Founder Notes
Someone Has Cloned My Shopify Store. What Should I Do?
Finding another website using your business name, products, photography and content is worrying enough. Finding one that appears to be actively taking orders while pretending to be your business is considerably more serious. I recently dealt with exactly this situation for a Shopify client, and what initially looked like a copied website quickly became an investigation into domains, hosting infrastructure, payment systems and copyright infringement.
If your Shopify store has been cloned, or you have discovered a fake website impersonating your business, there are practical steps you can take. The important thing is to act quickly without immediately alerting whoever is behind the site.
First, work out whether your website has been copied or your business is being impersonated
There is an important distinction between somebody copying elements of your website and somebody creating a website designed to impersonate your business.
A competitor borrowing your layout, wording or design ideas may be frustrating and could involve copyright infringement. A website using your business name, products, photography and reputation while apparently accepting orders is potentially much more serious because customers could reasonably believe they are dealing with you.
Start by looking carefully through the website and documenting what has been reproduced. Check the business name, logo, product names, product photography, descriptions, About page, reviews, contact information, company details and policies. You should also establish whether products can be added to the basket and whether customers can proceed to checkout, although I would not place an order or enter any payment details.
This initial assessment matters because the language you use when reporting the website should reflect what you can actually demonstrate. If somebody has copied your photographs, say so. If they appear to be offering products for sale while presenting themselves as your company, explain that clearly. Avoid making claims about stolen card details, fraud or the identity of the operator unless you have evidence to support them.
1. Preserve the evidence before contacting anyone
Your first instinct may be to contact whoever is operating the website and demand that they remove it. I would resist doing that until you have created a proper record of what is currently online, because the website could be altered or removed very quickly once its operator knows it has been discovered.
Take screenshots of the homepage, collection pages, individual products, copied photography and descriptions, About and contact pages, policies, footer, shopping basket and checkout. Where possible, keep the fraudulent domain visible in the screenshots so there is no ambiguity about where the material appeared.
I would also make a screen recording showing the journey through the website from the homepage to checkout without completing a transaction. Keep a note of the date and time everything was captured and retain the original files rather than relying solely on screenshots pasted into emails.
If the website subsequently disappears, you will still have evidence of what customers were seeing when you discovered it.
2. Don’t assume the cloned website is another Shopify store
This is something I discovered during a recent case involving one of my own Shopify clients. The genuine business was running on Shopify, but the website impersonating it had actually been built using WooCommerce.
That distinction is important because there is no reason somebody copying a Shopify store needs to use Shopify themselves. They can reproduce the products, photography, written content and branding using an entirely different ecommerce platform.
If the clone is hosted by Shopify, Shopify has reporting processes for potentially fraudulent activity and intellectual property infringement. If the website is built using WooCommerce, however, the situation is different. WooCommerce is software installed on independently hosted WordPress websites, so there isn’t a central WooCommerce platform with the ability to suspend every store using it.
Rather than starting with the platform, the objective should therefore be to understand the infrastructure behind the website and identify the organisations that may actually have the ability to disrupt it.
How can you tell What platform was used?
There are often clues in the source code which can be viewed in the browser settings – seeing links and code starting with “wp-” is a dead giveaway. If this doesn’t work try this website builtwith.com to see if they can help narrow down your investigation.
3. Identify the infrastructure behind the fake website
A website depends on several different services, and understanding the distinction between them makes reporting a cloned store considerably easier.
The domain will normally have been purchased through a domain registrar. The website itself will be running on a server or hosting network. Its DNS records connect the domain to that infrastructure, while a separate payment provider may be processing transactions.
These companies perform different roles, so reporting the website to one of them does not necessarily affect the others.
In the case I investigated, I started with the suspicious domain and examined its DNS records. The domain’s A record pointed to an IP address, which could then be traced to the autonomous system, or ASN, responsible for announcing that address. From there it was possible to identify the network operator and its registered abuse contact.
For a founder, you don’t necessarily need to understand every technical detail of internet routing. The useful principle is:
Domain → DNS → IP address → hosting/network provider → abuse contact
You are trying to establish which organisations are providing the infrastructure that allows the website to operate and where an evidence-based complaint can be sent.
These websites will help you find out the DNS servers and hosts for the cloned website.
Search Domain and IP ownership information from the world’s largest WHOIS database
THE MX TOOLBOX SUPERTOOL – All of your MX record, DNS, blacklist and SMTP diagnostics in one integrated tool.
4. REPORT THE DOMAIN TO THE REGISTRAR
Once you know which company registered the suspicious domain, find its abuse reporting process and explain that the domain is being used to impersonate an established business.
Provide the genuine website and fraudulent website clearly, then include evidence showing that your business predates the suspicious domain and that your identity or intellectual property is being used without permission.
A newly registered lookalike domain can be useful supporting evidence when the genuine business has been trading from its established domain for many years. The age of a domain does not prove fraudulent activity by itself, though, so it should form part of the evidence rather than becoming the basis of the accusation.
Keep the complaint factual and make it easy for somebody unfamiliar with your business to understand the problem.
5. Report the website to its hosting or network provider
The domain registrar and web host are not necessarily the same company, which is why I would investigate both.
If you can identify the company hosting the website, or the network associated with the IP address serving it, look for its abuse contact and report the activity. Explain that an unauthorised website is impersonating your established business and provide evidence of the copied material.
Be precise about what your technical investigation actually proves. An IP address being associated with a particular network does not necessarily mean that network operator personally runs the fraudulent website. It may provide infrastructure to another hosting company or customer.
The complaint should therefore explain that the website is being served through infrastructure associated with that network and ask the provider to investigate, rather than accusing the provider itself of operating the site.
If your original photography, written product descriptions or other copyright-protected material has been reproduced, include that in the complaint as well. A clear copyright infringement can sometimes provide an additional route for action alongside the wider impersonation complaint.
6. Check how the fake store appears to be taking payments
If customers can reach a checkout, investigate what payment options are being presented. Depending on the website, payments could be handled through Stripe, PayPal, Shopify Payments or another payment provider.
Do not make a purchase simply to discover this. You don’t want to provide personal or payment information to a website you already suspect of impersonating another business.
If you can reliably identify the payment provider, investigate its fraud or abuse reporting procedure and include the information in your wider evidence record.
This is an important distinction when explaining the seriousness of the problem. Somebody reproducing your product photograph is primarily an intellectual property issue. A website apparently accepting customers’ money while presenting itself as your established company creates a much wider commercial and consumer risk.
7. Report the fake website to Google where appropriate
If the website appears deliberately designed to mislead customers about the business they are dealing with, it may also be appropriate to report it through Google’s mechanisms for deceptive websites, phishing, spam or other problematic content.
As with every other report, accuracy is more useful than exaggeration. Rather than claiming that the website is stealing credit card information when you cannot prove it, describe what you can demonstrate.
For example, you might explain that the website appears to be impersonating an established UK retailer, is using the company’s trading identity, products and imagery without permission, and appears to be offering those products for sale.
That gives Google something specific to investigate without weakening your complaint through speculation.
REPORT TO GOOGLE’S ABUSE SYSTEM
I’d use the Safe Browsing phishing report first and describe it as a website impersonating an established retailer and using its identity, products and imagery to present itself to customers.
For a suspected impersonation/phishing site report it to Google’s official reporting page:
For the broader set of Google reporting options, including spam, malware, phishing and other Search issues:
8. Publish a warning on your genuine website
While you are trying to get the cloned website removed, you also need to protect customers who may encounter it.
I would add a clear notice to the genuine website explaining that you are aware of an unauthorised site, naming the fraudulent domain and confirming the address of your only official website. Depending on the seriousness of the situation, this could appear temporarily in an announcement bar or other prominent part of the site.
I would also consider creating a permanent page specifically about the fraudulent domain. This has a useful search function as well as providing reassurance to existing customers.
Someone who encounters an unfamiliar website offering your products at unusually low prices may search Google for the domain followed by terms such as “scam”, “fake” or “genuine”. Publishing an authoritative page on your established domain gives the search engine something from the real business to return for those queries.
A title such as “yourbusiness-sale.shop: Fraudulent [Business Name] Website Warning” makes the purpose of the page unambiguous to both customers and search engines.
9. Don’t contact the people behind the cloned website too early
There may eventually be a reason to contact the website operator directly, particularly if you take formal legal advice and decide that a cease-and-desist letter or other legal action is appropriate. I would not make that the first step.
Once the operator knows they have been discovered, they can change the website, remove evidence, move to another hosting provider or simply register another domain. That can make an already difficult problem harder to document.
Preserve the evidence first, identify the infrastructure and make the appropriate reports to the companies capable of taking action. You can then decide whether direct contact is useful.
10. Keep monitoring after the cloned website disappears
Getting a fraudulent domain or website taken offline does not necessarily mean the problem has gone away.
If somebody has already copied your catalogue, photography, branding and written content, much of the work required to create another version of the website has already been done. Registering another domain and moving the material elsewhere can be relatively straightforward.
For the following weeks, periodically search for your business name and some of your more distinctive product names. You can also place distinctive passages from your product descriptions inside quotation marks when searching Google, which can help reveal other websites reproducing the same wording.
Customer service enquiries are worth monitoring as well. If somebody contacts you asking about an order that does not exist in your system, find out exactly which website they purchased from. Several similar enquiries may be the first indication that another impersonation site has appeared.
What should I do if my Shopify store has been cloned?
The important thing is to approach the problem methodically. Preserve evidence before alerting the operator, establish exactly what has been copied, identify the technology and infrastructure behind the website, then make specific complaints to the organisations that can actually do something about it.
That may include the ecommerce platform, domain registrar, hosting or network provider, payment processor and search engines. Where your original photography, copy or branding has been reproduced, copyright or trademark complaints may provide additional routes for action.
Keep records of every complaint, including screenshots, dates, email correspondence and reference numbers, and continue monitoring after the original site has been removed.
Treat a cloned store as a commercial incident
A successful ecommerce business builds up far more than a website. Over time you invest in photography, product descriptions, search visibility, customer reviews, brand recognition and, most importantly, trust. Those things have commercial value, which is precisely why somebody may try to appropriate them.
You cannot completely prevent somebody from copying information that is publicly accessible on your website. The situation becomes considerably more serious, however, when another website begins using that material and your identity to convince customers that they are buying from you.
At that point, this is no longer simply somebody copying your web design. It is a commercial incident involving the reputation your business has spent years building, and it deserves a proportionate response.
Preserve the evidence, understand what sits behind the fraudulent website and make clear, specific complaints to the organisations with the ability to disrupt it.
Frequently Asked Questions
Start by preserving evidence before contacting whoever is operating the cloned website. Take screenshots and screen recordings, document what has been copied, and establish whether the site is capable of taking orders. You can then investigate the domain registrar, hosting provider, ecommerce platform and payment provider so complaints are directed to the organisations that can actually take action.
There isn’t necessarily one organisation that can remove a fake website. Depending on how the site is set up, you may need to report it to the domain registrar, hosting or network provider, ecommerce platform and payment processor. You can also report deceptive websites to Google Safe Browsing. Provide clear evidence showing your genuine website alongside the site impersonating it.
Google provides a Safe Browsing reporting service for suspected phishing and deceptive websites. When submitting a report, stick to what you can demonstrate rather than making assumptions about what the operator is doing with customer information.
If the cloned website itself is hosted by Shopify, you can report it to Shopify for investigation. However, don’t assume that a clone of your Shopify store is also running on Shopify. It could have been recreated using WooCommerce or another ecommerce platform, in which case you will need to identify the companies providing its hosting and other infrastructure.
There is a difference between copying aspects of a website’s design and reproducing protected material such as original photography, written content, logos and trademarks. If another website is also using that material to impersonate your business, the issue extends beyond somebody simply copying the look of your website. For specific questions about your intellectual property rights or legal action, speak to a suitably qualified solicitor.
Preserve evidence showing exactly where the photographs are being used and retain the URLs of both the original and copied material. If you own the copyright, you may be able to make a copyright infringement complaint to the website’s platform, hosting provider or other relevant service provider.
The domain’s DNS records can provide useful technical information. An A record may reveal the IP address serving the website, which can then be investigated to identify the network or hosting infrastructure associated with it. Bear in mind that the network associated with an IP address is not necessarily the company directly hosting the end customer’s website, so technical findings should be described carefully.
Usually not immediately. Contacting the operator tells them that the website has been discovered and gives them an opportunity to alter the site, remove evidence or move elsewhere. Preserve your evidence and make the appropriate infrastructure and abuse reports before deciding whether direct contact or formal legal action is appropriate.
Yes, particularly if customers could reasonably mistake the fraudulent website for your genuine business. Publish a clear notice identifying the unauthorised domain and confirming your official website address. A dedicated warning page can also help people searching for information about the suspicious domain find a statement from the genuine business.
Make it clear that the transaction was not made with your business and document any information the customer can provide about the website and their order. They should contact their bank, card issuer or payment provider promptly for advice about the transaction. Multiple customer reports may also provide valuable additional evidence when reporting the impersonating website.
You cannot completely prevent someone from copying publicly accessible material from an ecommerce website. Strong branding, retaining original files for photography and written content, registering trademarks where appropriate and periodically monitoring your brand online can make impersonation easier to identify and give you stronger evidence when you need to challenge it.
Potentially both, but they are different issues. Copying original photography or written content may involve copyright infringement, while using another company’s identity to persuade customers that they are dealing with the genuine business raises wider impersonation and potential fraud concerns. When reporting a cloned store, describe each issue separately and avoid alleging criminal activity that you cannot substantiate.
FURTHER READING
Boutique vs Brochure
Why the best ecommerce websites balance customer experience with commercial performance.
Published
Last Updated