Phishing and fraud during China’s Singles Day sales

Singles Day is a windfall for ecommerce players like Alibaba and JD – everybody knows that. And it’s often a good thing for consumers, too, as they can get products they want at rock-bottom prices.

Well, most of the time.

Unfortunately (and inevitably), the massive spending that happens on Singles Day also attracts a massive number of scammers and phishers hoping to get a piece of that multibillion-dollar pie. How do they do it?

Singles Day scams

Fake sites: Using a traditional phishing technique, scammers construct sites that look precisely like real ecommerce sites like Taobao or JD, sometimes even masking the URL. But of course they’re not the real thing, and unlucky customers who make the mistake of purchasing something will never recieve their item. This year, China’s state media reports that more than 5,000 of these sites were discovered on Singles Day.

Big (and fake) discounts: If you don’t want to bother setting up a Taobao clone, you can create an off-brand-looking ecommerce site and try to lure customers in with ridiculously good deals. For example, one such site this Singles Day promised buyers the chance to buy an iPhone 6 for just 1388 RMB (US$217), claiming that only 100 of the phones were available. Of course, in reality none of the phones were available because the deal was too good to be true. Anyone who purchased a phone lost their money and got nothing in return.

Fake returns: Another approach involves collecting user information (passwords, bank information, ID numbers, etc.). In one such example, scammers set up a fake site to attract users with special order requests or interest in returning something. This site then led to a fake Taobao login page that would accept any input (but of course most users didn’t know that, and input their real Taobao account and password). From there, users were directed to a returns center where they filled out all kinds of details that scammers could then sell to third parties or use themselves to compromise and steal from the user’s Taobao account.

Big losses, but few victims

Not many people were fooled by these scams – the Beijing police only got 98 reports, for example – but those who did get fooled lost out big-time. Based on the Beijing police reports, the total stolen and scammed away was over RMB 1.1 million (US$176,000), with the average victim having lost over RMB 12,000 (nearly US$2,000).

Of course, it’s possible that many of the people scammed this Singles Day haven’t yet realized it – they’ll discover it only when the items they ordered fail to arrive. But part of the reason the victim count is so low is that police teamed up with Chinese security company Qihoo 360 and were actively catching and shutting down scam and phishing sites during the day of sales. Here’s hoping that the police follow up on the sites they shut down and arrest some of the perpetrators so that next year, even less money is lost.

Have you ever been scammed or phished online?