The Fake Shop Investigation Playbook The shop vanishes. Your case doesn't have to.

Why the first hours matter

A fake shop, also called a fake online store or scam website, is built to disappear. Consumer centres warn that shops are often deleted and relaunched at new addresses^[1]. By the time a victim notices that nothing is arriving, files a report and the case reaches a desk, there may be nothing left to look at.

STEP 01

Preserve the evidence

A screenshot on its own is weak evidence. The Berkeley Protocol, the UN-backed standard for online investigations, treats the web address, the page's source code and a full-page capture as the minimum for court use^[5]. It was written for international crimes, so treat it as a strong reference point and follow your own agency's rules first.

What to capture

Capture	Why it matters	Tip
Full web address	Identifies exactly what you saw	Copy it, do not retype it
Full-page capture	Shows the shop as a visitor saw it, including the legal notice and checkout	Capture the checkout and payment pages, not only the home page
Page source code	Holds hidden traces that later connect shops	Your browser's "save page" function is a start
Payment details	Often the best route to a real person	Note IBAN, recipient name and payment provider exactly as shown
Time, collector and method	Lets others check how the capture was made	Record your name, the time and the tools used[5]
Hash value	A digital fingerprint that proves the file has not changed since capture	Create it at the moment of capture, using the currently accepted standard[5]

Keep a simple evidence log

Chain of custody means a chronological record of who held the evidence, when, and what was done with it^[5]. It can start as simply as this:

STEP 02

Trace the domain and certificates

Every shop depends on outside companies: someone registered the address, someone hosts the site, someone issued its security certificate. Each leaves traces.

Trace	What it tells you	Limits to know
Domain lookup (WHOIS / RDAP)	Registrar, registration date and often an abuse contact	Personal owner details are often hidden from the public
ICANN RDRS	INTL A request channel for hidden registration data on domains like .com. Open to law enforcement with an ICANN account[9]	Not all registrars take part. In the pilot, 26% of requests were approved and 55% denied[10]
DENIC (.de)	DE Holder details for companies are public. For private persons only the registration date and managing member show[11]. Authorities have a dedicated request form[12]	DENIC only registers domains. It stores no content and cannot take shops offline[13]
EU registration data rules (NIS2)	EU Registries and registrars must answer lawful, justified requests within 72 hours[14]. DE In Germany this is § 50 BSIG, for authorities only[15]	The request has to be well justified
Hosting and network	Which company serves the site	Many shops sit behind Cloudflare, which is generally not the host[16]. In one network 98.6% did[17]
Certificate logs (crt.sh)	Security certificates are recorded in public, searchable ledgers[18]. They can reveal other addresses used by the same operator	A name in a log does not prove a live site. Entries can take about a day to appear[18]

Check the ad libraries (EU)

Half of the 653 fake-shop domains German consumer advocates checked in 2025 had advertised on Google or Meta^[19]. EU In the EU, very large platforms must keep a public, searchable record of their ads, including who the ad was for and who paid, until a year after it last ran^[20]. That makes these libraries a quick, free check, and no information request or special investigative measure is needed to read them.

	Meta Ad Library	Google Ads Transparency Center
Where	facebook.com/ads/library, no account needed	adstransparency.google.com, no account needed
Search for a shop	Your brand or the shop's name, or its web address in quotes as an exact phrase. There is no dedicated domain field	Advertiser name or website, so you can enter the shop's address directly[21]
Set first	Country, ad category "all ads", active and inactive	Region, then date and format
Extra detail on EU ads	Under "EU transparency": run dates, targeting, estimated EU reach, advertiser and payer	Dates shown, targeting categories, reach per location[21], advertiser name and location, payer[21]
How long ads stay	EU ads: one year after the last impression. Elsewhere, most ads only while active[22]	One year after the ad last ran. New ads can take 48 to 72 hours to appear[23]
Shows where the ad leads	Yes, the ad's link and displayed domain	No clickable links[23]

TikTok has a similar library covering the European Economic Area, Switzerland and the UK^[24].

What the libraries can give your case

• When the shop was active, and in which countries and for which age groups it advertised.
• How far it reached, which can help you estimate the number of potential victims.
• Other shops: other ads from the same advertiser can lead to sibling shops.
• Who to ask: the platform holds the advertiser's account and payment data. See step 5.

STEP 03

Follow the payment trail

Addresses are cheap to replace. Getting paid is harder, so payment details often connect shops and lead to people.

Trace	What it can tell you	Route, by country
IBAN	The first two letters show where the bank sits, not where the account holder lives. Virtual IBANs may route to an account elsewhere[26]	DE Account retrieval via BaFin under § 24c KWG shows holders and authorised persons[27]. Other countries: see the table in step 5
Foreign bank account	Holder and account activity in another EU state	EU European Investigation Order: decision within 30 days, execution within 90[28]
Suspicious transactions	Whether the money has already been flagged	DE Financial Intelligence Unit (FIU) at customs[29]. Prosecutors can obtain data on request[30]
Payment provider	Merchant account, payouts, sign-up data	See step 5
Crypto wallet	Transactions are public, but names are not. An exchange may know its customer	EU Eurojust's and Europol's SIRIUS project includes contacts for crypto exchanges[31]

STEP 04

Connect the shops into clusters

Treating each shop as a separate case hides the operator. A shop cluster is a group of shops that share something only their operator would share. The goal is to turn many small reports into one case.

How much does each link prove?

Shared trace	Strength	Why
Same bank account or merchant account	Strong	Money ends up in the same place
Same contact email or phone number	Strong	Hard to explain by chance, unless it was copied from a real company
Identical template or configuration files	Medium	Points to shared tooling, which may be sold to several groups
Same advertiser or payer in an ad library	Medium	Worth following, but the names are self-declared[33]
Same analytics or tracking ID	Medium	Suggests one account behind several sites
Same certificate	Medium	Useful, but check who manages it first
Same server address	Weak	Common in shop clusters[1], but thousands of unrelated sites can share one
Cloudflare, or a young domain	Weak	Not proof by themselves[1]

Strength ratings are a rule of thumb from investigative practice, not a legal standard. Look for at least two independent links before you call shops connected.

What real networks looked like

STEP 05

Send focused information requests

Ask the party that actually holds the data, and ask for specific items. The registrar knows who bought the address, the host knows who pays for the server, and the platform knows who opened the store.

Who holds what

Party	Likely holds	How to reach them
Registrar or registry	Registrant details, payment for the domain	Direct request, DENIC form, RDRS
Hosting company	Customer account, payment, access logs	Provider's law enforcement contact. Under the EU's Digital Services Act (DSA), providers must publish a contact point for authorities[36]
Cloudflare	Account data. It is generally not the host	lawenforcement@cloudflare.com with case number. Non-US governments preferably via a mutual legal assistance treaty (MLAT)[16]
Shopify and similar platforms	Store owner, sign-up data, payouts	Shopify's online legal access form, addressed to the correct company[37]
Google (ads, email)	Advertiser and account data	Online system for verified agencies, legal process required[38]
Meta (ads, pages)	Advertiser, page and payment account data	Online request system for law enforcement, legal process required[39]
Bank or payment provider	Account holder, transactions	See step 3

The legal instruments, in brief

The right tool depends on where you work. EU tools come first, then the same jobs under national law.

EU instrument	What it covers	Key point
e-Evidence Regulation EU	Direct cross-border orders to providers offering services in the EU. Applied since August 18, 2026, Denmark excluded[40][41]	Answer within 10 days, or 8 hours in emergencies. Preservation for 60 days. Subscriber data for all offences. Traffic and content data for offences with a maximum of at least 3 years, by a judge[42]
European Investigation Order EU	Evidence from another EU state[28]	Slower, but wider in scope

The same jobs in national law

A map for orientation, not a complete statement of each country's conditions. France and the Netherlands have adopted new criminal procedure codes expected around 2029, so article numbers will change^[72]. Check with your prosecutor.

What a good request contains

• The exact identifier: full web address, account name or IP address.
• The time window, with time zone.
• Specific data: for example account holder, sign-up date and payout account, rather than "all data".
• The legal basis and case number, addressed to the correct legal entity.
• A note on confidentiality. Shopify, for one, notifies users unless prohibited^[37], so say if notifying the customer would harm the case.
• A preservation request if the data might otherwise be deleted.

Six common mistakes

Common questions

This guide is general information, not legal advice. Tags show where a law or route applies: DE Germany, AT Austria, CH Switzerland, UK United Kingdom, US United States, FR France, NL Netherlands, EU European Union, INTL international. Laws, fees and contact routes change, so check the linked source before you rely on it.