In February, Marketplace reported on a fake storefront calling itself the Davines North America Official Online Shop. It looked right. It carried the real brand's products and photography. It appeared as a top sponsored result on Google. The only tell was the address bar, where the domain read davineas.com rather than davines.com.

Netcraft, which tracks this sort of thing, had already counted around 100,000 AI-generated websites impersonating close to 200 brands. The economics changed because the build time collapsed. A scammer with an AI coding agent can produce dozens of convincing storefronts in a day, buy search ads against the real brand's name, and collect card details from people who did everything they were told to do except inspect the URL.

The part that should concern anyone reading this: researchers quoted in that reporting say smaller brands and ecommerce operations are increasingly the target. Large companies have legal teams and takedown contracts. A regional retailer with good products and a decent reputation has neither, and is now worth cloning.

---

The scale of it

• The FTC received more than one million imposter scam reports in 2025.

  Consumers reported losing nearly 3.5 billion dollars. The agency's own consumer protection director has said the true cost is likely higher.



• Around 30% of people who lost money to scammers in 2025 were first contacted on social media.

  Those cases alone accounted for 2.1 billion dollars in reported losses.



• Roughly 100,000 AI-generated sites were found impersonating about 200 brands.

  Netcraft's 2025 finding, as reported in February. Researchers identify them partly by leftover artefacts in the generated code.



• The distribution channel is advertising, not email.

  Fake sites now reach victims through paid search and social ads, which is why appearing above the real brand in search results is a feature of the scam rather than an accident.



• The FTC opened a rulemaking on this in September 2026.

  Its advance notice asks whether online platforms should be obliged to stop impersonation ads before they reach consumers, including vetting advertisers and removing confirmed scam ads. Comments close 60 days after Federal Register publication.

Worth stating plainly, because this post is published by people who build websites: AI site builders are genuinely good tools and we use them. The problem is not the technology. It is that the cost of producing something convincing fell faster than the cost of taking it down, and nothing has yet corrected that imbalance.

---

1. Find out whether it has already happened

Most businesses discover a clone when a confused customer emails them. You can do better in twenty minutes.

Search your brand name in an incognito window and read the sponsored results rather than skipping them. Search common misspellings, your name with added or dropped letters, and your name plus words like official, outlet, store and sale. Check the ad transparency libraries that Google and Meta publish, which let you see who is running ads mentioning your brand. Run a reverse image search on your main product photography. Your own images are the fastest way to find a site using them.

2. Buy the lookalike domains that actually matter

You cannot register every variant and should not try. Buy the handful a real customer could plausibly mistype or misread: the common misspelling, the letter transposition, the hyphenated version, your name with a major alternative extension.

Point them all at your real site with a redirect. This is cheap, permanent, and removes the most convincing addresses from the market before anyone else takes them.

3. Get your email authentication to enforcement

Impersonation does not stop at the website. If your domain has no published policy telling receiving servers what to do with forged mail, anyone can send email that appears to come from you.

Publish SPF and DKIM, then move DMARC to a reject policy rather than leaving it in monitoring mode forever, which is where most implementations quietly stall. Do it carefully and in stages so your legitimate mail keeps flowing, since the usual failure is a newsletter tool nobody remembered to authorise.

4. Make your real address unmistakable everywhere

Every place your brand appears should name the same canonical domain: social profiles, packaging, invoices, email footers, order confirmations, review listings.

Inconsistency is what gives a clone room to operate. If customers have seen three different addresses from you over the years, a fourth will not alarm them. Pick one, use it without exception, and say so where customers can see it.

5. Register the trademark, because takedowns run on it

This is the unglamorous legal step that determines how fast everything else goes. Registrars, hosting providers and ad platforms all have abuse processes, and those processes move considerably faster when you can cite a registration number instead of describing a grievance.

Without one, you are asking a platform to adjudicate who owns a name. With one, you are asking them to apply a rule. The cost is modest set against the difference in response time.

6. Set up monitoring you will actually look at

Brand monitoring services exist at every price point, and the free end goes further than most businesses realise. Alerts on your brand name and its common variants, certificate transparency monitoring to catch new certificates issued for lookalike domains, and a monthly check of the ad transparency libraries.

Assign it to a person with a recurring calendar entry. Monitoring that nobody owns is the same as no monitoring, and it fails silently.

7. Write the takedown runbook before you need it

When you find a clone, speed is the whole game, and the worst time to work out the process is while customers are losing money.

Keep a document with the abuse contacts for the major registrars and hosts, the ad platform reporting routes, your trademark details, a template complaint, and a prepared customer notice. Decide in advance who has authority to act on a Saturday. A clone taken down in hours is a story nobody hears; one that runs for a fortnight becomes your reputation.

8. Make the real thing harder to counterfeit convincingly

Clones copy what is easy to copy: layout, photography, product descriptions, logo. They struggle with what is specific and connected.

A real checkout with a payment provider the customer recognises. Genuine reviews on a third-party platform that links back. A physical address and a phone number that someone answers. An account area with real order history. Consistent, distinctive brand design rather than a template a generator can reproduce in a prompt. None of this stops a clone from existing, and all of it widens the gap between the real experience and the fake one at the moment the customer is deciding whether to trust what they are looking at.

---

The asymmetry nobody has fixed yet

Here is the uncomfortable arithmetic. Creating a convincing clone now takes an afternoon and costs almost nothing. Removing one takes days, requires evidence, and depends on the cooperation of a registrar in another jurisdiction who has no particular stake in your business. One side of that exchange got dramatically cheaper and the other did not.

That is why the FTC's September notice matters more than another security checklist. The question it asks is whether the platforms selling the ads should carry some of the cost of verifying who is buying them. A fake store only works if it can reach people, and in this generation of the scam it reaches them by paying for placement above the real brand. Putting the obligation on the entity collecting that payment is a different lever from asking every small business to defend itself individually. Whether it survives the comment process is a separate matter, and worth watching if you sell online.

Until something shifts, the realistic posture is not prevention. It is detection and speed. You will probably not stop a clone appearing, and you can decide in advance how many hours it lives, which depends almost entirely on whether you noticed and whether you knew who to contact. Most businesses fail both of those tests, and both are solvable in an afternoon of preparation.

The last point is the one that gets least attention. Customers who are defrauded by a fake version of your store frequently blame you, because from where they sit they bought from your brand and were robbed. The reputational cost lands on the real business regardless of fault, which is the actual reason this belongs on a marketing budget rather than only a security one.

---

Three checks to run this week

• Search your brand name in a private window and read every sponsored result.

  Then search the two most likely misspellings. Five minutes, and the most common way clones are found.



• Check your DMARC record and see whether it is set to none.

  If it is, your domain is publishing a policy that tells the world to deliver forged mail from you anyway.



• Reverse image search your three best product photographs.

  Your own images travelling without you is the clearest early signal there is.

Twenty minutes, no budget, and at the end you will know whether this is a hypothetical problem or one you already have.

Want the domain defences, the monitoring and a site that is hard to counterfeit? Talk to Spark about protecting the brand you paid to build.