Specialisms
The site carried a well-known logo – someone else was running it.
Counterfeit sites are now barely distinguishable by their design. They adopt the original’s logo, typography, legal notice and legal texts and often differ only in the address bar. Two sides are affected: users who enter data or make payments there, and companies and public authorities whose presence has been copied and whose customers then turn to them.
Circumstances
Clarify the context
Evidence
Preserve documents
Deadlines
Explain any urgency
Approach
Discuss the next steps
Immediate steps
What to do now
The steps differ according to whether you paid or entered data on the page or whether your own presence was copied. The first step is the same in both cases.
Document the page in an evidentially sound way
Secure screenshots with the full address bar visible, together with date and time, the legal notice, the payment page and, insofar as possible, the source code. Such pages frequently disappear within a few days; without your own documentation it cannot later be proven what stood there.
If payment has been made, involve the bank immediately
Expressly ask for a recall of the transfer or a chargeback of the card payment and have the report confirmed with date and time. Time limits apply to these procedures that can be short and must be clarified at once.
Change entered access data immediately
Change the affected passwords from another device and check devices, sessions and forwarding arrangements stored in the accounts. If a confirmation code was also entered, assume that access has already taken place and block the affected accesses.
Establish the domain, registrar and host
Record the domain name, registration date, registrar and hosting provider. These details are a prerequisite for every report and for the complaint and can be obtained only to a limited extent after the page has been shut down.
If your own presence has been copied, report early and inform internally
Report the page to the registrar, host, search engines and browser warning services and at the same time inform your own customer service so that incoming complaints are correctly assigned. A brief warning on your own presence can prevent further damage.
File a criminal complaint
File a complaint stating the domain, the time, the payment data and your documentation. Even if the individual page is already offline, registration and payment data remain available with the service providers involved.
Contact & appointments
Switzerland
Zürich
United Kingdom
London
Estonia
+372 6 288 2000
France
+33 2 04 26 81 82
Netherlands
+31 970 102 51606
Germany
+49 30 41733313
WhatsAppMessage us directly
Send a WhatsApp messageOverview
What lies behind replica sites
A copied page is created in minutes. The source code of the original is taken over, the domain resembles the real one – one extra hyphen, a different ending, a swapped letter – and a certificate for the encrypted connection is available free of charge. The padlock in the address bar therefore says nothing about the operator’s seriousness, but only that the transmission is encrypted. Such pages are found via advertisements, via links in messages or via search results for terms such as “customer service” and “refund”.
The purpose is either to harvest access data or a payment. Replica official sites work with alleged fees for certificates, applications or extensions that are free of charge or cheaper on the real site. Replica brand sites take orders that are never fulfilled. A third group imitates login screens of institutions and services and forwards the data entered in real time to the genuine service in order to obtain the second factor as well.
For companies and authorities the damage is composite: immediate losses among customers, complaints about events with which they have nothing to do, and an impairment of their own presence. Because such pages are operated in waves and reappear after a short time under a new address, the issue is less the shutdown of a single page than a procedure that can be repeated.
Recognising the signs
How a replica page can be recognised
The design is of no help, because it is copied. What is telling are the technical and organisational edges of the presence.
- The address in the address bar differs from the familiar one by a single character or in the ending.
- Only the page called up is complete; sub-pages lead nowhere or refer to the original.
- A fee is demanded for a service that is free of charge or cheaper at the official office.
- In the end the only payment methods available are transfer, cash transfer or crypto payment.
- The legal notice names details that cannot be confirmed in the public register, or belongs to another company.
- The domain was registered a few days or weeks ago, although the presence presents an established provider.
- The page was reached via an advertisement or a link in a message, not via a bookmark or the familiar address.
Possible measures
Possible measures
For those affected on the user side the payment is in the foreground; for companies and authorities it is the shutdown and the risk of repetition. Both can be combined.
Evidentially sound documentation
We document the presence in a form that can later be used and record the technical inventory before the page disappears. That is a prerequisite for reports, the complaint and any civil-law action.
Reports to registrar, host and search services
We formulate the complaints vis-à-vis the service providers involved and follow them up. Whether and how quickly a page is shut down is decided by these companies; a commitment on this is not possible.
Trade-mark-law steps
If a company’s mark, name or presence is used, claims for injunctive relief and removal may come into consideration, if appropriate combined with proceedings for transfer or deletion of the domain. Success depends on whether a tangible holder exists.
Tracing the payment side
If payment has been made, we examine chargeback and refund routes and, where possible, identification of the recipient. A right to information against the payment service provider may come into consideration.
Preparation of a repeatable procedure
Because such pages appear in waves, a defined process for detection, documentation and reporting is more effective than handling each case individually. We set this process up on request and accompany the first runs.
Prospects
What can be achieved
Shutting down a page is frequently possible, but it is not the same as a recovery. Whether paid money can be recovered depends, as in all other cases, on where it has flowed and who holds it; the payment channels of these pages are deliberately chosen so that a reversal is difficult. An outcome cannot be promised.
In terms of time: documentation must take place immediately, because the page usually disappears first, and chargeback routes are bound to deadlines and close quickly. Reports to registrars and hosts often take effect within days, but regularly only lead to the same presence appearing under a new address. Trade-mark-law proceedings remain possible for longer, but presuppose a tangible opponent.
A realistic result is therefore usually one on two levels: the individual page disappears, and one’s own process for the next case is in place. For users the fast route via bank and complaint remains the essential one. The overarching foundations on evidence preservation and payment tracing are set out in the Fraud & Scam practice area.
Frequently asked questions
Frequently asked questions about replica pages
The answers describe the framework. What applies in your case depends on whether you are affected as a user or as a rights holder.
Related specialisms
Patterns that often overlap
Fraud rarely follows just one pattern. If your case only partly matches, related specialisms may help you understand the connections.
Phishing
Forged bank and authority messages that harvest credentials – and what to do after an approval.
Find out moreOnline fraud
Fake shops, manipulated payment pages and fraudulent platforms – chargeback, evidence preservation and opposing parties.
Find out moreInvestment Fraud
Dubious return promises, trading portals and participation models – payment routes, information requests and possible claims.
Find out more
Related information
Related information
- Fraud and scamsWhen fraud is suspected, payment routes, correspondence and timing are important starting points.
- Recognising signs of fraudUrgency, secrecy and extra payments before a promised withdrawal are recurring warning signs. A single feature does not replace examination of the facts.
- Fraud patterns at a glanceForged invoices, fabricated relationships and manipulated investment platforms follow different patterns. Explore how they work and possible next steps.
- Contact usDescribe your matter in a few sentences. Include only what is needed for the initial contact. Documents can be requested later through a suitable channel.
Contact
Describe your matter
An enquiry does not establish a client relationship or responsibility for monitoring deadlines. If a deadline is approaching, do not rely on this form alone.
- General information. The legal assessment depends on the circumstances of each case.