Report a copycat store to its payment processor

The usual list is host, registrar, platform. The payment processor is missing from it, and it is arguably the most effective of the four.

Why this route works

A domain costs a few dollars and is replaced in an afternoon. Hosting is the same. A merchant account is not. It requires an identity, a bank relationship and an approval process, and losing one is expensive in a way that losing a domain is not.

The grounds are also cleaner than anywhere else. A registrar may argue that a domain name alone is not their problem. A processor's acceptable use terms universally prohibit misrepresenting your identity or your business, and a store presenting itself as a brand it is not, while taking card payments, is squarely inside that.

And unlike an intellectual property notice, this needs no sworn statement from you. You are reporting a merchant for breaching the processor's own rules.

Find out which processor it is

Add an item to the cart and go as far as the payment step without completing anything. Do not enter real card details.

Then look at what the page loads. The payment form is usually an embedded frame from the processor, and both the page source and the network requests name it. Common ones are Stripe, PayPal, and the platform's own payments product. Many fake stores run more than one, so check for alternatives offered at checkout.

Where each takes reports

• Stripe. Support routes are published at support.stripe.com. Report it as a merchant misrepresenting their business.
• PayPal. PayPal publishes a route for reporting suspicious or fraudulent activity from its help centre, and it can be used without an account relationship with the merchant.
• Platform payments. If the store runs on a commerce platform using that platform's own payments product, the platform is both host and processor, and the abuse route covers both.

Use whatever the current help pages point to rather than an address from an old article. Support destinations move.

What to send

Processors deal in facts about merchant conduct, so give them that:

• The storefront URL and a checkout URL.
• Dated captures of the store presenting itself as your brand.
• Your own store, for comparison, so the misrepresentation is visible rather than asserted.
• The domain registration date, if recent.
• Anything showing the material was taken rather than licensed, such as product images served from your own content delivery network.

State the breach plainly: this merchant is presenting itself as our business and taking card payments on that basis. That is a terms question, not a legal argument, and it is the kind of report a processor can act on quickly.

What to expect

You will usually not be told what happened. Processors do not report back on other people's merchant accounts, and that silence is not a rejection. The observable outcome is that checkout on the store stops working.

Which is why it is worth checking rather than assuming. A store that fails to take payment once may simply be having a bad minute. Check twice, at least an hour apart, before you treat it as done.