A fraudulent site can no longer be identified solely by its spelling mistakes or the absence of a padlock in the address bar. Phishing techniques have become more sophisticated, and the real danger now lies upstream and downstream of the payment tunnel. Here, we detail the technical checks that allow you to make a decision before entering any personal data.
Fraud through manipulation around the site: the risk that classic guides overlook
The fraudulent site is no longer always the place where the fraud occurs. It serves as a pretext. According to the 2025 report from the Payment Security Observatory, manipulation frauds surged by 34% in 2025, driven by massive data leaks.
The typical scenario works like this: a fake merchant site attracts the victim through targeted advertising. The order intentionally fails. A “consultant” then calls back, posing as support from the bank or platform. They ask to install remote access software or to validate a transfer.
We observe that this mechanism makes the usual visual criteria (professional logo, valid SSL certificate, well-maintained product pages) insufficient. A site designed to trigger a phone call does not need to directly process a card payment. It only needs to appear credible for a few minutes.
- Any site that displays a phone number in case of “payment error” without offering a written solution should raise suspicion
- A request to install third-party software (like AnyDesk, TeamViewer) after a failed purchase constitutes a signal of manipulation fraud
- A “consultant” asking to validate a transaction via the banking app never represents the bank, which does not operate this way
Before even analyzing the technical structure of a site, it is essential to understand that reading reviews on aplouf com or any unknown domain remains a preliminary reflex that allows for cross-referencing feedback from real users.
Whois data and domain registration duration: what the technical layer reveals
A domain name registered for one year, with the registrant masked by a privacy service, and whose content claims to offer a long-established business, presents an exploitable inconsistency. This intersection between the creation date of the domain and the registration duration remains the most reliable filter.
A legitimate e-commerce domain is generally registered for several years. A fraudster optimizes their costs: one year is enough to set up an operation, collect data, and disappear.
Web archiving tools complement this verification. A domain that radically changes its theme within a few months (a culinary blog turned high-tech marketplace) signals a recycling of an expired domain. This technique allows inheriting the age and sometimes the residual SEO of a previous site, which also misleads automated scoring tools.
High-risk sectors for online card fraud
The fraud rate on online card payments has been halved in five years thanks to the widespread adoption of strong authentication (3-D Secure, validation via banking app). However, certain categories of products concentrate the anomalies.
Distance purchases in the computer, hi-fi, photography, and electronics sectors remain hotspots for risk. These products combine high unit value and easy resale. An unknown site offering abnormally low prices on these ranges deserves heightened vigilance.
On-page signals of fraudulent sites: beyond the obvious
The absence of legal notices or general terms of sale remains a valid criterion, but the most sophisticated fraudulent sites now include them, often copied from a legitimate site. We recommend checking the consistency between the displayed information and public data.
- The SIRET number or registration indicated in the legal notices must correspond to an active company in the official registers (Infogreffe, annuaire-entreprises.data.gouv.fr)
- The physical address, when provided, can be verified via Street View: a headquarters located in a residential building without a plaque or commercial premises raises questions
- Copied T&Cs sometimes contain the name of another company or site, which constitutes an immediate alert signal
A technical point often overlooked concerns browser-side redirections. A site that modifies the URL in the address bar after the initial click, switching from one domain to another during the payment tunnel, generally attempts to dissociate the phishing page from the page collecting banking data.
Link profile and web presence of the domain
A legitimate merchant site accumulates mentions over time on directories, forums, and comparison sites. A fraudulent domain presents an almost non-existent link profile, or is composed exclusively of links from spam comments on blogs.
Verification tools like ScamDoc calculate a trust score by cross-referencing several dozen technical criteria: age, volume of public data on the publisher, SSL certificate, consistency of information. A low score does not prove fraud, but a high score does not refute it either when the site serves only as bait for manipulation fraud.
Strong authentication and online payment reflexes
The widespread adoption of 3-D Secure has reduced direct card fraud, but it creates a false sense of security. Strong authentication protects against the fraudulent use of stolen card data. It does not protect against a transfer voluntarily validated by the victim under pressure from a fake consultant.
Before making any purchase on an unknown site, we recommend using a one-time virtual card, offered by most online banks. The limited ceiling and short validity period reduce exposure in case of compromise.
A final technical reflex: check that the payment form points to a recognized provider (Stripe, PayPal, Adyen, Monetico) and not to a page hosted on the same domain as the merchant site. A payment tunnel managed in-house by an unknown site is a major alert signal.
Vigilance against fraudulent sites is no longer limited to a visual analysis of the page. The ecosystem surrounding the site (phone calls, third-party software, validation of transfers) now constitutes the main vector for financial loss. Cross-referencing Whois data, business registers, and automated trust scores remains the most reliable method to rule out a suspicious domain before any interaction.
