Beyond Phish: Toward Detecting Fraudulent e-Commerce Websites at Scale

## Beyond Traditional Phishing Detection

Researchers at IEEE Symposium on Security and Privacy present work on fraudulent e-commerce sites that steal payments without delivering goods. Unlike credential-phishing pages, these scams mimic legitimate storefronts—FTC-reported losses are substantial—and extend to fake pet-adoption and donation schemes.

## Building a Ground-Truth Dataset

The team collected roughly 29,000 online shopping sites, labeling about 23,100 legitimate and 6,100 fraudulent through manual verification. Category analysis of page source revealed scam typologies beyond simple brand impersonation, requiring features beyond URL similarity, logo presence, or login forms used in classic phishing detectors.

## Novel Detection Signals

Fraudulent sites often add social-media links to feign legitimacy, but behavioral patterns differ: inconsistent contact information, suspicious payment flows, and template reuse across unrelated "brands." Machine-learning models trained on these features outperform phishing-oriented classifiers on this domain.

## Scale and Responsible Disclosure

The system operates at web scale, surfacing persistent scams still online months later. Researchers reported findings to hosting providers and e-commerce platforms; Safe Browsing uptake varied. Code and data are released publicly to help hosting companies and security vendors protect consumers from payment fraud, not just credential theft.