Fake Shopping Website Statistics Reveal Identity Fraud Risks for Lenders
NordVPN reported that fake online stores detected through its Threat Protection Pro data increased 250% in October 2025 compared with September. These fake shopping website statistics matter to lenders and other financial services companies because the risk can extend beyond a shopper’s immediate loss. A fake site can collect personal details or login credentials that may later be used in identity theft, account takeover, or fraudulent financial applications.
The finding does not prove that every visitor becomes an identity theft victim or that fake sites cause more loan or buy now, pay later applications. Information exposed through an online scam may create risks long after the original transaction ends.
This raises an important question for financial services teams: How consistently are applicant identities checked before financial decisions are made?
TL;DR
- NordVPN reported a 250% increase in fake shopping websites in October 2025 compared with September.
- Fake sites and phishing scams can collect personal information and login credentials that may later be misused.
- In a TransUnion survey, 200 U.S. business leaders attributed 31% of reported company fraud losses to account takeover and 24% to synthetic identity fraud.
- Adobe forecasts $21.3 billion in U.S. BNPL online spending during November and December 2026, up 6.6% from 2025.
- Searchbug APIs can provide identity and contact data for comparison during application review. AML screening supports a separate compliance review.
What Do Fake Shopping Website Statistics Show About Holiday Fraud?
NordVPN Recorded a 250% Increase Ahead of Black Friday 2025
NordVPN’s Black Friday scam research reported a 250% spike in the creation of fake shopping websites ahead of Black Friday. Its research covered threat data collected from August through October 2025. A related NordVPN release described the increase as a comparison between October and September 2025.
The finding does not represent every fake store online. It reflects sites observed through NordVPN’s threat-protection data. NordVPN did not publish a raw site count with the percentage.
NordVPN describes fake shopping sites as replicas of legitimate retail websites. Some copy a known retailer’s design but change the login fields so entered usernames and passwords go to the scammer. Other sites may request payment details or personal information as part of a false purchase.
A shopper may lose money, expose payment information, or give a criminal access to an account. Login credentials can support account takeover, while personal details can be sold, combined with other records, or used in later identity fraud.
How Can Information Collected by Fake Shopping Websites Be Misused?
Stolen Information Can Be Used Beyond the Original Scam
A person who enters information on a fraudulent website may expose a name, address, email address, phone number, password, or payment details. The exact information depends on the fields used by the site and what the victim submits.
A reused password may give a criminal access to another account. Personal details can also support false requests or unauthorized credit applications. IdentityTheft.gov explains that victims may discover new accounts, credit cards, loans, or other debts opened in their names.
This creates a possible connection between a consumer scam and later financial fraud. It does not mean every fake site produces a fraudulent application. There is also no standard timeline for when stolen information may be misused or discovered.
Identity Theft and Synthetic Identity Fraud Are Different
Traditional identity theft usually involves pretending to be a real person and using that person’s information or credit. Synthetic identity fraud involves creating a new identity from fabricated information, altered information, or a combination of real and false details.
The Federal Reserve System’s white paper, Synthetic Identity Fraud in the U.S. Payment System, explains that a synthetic identity may combine a real Social Security number with a false name, address, or date of birth. It may then be used to establish a credit record and obtain credit.
Stolen personal information can contribute to some synthetic identities, especially when a real SSN is combined with fabricated details. However, identity theft and synthetic identity fraud should not be treated as the same event. Not every stolen record becomes part of a synthetic identity, and a lender cannot identify a synthetic identity from one mismatch alone.
What Do Account Takeover and Synthetic Identity Fraud Statistics Mean for Lenders?
What TransUnion’s Survey of U.S. Business Leaders Found
TransUnion’s H2 2025 Global Fraud Report included a survey of 1,200 business leaders across six markets. The survey was conducted from May 29 through June 6, 2025, and included 200 respondents in the United States. Participants held management roles related to fraud or risk at companies that primarily served consumers. The U.S. companies included in the survey had at least $200 million in annual revenue.
TransUnion’s U.S. business survey reported that account takeover represented 31% of the fraud losses reported by respondents’ companies, followed by synthetic identity fraud at 24% and scam or authorized fraud at 23%.
These percentages are not shares of all confirmed fraud losses across the United States. They describe how the surveyed business leaders distributed the fraud losses reported by their own companies. The respondents also came from companies much larger than many independent lenders and fintech firms.
Account takeover and synthetic identity fraud affect different parts of the customer lifecycle. Account takeover concerns unauthorized access to an existing account. Synthetic identity fraud concerns a created identity that may be used to obtain credit. Neither figure shows that fake shopping websites caused the losses.
What Does Holiday BNPL Spending Mean for Application Review?
Adobe Forecasts $21.3 Billion in Holiday BNPL Spending
Adobe’s 2026 holiday shopping forecast estimates that BNPL will support $21.3 billion in U.S. online spending during November and December 2026. That would be a 6.6% increase from the same period in 2025. Adobe expects $1.09 billion in BNPL spending on Cyber Monday and $807 million on Black Friday.
Those figures measure BNPL spending, not application volume or fraud. They should not be treated as a forecast of how many fraudulent applications providers will receive.
The forecast still shows why BNPL providers should review their processes before the busy holiday season. BNPL providers and digital lenders can review whether identity checks are applied consistently, conflicting information reaches the right team, and review rules work when activity is high.
Each business should decide which checks fit its products, legal duties, risks, and application process. The process should also work outside the holiday season.
How Can Financial Services Teams Review Identity Information During Application Intake?
Compare Submitted Information With Additional Data
Collecting identity details is not the same as checking them. An application may contain a complete name, SSN, address, email address, and phone number, but completed fields do not show whether the details are accurate or belong together.
Where permitted, a business can compare submitted information with additional data. A team might review whether a name aligns with the SSN information being checked or whether available contact records support the application.
Matching information can support the review, while conflicting information may require follow-up. Neither result should decide the application on its own. Records may differ because of a recent move, a name change, an input error, shared contact information, or outdated data. The business needs rules for deciding which differences require correction, another verification step, or manual review.
Use Automated Checks With Defined Review Rules
APIs can add data checks to an existing application workflow. The system can submit authorized information, receive a response, and route the record according to the company’s procedures. This can reduce reliance on occasional manual searches and make the initial review more consistent.
Teams should define which applications receive a check, which results require review, who handles unresolved differences, and what records must be kept. They must also follow applicable privacy, data-use, fair lending, and compliance requirements.
How Can Searchbug APIs Support Identity and Compliance Review?
Searchbug offers several services that answer different questions during an application review.
SSN and Name Match API
Searchbug’s SSN and Name Match can compare submitted name and SSN information. Supported searches may use a full SSN with a last name or the last four SSN digits with a full name, depending on the request method and access available. (Note: This API requires SSN Verification Access to use.)
The result can add one identity-data signal to an existing review. It does not prove that the applicant owns the SSN or that the person submitting the application is the person represented by the information. When results do not align, the lender should follow its procedures for correction or additional verification.
People Search API
Searchbug’s People Search API returns available identity and contact records that may include names, addresses, and phone numbers. A permitted user can compare those records with information supplied in an application.
Availability can vary by search and record. An association between a name and contact record does not prove that the applicant controls the phone number, lives at the address, or submitted a legitimate application. The result is reference information for the company’s review process, not a final identity decision.
AML Screening
Searchbug’s KYC and AML solutions support screening against available global watchlists, OFAC sanctions data, and politically exposed person records. This is a separate compliance check, not an identity-matching tool.
A possible screening match may require review against other identifying details because different people or organizations can have similar names. It can support a compliance review, but it cannot identify synthetic identities, establish identity ownership, or guarantee compliance.
The lender remains responsible for choosing appropriate checks, interpreting the results, and making the final decision.
Conclusion
Fake shopping websites create more than an immediate shopping risk. When they collect personal information or login credentials, that data may later be used in account takeover, identity theft, or fraudulent applications.
A completed application can still contain information that does not belong to the same person. Financial services teams can review how submitted information is checked, how conflicting results are handled, and when a record should receive further verification. Searchbug APIs can support that work with identity, contact, and compliance data, but each organization must decide how those signals fit its own process.
Create a free Searchbug API Test Account and receive $10 in credits to test available identity, contact, and compliance data tools. Teams working with larger datasets can also use Searchbug Bulk Processing for high-volume data review.
Editorial note: This article is for informational purposes only and is not legal, lending, fraud-prevention, or compliance advice. Organizations should review their identity-verification and compliance procedures with qualified professionals.
