How customers check whether your WooCommerce shop is real, and how to pass that test

A careful buyer, a payment provider and Google Merchant Center check a new shop in much the same way: they compare the company details with official registers, look at the age of the domain, search for copied photos and read the reviews. An honest WooCommerce shop can fail that test through plain neglect, such as an old address in the terms or a private bank account in the transfer instructions. This guide walks through those checks from the shop owner's side, with what to fix before a customer finds it. The registers and authorities named here (KRS, CEIDG, the VAT white list, the dns.pl WHOIS, CERT Polska, UOKiK) apply to shops registered in Poland or selling to Polish customers. The domain history, padlock, reverse image search, reviews, Merchant Center and WooCommerce checks work the same anywhere.

The NASK guide “Okazja czy pułapka?” (“Bargain or trap?”, November 2025) quotes CERT Polska data for 2024 in its section on fake shops: around 1,600 reports received and around 14,000 recorded cases of well-known marketplace brands being used without permission (NASK, approximate figures). A buyer who has heard about these scams checks every shop they do not know, including yours.

#How customers check whether an online shop can be trusted

Checking a shop is open-source intelligence (OSINT): conclusions drawn only from public sources. Company registers, the VAT taxpayer register, the WHOIS database, web archives, image search and online reviews. None of it needs technical knowledge, which is why the same steps end up in consumer guides. On 29 October 2026, Sekurak and Securitum run an online course in Polish, “Jak się nie dać oszukać? Sprawdzamy sklepy internetowe technikami OSINT-owymi” (“How not to get scammed: checking online shops with OSINT techniques”), in which they verify two shops live, an obvious scam and a professional-looking fake (course description).

Every inconsistency a buyer finds looks exactly like a fraud signal. In its shopping guide, CERT Polska advises reading the terms, delivery, payment and returns information and being “alert to any inconsistencies between them” (own translation from Polish, CERT Polska). To a buyer, two different addresses in the footer and the terms are a warning sign, even when one of them is just a forgotten update.

#What company details an online shop has to display

Two Polish acts set the minimum. Article 20(3) of the Entrepreneurs’ Law (Prawo przedsiębiorców) says that a business selling at a distance over telecommunications networks “shall state in its offer at least its registered name, tax identification number (NIP) and registered office or address” (own translation from Polish, Journal of Laws 2025 item 1480). Article 5 of the Act on Providing Services by Electronic Means (ustawa o świadczeniu usług drogą elektroniczną) adds electronic addresses, the name or registered name, and the registered office and address, given “in a clear, unambiguous and directly accessible manner” (own translation from Polish, Journal of Laws 2024 item 1513). The government business portal biznes.gov.pl adds to the content of the terms the authority that registered the business, the registration number, the company address, email and phone (biznes.gov.pl).

A customer compares these details in four places: the footer, the terms, the privacy policy and the invoice. Then they type the NIP into a company search. The KRS (National Court Register) search shows the address, legal form, identification numbers, registration date and history of changes, while CEIDG (the register of sole traders) needs only a first and last name, NIP or REGON (biznes.gov.pl, how to check a business partner).

CERT Polska points to one more detail. If KRS lists a brick-and-mortar shop or a company from a different line of business under the name of the supposed shop owner, that is a strong warning sign, because a scammer may have impersonated an existing company or taken over its unused domain (CERT Polska). For an honest shop, this means the business activity recorded in the register should cover the trade you actually run. A company registered as a design studio that sells cosmetics will raise questions with a careful customer and with a payment provider.

What to fix in your own shop:

• one version of the company name, NIP and address in the footer, terms, privacy policy, WooCommerce transactional emails and invoices,
• an address that matches the KRS or CEIDG entry, updated in the same week as the register after a move,
• a working phone number and email address, because CERT Polska tells buyers to contact the seller and walk away if they cannot get through.

#How to check a shop’s bank account on the VAT white list

The Polish register of VAT taxpayers, known as the white list (biała lista), can be searched by bank account number, NIP or REGON (biznes.gov.pl). A buyer who has received transfer instructions pastes in the account number and sees whether it belongs to the company named in the terms. The Ministry of Finance announced the launch of the modernised register for 15 October 2026 at wykazpodatnikowvat.mf.gov.pl, and on 21 October that address was already responding (KAS).

A B2B customer has money at stake here. According to KAS, the National Revenue Administration, in transactions above PLN 15,000 a company that pays into an account missing from the register cannot count the expense as a tax-deductible cost and is jointly liable with the seller for the seller’s VAT arrears. It avoids this by notifying the head of its tax office within 7 days of ordering the transfer (KAS, register information). So a wholesale buyer’s accountant will check your account at the first larger order.

In WooCommerce, the account number for bank transfers goes into the settings of the direct bank transfer payment method (in code: bacs), and the shop shows it on the order confirmation page and in the order email (WooCommerce). Enter the company account registered with the tax office there. The owner’s private account, or an account at a different bank from the one in the register, is the first thing that fails the test.

#How to check a shop’s domain age in WHOIS

Fake shops have short lives. CERT Polska describes phishing sites as registered in bulk, used shortly after registration and abandoned for new addresses (CERT Polska, Warning List). That is why buyers look at the domain registration date. For .pl domains, the WHOIS database of the NASK registry (dns.pl/whois) shows the creation date and the registrar. For example, a query for cert.pl returns a creation date of 12 March 1998 and NASK as the registrar. For any domain, the second source is the Wayback Machine, which shows what the site looked like in previous years.

A young domain does not mean fraud, but combined with a low price and missing company details it becomes a strong signal for the buyer. What you can do:

• after a rebrand, keep the old domain with a 301 redirect, so the history under the old address leads to the new shop,
• explain on your “about us” page since when you have been trading and under what earlier name, consistent with the registration date in the register,
• do not buy a domain previously used by another business without checking its history in the Wayback Machine, because old content or entries on warning lists come along with the address.

#Does the padlock in the browser mean the shop is safe

No. CERT Polska answers this question in its guide with one word and then explains: “Scammers have already developed ways of exploiting this kind of marker” (own translation from Polish, CERT Polska). NASK repeats it in its 2025 guide: the padlock symbol next to the address is no guarantee of safety (NASK).

A free Let’s Encrypt certificate is issued automatically: “the ACME client proves to the Certificate Authority (CA) that the web server controls a domain” (Let’s Encrypt). Nobody checks the company, the address, or whether the shop ships anything. HTTPS on a WooCommerce shop is mandatory for other reasons, but a careful customer is only convinced by the company details, the bank account and the domain history.

#How to check whether product photos are stolen

Reverse image search (Google Lens, TinEye, Bing) shows where else on the web a given photo appears. A buyer uploads a product photo and sees whether it comes from the manufacturer’s catalogue, someone else’s shop or a stock library. NASK lists “attractive product photos” among the features of fake shops, alongside well-known brand products and customer reviews (own translation from Polish, NASK).

A shop that uses only manufacturer photos does nothing wrong, but it does not stand out either: the same files show up in dozens of other shops, fake ones included. A few of your own photos for each bestseller (the product on your desk, the package with its shipping label, a shot from the warehouse) give the buyer proof that the goods physically exist. The same original photos help in image search results, as the post on Google Lens and optimizing images in WooCommerce explains.

#How to check whether reviews of a shop are genuine

Since 1 January 2023, Poland has applied the rules of the EU Omnibus Directive. UOKiK announced them like this: “Every business that provides access to product reviews will have to state whether and how it verifies their authenticity, and whether it publishes all reviews or only the positive ones. Posting fake or distorted reviews will also be expressly prohibited” (own translation from Polish, UOKiK). In its July 2024 press release, the authority adds: “It is not allowed to remove negative opinions, if someone was actually not satisfied with the product/service”, and businesses trading in fake opinions face a fine of up to 10% of revenue (UOKiK).

Buyers also look at how reviews are spread over time. CERT Polska advises trusting a shop less when there is a gap in its review history, for example the newest reviews come from the last two weeks and the previous ones are more than a year old (CERT Polska). NASK warns about reviews that are all positive, or repetitive and posted within a short time.

WooCommerce lets you allow reviews only from customers who bought the product and mark them with a verified owner label (WooCommerce). If you do this, say so next to the reviews in one sentence: who can leave a review and whether you publish all of them. That meets the information requirement and gives the buyer a reason to trust you. If you collect reviews on an external platform, describe its verification method in the same way.

#How a fake shop impersonates a real one

A clone of a real shop copies the logo, photos and descriptions, and differs in the domain and the bank account for payments. NASK describes three variants: impersonating well-known shops using their logos, fictitious sites that disappear after a short time, and shops that send goods that do not match the description (NASK). CERT Polska adds typos in the address that are easy to miss, and domains taken over from businesses that never ran a shop.

An honest shop is directly affected by the variant CERT Polska calls a legitimate payment in a fake shop: the scammer simultaneously buys from a real shop under their own details, and the victim unknowingly pays for that order (CERT Polska). From your WooCommerce dashboard it looks like an ordinary paid order. CERT Polska points buyers who paid by card to a chargeback as a relatively easy way to get their money back. If the victim uses it, the dispute can land with the merchant who accepted the payment, while the goods are already with the scammer. Signals worth setting an alert for in order handling: a delivery address that does not match the payer’s details, a parcel locker instead of an address for expensive goods, several orders from different cards to the same address.

Google treats similar practices as an egregious violation of the Merchant Center policies and states that it may not issue a warning before acting on one. Its list of examples includes “Present a false identity, business name, or contact information” and “Displaying a false or virtual physical address as your headquarters while operating entirely from an undisclosed region” (Google Merchant Center). An honest shop with a virtual office address does not break this rule as long as it does not hide where it actually operates and ships from. Still, it is worth saying so plainly on your contact page.

#How to report a fake shop impersonating your business

CERT Polska accepts reports of phishing sites through the form at incydent.cert.pl/phishing, and suspicious text messages can be forwarded free of charge to 8080 (CERT Polska). Verified domains go on the Warning List for 6 months. The list is used by telecom operators that joined the agreement with the President of UKE (the Polish telecoms regulator), the Minister of Digital Affairs and NASK (originally Orange, Plus, Play and T-Mobile), as well as the private DNS providers Quad9 and NextDNS. A customer who opens a blocked address sees a warning page instead of the fake copy of your shop.

Reporting to CERT is one of three steps. The second is an abuse report to the hosting company and the domain registrar, whose details you will find in WHOIS and in the clone’s DNS records. Attach screenshots, the clone’s address and the address of your shop. The third is a notice for customers on your site and on social media: what your only address is and what your bank account number is. If someone has already paid into the clone’s account, send them to their bank and to the police, as CERT Polska advises.

#Checklist: the credibility test for a WooCommerce shop

The points a careful buyer checks, starting with the quickest.

Consistent company details are also part of complying with consumer law. The full list of requirements for a Polish shop (GDPR, Omnibus, GPSR, returns) is in the WooCommerce compliance checklist. The technical protection of a shop is covered in the WordPress hardening guide. To have this list checked on your shop and the payment settings, transactional emails and footer fixed, describe the project on the WooCommerce developer page or order a WordPress security audit.