The Black Friday 2026, which will be held next November 27, again places online shopping at the center of commercial campaigns, with thousands of offers in clothing, technology, footwear and other products. However, behind some ads that appear on Instagram, Facebook and other social networks, fake stores that imitate well-known brands can hide to get consumers to pay for items they will never receive. The scam can be especially difficult to detect because the fraudulent pages reproduce the logos, product photos and even the design of the original websites.
The National Police has already documented this procedure in an operation announced on January 2, 2024, when it blocked various pages that impersonated well-known clothing brands. Those responsible had created digital stores that were virtually identical to the originals and promoted them through social media ads, taking advantage of the increase in shopping during Black Friday and the Christmas campaign. Users accessed the alleged deals with a single click and made payments for products that ultimately never arrived.
The investigation showed that recognizing a brand, its logo or the usual look of its store does not prove that the page is authentic. Scammers can copy a large part of the visual elements of a legitimate company and use Internet addresses that are very similar to the official ones, modifying only a letter or adding words that go unnoticed by the buyer.
The problem remains present in commercial campaigns. An investigation published by Maldita.es in January 2026 identified 18,088 ads circulated between Black Friday and the eve of Christmas 2025 that used the visual identity of up to 16 well-known brands on Instagram and TikTok. Among the companies impersonated were names such as Adidas, LEGO, Pandora and Lacoste, although these brands were not responsible for the fraudulent ads.
From the Instagram ad to the cloned store: this is how the scam works
Fraud usually begins with an everyday situation: a user browses Instagram and finds an ad that promises extraordinary discounts on sneakers, clothing or accessories from a well-known brand. The post may use professional photographs, the original logo and messages that announce an exclusive clearance sale or a promotion limited to Black Friday.
By clicking on the ad, the consumer accesses a page that apparently belongs to the brand. The header, the colors, the images, and the arrangement of the products match those of the official store, which creates an initial impression of trust. However, the address shown in the browser bar is not exactly the same as the one used by the authentic company.
This was precisely one of the mechanisms detected by the National Police in the 2024 operation. The criminals registered domains with names almost identical to the originals, introducing or removing characters, or using endings such as ".shop" to give the page commercial appearance. This extension alone does not mean that a store is fraudulent, but it must be checked that the domain really belongs to the company.
The investigation also found that those responsible registered the domains through companies in third countries, hosted the pages on servers in the United States, and routed the payments through a business based in Brazil. In the weeks leading up to Black Friday, the Police had received more than 200 reports related to these practices, which made it possible to detect common patterns and link the complaints.
Shoppers could complete the process without noticing significant differences from a conventional store. Even the fraudulent pages had security certificates and showed the familiar browser padlock, a detail that could reinforce the appearance of legitimacy.
The checks that make it possible to detect a fake website before paying
The National Cybersecurity Institute (INCIBE) and the Ministry of Consumer Affairs recommend starting with the Internet address. It is not enough for the brand name to appear: the domain must be verified to match exactly the one used by its official website. An address with changed letters, added words, or an unfamiliar structure can be an indicator of impersonation.
The safest way to make this check is to leave the ad and access the company’s official page separately, either by typing its address into the browser or using your usual application. If the promotion does not appear there, it is advisable to be suspicious and verify whether it is an offer from an authorized distributor.
Another fundamental element is the seller’s identity. Stores must provide information about the company responsible, including its name or company name, address, and contact details. This information is usually found in the sections of “Legal notice”, “Contact” or “General conditions”. If it does not exist, proves to be incomplete, or does not match the advertised brand, the buyer must take extra precautions.
It is also important to review shipping conditions, returns and payment methods. A store that advertises products with very high discounts, but does not explain when it will deliver them, who handles claims, or how to recover the money, shows signs that justify additional verification.
Lastly, it is necessary to take into account that the padlock and the HTTPS protocol do not guarantee that a business is authentic. These mechanisms indicate that there is an encrypted connection between the user and the page, but they do not certify that the company that manages it is really the brand shown on the screen. The criminals investigated by the Police already used valid certificates so that their stores would look reliable.