dozen products and adds more over months. Fake stores are often built from a template and filled with an imported catalog in one go: clothes, shoes, kitchen gadgets and garden tools in the same shop, all at a discount.

You can spot this yourself. If a store you have never heard of sells everything, has hundreds of product pages, and its "About us" page says it has served customers for years while the domain is weeks old, treat it as a warning sign.

[Back to Table of Contents]

Copied policies and borrowed brand names

17% of the flagged stores used return, shipping, or privacy text copied from another store, sometimes with the other store's name still in it. Real stores write their own policies, or at least fill in their own name. Copied text is a sign that the store was assembled quickly and that the "30-day returns" promise may not be backed by anyone.

Another 15% looked like they were imitating a known brand: the same name, logo style, or products, on a domain the brand does not own. Among the names we saw were Chanel, BOSS, AliExpress, Vinted, and Studio Ghibli merchandise. Brand imitation is especially common before big sales, when shoppers search for "official store" deals.

A quick test for both: copy one sentence from the store's returns page, put it in quotes, and search for it. If the same sentence appears on dozens of other shops, the policy is not the store's own. For brands, open the brand's official website via a search engine, not from an ad, and check whether it links to the store or lists it as a reseller.

[Back to Table of Contents]

Why a clean antivirus result is not enough

Only 28% of the flagged stores were flagged by at least one antivirus engine, and 15% by two or more. Among stores with no warning, 4% had one engine detection, and none had two. Blacklists showed the same picture: 10% of flagged stores were listed in a threat database, compared with 1% of stores with no warning.

Put the other way round, 72% of the flagged stores had no antivirus detection at all. That is not a failure of antivirus engines. A fake shop that opened nine days ago has not yet been reported, so it is not on any list. It gets caught by other signs: the domain's age, the size of its catalog, copied text, and what the page itself shows. This is why a store check should look at more than one thing, and why "no virus found" on its own does not mean "safe to buy from".

[Back to Table of Contents]

Some domain endings carry more risk

Almost half (48%) of the 243 stores on .shop domains got a warning, compared with 27% of .com stores and 6% of .co.uk stores. The .shop ending is cheap and easy to register in bulk. In June 2026, Sansec uncovered a network of 5,714 fake storefronts on .shop domains that imitated hundreds of brands.

That does not make every .shop store a scam. More than half of the .shop stores in our data passed, and plenty of honest small businesses use the ending. Treat the domain ending as one signal among several, not as a verdict.

[Back to Table of Contents]

What the wider 2026 data says

Our scans show which stores look risky. Official reports show what happens when people buy from them, and the picture for 2025 and 2026 is the same everywhere: more people report shopping fraud, and fake stores are being built faster than before.

Two things stand out. First, many fake stores now reach shoppers through social media ads, not search, so a store you meet in your feed deserves the same check as one you find yourself. Second, real stores can be abused too: card skimmers hide in genuine checkouts, and in October 2026 a Shopify checkout hijack sent shoppers on real stores to fake payment pages. A familiar name lowers the risk, but it does not remove it.

[Back to Table of Contents]

Before Black Friday: 5 checks before you pay

Our full guide, How to check if a website is legit before you buy, covers every step. If you only have a minute, run these five checks on any store you have not bought from before:

1. Scan the store. Paste its address into the PCrisk Website Scanner. It shows the domain's age, antivirus and blacklist results, and store-specific warning signs in one report.

2. Check how old the domain is. A store that claims years of experience on a domain registered a few weeks ago is a red flag.

3. Search one sentence from the returns policy. Put it in quotes. If it appears word-for-word on many other shops' policies, the store did not write its own policy.

4. Find the brand's official site yourself. Search for the brand and open its site from the results, not from an ad, before trusting an "official outlet" or a huge discount.

5. Pay with a card or PayPal, and watch the payment page. Both let you dispute a charge. Never pay by bank transfer, gift card or crypto to a store you do not know. When you reach the payment page, check that the address still belongs to the store or a payment provider you recognize.

If something feels off, close the tab and buy elsewhere. A deal is never worth handing your card details to a store that cannot show who runs it.

Check a store before you buy

[Back to Table of Contents]

Run an online store? Make it easy to trust you

Our data has an awkward side for honest store owners. Shoppers are learning to distrust young domains, unfamiliar endings, and big discounts, and a legitimate new store can tick all three. Scam stores also copy the trust seals used by real stores, so a badge image alone no longer convinces careful buyers. We explain the difference in Trust badges: real ones vs. pictures.

The fix is to give shoppers something they can check. Write your own policies, show a real address and contact details, and use a trust badge that links to a live, dated report instead of a static image. The PCrisk Trust Badge does this: PCrisk scans your store from the outside every day, and the badge on your site opens your store's current security report. If a scan finds a problem, you get an email so you can fix it quickly.

Get the PCrisk Trust Badge

[Back to Table of Contents]

In closing

Online shopping in 2026 is mostly safe, and most of the stores people check pass. The risk sits in a small, recognizable group: stores on brand-new domains, often on cheap endings, with huge imported catalogs, copied policies and borrowed brand names, and usually not yet on any antivirus list. Take one minute to check a store you do not know before you pay, use a payment method you can dispute, and you avoid most of what goes wrong this Black Friday.

[Back to Table of Contents]

Frequently asked questions (FAQs)

Is online shopping safe in 2026?

Mostly, yes. In our scans, 73.8% of online stores got no warning. The risk is concentrated in new, unfamiliar stores, so check any store you have not bought from before and pay with a card or PayPal.

What are the signs of a fake online store?

The most common signs in our data were a domain registered in the last few weeks, more than 1,000 products on a brand-new site, return or privacy text copied from another store, and a name or design that imitates a known brand. Prices far below every other shop are another warning sign.

Is a new online store always a scam?

No. Many honest stores are new, and half of the stores with no warning in our sample had domains under 30 days old. A new domain is a reason to look closer, not proof of a scam.

Are .shop websites safe?

Many are. In our data, 48% of .shop stores got a warning, compared with 27% of .com stores, so it is worth checking a .shop store before you pay. But more than half of them passed.

How can I check if an online store is legit?

Scan the address with the PCrisk Website Scanner, check the domain's age, search a sentence from its returns policy, and look for independent reviews. Our guide How to check if a website is legit before you buy covers each step.

Can I get my money back if I bought from a fake store?

Often, if you paid by card or PayPal. Contact your card issuer or open a PayPal dispute as soon as possible, and report the store to the police or your national fraud reporting service. Bank transfers, gift cards, and crypto are much harder to recover.

[Back to Top]