Scammers Copy Trusted Names: 10 Safety Tips for Today

New reports show fake stores, fake help desk calls and real-looking sign-in requests. Here are 10 simple steps to stay safe.

AppWT Informative Multi-Lingual System

New security reports this week show scammers copying names people already trust. They build look-alike stores, pretend to be IT help desk staff, and send sign-in requests that look real. Before you pay, call or sign in, check where the site, call or request really came from.

What the reports found

Help Net Security covered Akamai's Fraud and Abuse Report 2026. One retail scam used more than 1,200 look-alike .shop web addresses. A look-alike address is a name made to resemble a real store's name. The fake checkout pages asked for card numbers, expiration dates and security codes. If one site was removed, the others kept working. New sites could appear within hours.

A ticket scam copied official ticket and hospitality sites for a major sporting event. Some of its checkout pages asked for passport or ID details.

In a separate report, Cisco Talos found people posing as IT help desk staff. They reached workers by phone, email and Microsoft Teams. They talked people into opening remote access sessions. Remote access lets someone else control your computer from far away. In one case, it ended in ransomware, which locks files and demands payment.

Tips for shopping and travel

Tip 1: Type the store address yourself

Use a bookmark or type the store's web address into your browser. Look closely at the web address before you enter card details. Fake stores can share the same design as many other fake stores.

Tip 2: Buy event tickets only from the official seller

Go to the event's official site on your own, not through a link. Be careful if a ticket page asks for your passport or ID to "deliver" tickets. The Akamai report found fake ticket sites asking for exactly this.

Tip 3: Get apps from your phone's official app store

Akamai documented a paid social media ad that led people to a fake app store. The app people downloaded collected private information. Open your phone's real app store and search for the app there.

Tip 4: Be careful with job offers on social media

Akamai found fake hiring posts on four major social platforms. They led people to forms built to collect personal details. Find the company's real careers page and apply there.

Tips for your accounts

Tip 5: Use a different password for every account

Criminals use automated programs to test passwords leaked in old breaches on other sites. This is called credential stuffing. If you reuse a password, they may get into your saved cards, reward points or personal details. They can then change your recovery settings, so you get locked out.

Tip 6: Watch for small warning signs

Akamai says people often notice theft through a purchase alert, missing points or a password that stops working. Turn on purchase alerts. If something looks wrong, change that password right away.

Tip 7: Keep your bank login to yourself

The Hacker News reports that Bank of America emailed customers about this. The bank said never to share your username and password with another person or outside service. That includes an AI tool or agent that offers to act for you.

Tips for work and small business

Tip 8: Hang up and call IT back

If someone says they are from IT and asks for remote access, end the call. Call your help desk using a number you already know. Talos says the callers seemed to know only names and email addresses. They did not need much more to sound real.

Tip 9: Never call a number from a pop-up

In one Talos case, a worker called a support number shown in a browser pop-up. That person later gave the caller remote access. Talos documented this pop-up scam in one case. Close the browser tab instead.

Tip 10: Do not finish a sign-in you did not start

The Hacker News described ANY.RUN's look at a campaign called Skyw4lker. Victims got a password-protected file that looked like a contract. It led to a Google-hosted page, then to a real Microsoft sign-in. The attacker had started that sign-in. When the victim finished it, the attacker could get into the account. This is called device code phishing. If a file asks you to sign in or enter a code, stop and check with IT.

One more step for business owners

Talos found the fake callers went after all kinds of workers, not only managers or tech staff. So train every person on your team. Talos also recommends phishing-resistant sign-in, such as hardware security keys. A security key is a small device you plug in or tap to prove it is really you. Talos suggests these in place of text message codes and push prompts.

Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.

Sources

• Scammers rebuild fake shopping sites within hours of a takedown, Help Net Security, 2026-10-30
• Fake IT help desk callers got by on little more than names and email addresses, Help Net Security, 2026-10-30
• ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories, The Hacker News, 2026-10-30
• American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed, The Hacker News, 2026-10-28