A 65% Discount on Bagels That Steals Your Credit Card

A 65% Discount on Bagels That Steals Your Credit Card

A Lookalike Bagel Shop Offers 65% Off and Steals Card Data

A fake website copied Boichik Bagels down to its lowercase navy logo, golden challah photos, menus, mugs, and customer reviews, then slashed prices by 65% to lure bargain hunters. The Berkeley bagel company says its only real site is boichikbagels.com, while the impostor uses a near-identical domain built around boichikbakery. Anyone who checks out on the fake store hands credit card details straight to criminals, according to SFGATE and the Bay Area Telegraph.

A Loyal Customer Spotted the Fraud First

Founder Emily Winston got an early-morning call from a longtime customer who had stumbled on the copycat site, SFGATE reported. Boichik then posted an Instagram warning on October 27, saying there was an imposter among them and asking shoppers to look closely at where they order. The company said it was working to take the site down and asked customers to share the alert.

Researchers Blame a Polished Skimming Toolkit

Selena Larson, principal threat researcher at Sunnyvale cybersecurity firm Proofpoint, told SFGATE the impersonation belongs to a much larger payment-fraud ecosystem. The attackers use a software development kit called PaymentVanilla, a small piece of JavaScript placed on the fake site that mimics the Shopify payment process and harvests card data in real time. To shoppers, the checkout looks normal.

50,000 Matching Sites Target Tens of Thousands of Brands

Larson said she found about 50,000 websites sharing the same designs, JavaScript usage, emoji placeholders, and menu and photo placement as the real stores. The fraudsters are targeting tens of thousands of consumer brands, from sports teams and museums to coffee and chocolate companies, with artificial intelligence almost certainly helping them clone full stores in minutes. Boichik is one Bay Area victim among many.

Fake Stores Now Appear Every Three Minutes

A holiday fraud report from Savi Security, the company behind Scamwise, released on October 20, 2026, found consumers flagging a new fake online store roughly every three minutes, about 500 a day. The finding draws on more than 1 million consumer submissions to Scamwise, including over 250,000 e-commerce site reports. Holiday-themed fake stores jumped 5x in the past 60 days, Merchant Fraud Journal reported, and myshopify.com is the most abused domain in the dataset, and at least one in five fake stores can be traced back to ads on large platforms. Research blog Recon.bot separately documented one operation cloning 475 Shopify brands. For shoppers, the next step is simple: check the domain before paying, use only the official store, prefer credit cards or mobile wallets, and call the bank and dispute suspicious charges at once.