Consumer group Which? has warned online shoppers to be wary of tens of thousands of fraudulent websites impersonating major retailers such as Tesco and Amazon. New research identified more than 28,000 unsafe website addresses during January, all designed to harvest personal information under the guise of trusted brands.
The most common tactic, known as ‘typosquatting’, involves scammers registering domain names that are common misspellings or mistypings of well-known companies. Unsuspecting visitors who accidentally land on these pages are presented with lookalike sites that prompt them to enter sensitive data. Among the most impersonated brands were Amazon, Google, Microsoft, Gemini and ChatGPT, reflecting the growing popularity of AI services.
Which? conducted the research in partnership with technology firm Decodo. Separate findings revealed that ‘digital squatting’ scams have risen by 68 per cent since 2021, with disputes over domain names reaching 6,200 last year, according to the World Intellectual Property Organization.
One example highlighted by Which? involved a scam text pretending to be from Tesco, offering recipients a ‘2026 reward program’. The link led to a page showing 12,379 points redeemable for items such as phone chargers and furniture, before asking for a full name, email address and home address – details commonly used for identity fraud. The fraudulent site was created in March 2026, a tell-tale sign that it was not genuine.
Amazon was also targeted, with a fake page mimicking the retailer’s login screen to capture email and phone numbers. Another example impersonated Boots, offering customers a survey in exchange for five skincare products, yet again a method of harvesting private information.
Rocio Concha, Which? head of policy and advocacy, called on online platforms to proactively scan content for signs of fraud under the Online Safety Act, and urged telecoms companies to identify and block text messages containing links to known scam websites.
