Scam websites: Tesco, Amazon and Boots impersonation warning
Tali writes about scams and consumer rights for Which? delving into fraud, technology and consumer rights topics to keep readers safe and empowered.
Scammers are attempting to con shoppers using fake websites, including imitations of Amazon, Boots and Tesco sites, Which? is warning.
Some of the sneakiest fake websites closely impersonate known brands to con unsuspecting victims using a tactic known as 'typosquatting'. This is when a website address is so closely mimicked that it looks legitimate.
Typosquatting typically includes the brand name to trick you into thinking you’re clicking the genuine website.
Tech company Decodo identified over 28,000 dodgy website addresses in January 2026, and found Amazon, Google, Microsoft, Gemini, and ChatGPT to be among the most impersonated brands.
Read on to discover a scam website using typosquatting to impersonate Tesco and copycat sites of Amazon and Boots.
Tesco impersonation
Which? found a scam text claiming to be from Tesco that tells you that you have ‘points’ to renew as part of a ‘2026 Reward Program.’
It goes on to provide a link to redeem these points. Which? has previously reported on scam texts promoting ‘points’ targeting EE. This scam followed a similar formula, advertising points and leading recipients to a scam site impersonating EE that asked for their personal information.
The text leads to a website impersonating Tesco, with the website address including the word ‘Tesco’ to try to catch people out.
The site was registered on 2 March 2026 and uses Tesco’s branding and logo to appear legitimate. It also includes several dead links under the guise of leading to ‘contact us’ and ‘about us’ pages.
The website tells you that you have points available to redeem and asks you to verify your mobile number to do this.
Which? typed in a bogus number and was directed to a page stating we had a Clubcard balance of 12,739. This page lists various products available to ‘redeem,’ including phone chargers, blood pressure monitors and furniture.
Selecting one of these products and clicking on ‘redeem now’ led to a page asking for your full name, email address and home address.
Which? has reported this scam website, but it was still live by the time we published this story.
Amazon and Boots copycat websites
Amazon is often impersonated by scammers, and just last month, Which? warned about a text message scam circulating about an Amazon product recall. The message instructed you to click a link to apply for a refund.
This link led to a copycat of Amazon's login page and asked for your Amazon login details, such as your email or phone number. It also enabled you to create a new account if you’re new to Amazon.
Which? also recently found an email that claimed to be from Boots and invited you to complete a survey to receive a prize. The email led to a website that appeared to be a convincing copycat of the Boots official site.
What can be done about scam websites?
Links to fraudulent websites are usually shared using text messages, social media posts or online adverts. This means that intermediaries, whether online platforms or telecoms companies, have a duty to prevent their users from receiving these scams.
Which? has called on online platforms to proactively scan all uploaded content for signs that it might be fraudulent, as part of their responsibilities under the Online Safety Act. This would include links to fraudulent websites.
Which? wants telecoms networks and mobile messaging aggregators – the middlemen between brands and mobile phone networks – to do the same and to block any messages that contain suspicious links.
It's important that both online platforms and telecoms networks proactively seek the most up-to-date information on fraudulent websites so that they know which links to block, and that they share this information with other organisations to help prevent fraud.
Find out more: join our campaign to Stamp out Scams
6 signs of a scam website
You can spot websites impersonating legitimate brands by looking out for:
- Unofficial website addresses – look closely for typos in web addresses; this is how scammers catch you out.
- Newly created websites – using a domain checker like who.is can tell you when the website was created, a newly created website should raise alarm bells.
- Prices and opportunities that sound too good to be true – be wary of flash sales or heavily discounted goods.
- Poor spelling and grammar, or pixelated images and graphics.
- Dead links – for example, links such as the ‘contact us’ and ‘about us’ pages that don’t lead anywhere.
- No padlock – a padlock next to a website's URL means the site is encrypted, so what you do on it – such as browse or make payments – can't be intercepted. This should always be visible on a trusted website, but don't assume that this sign alone means you should trust the website, as scammers often use website encryption to trick you into thinking your data is safe.
If you've lost any money or spot an unauthorised transaction on your account, you should contact your bank immediately using the number found on the back of your card. Scams should be reported to Report Fraud, or by calling the police on 101 if you live in Scotland.
