120 Fake Walmart Websites Are Targeting Shoppers With Huge Discounts. Here Are the Telltale Signs

Walmart is one of the biggest retailers in the US, with both an offline and online presence. But if you've shopped a Walmart deal online recently thinking you've grabbed a great discount, there's a chance you didn't shop with Walmart at all.

Malwarebytes has found 120 fake websites impersonating Walmart in order to collect sensitive personal user information. These websites lure shoppers with heavy discounts (40-70%) on various products, such as liquor and electronic gadgets.^[1]

However, once you proceed to buy an item, you're required to enter information such as your name, address, email, phone number, and credit card details, all of which are then harvested by the malicious parties behind the websites.

Here's everything you need to know about how these online Walmart scams work and what you can do to stay safe from phishing websites.

Thanks for subscribing!

Please check your email for your first message.

Take back control of your privacy.

Join thousands who get our privacy-first newsletter every week. No spam. No nonsense.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

How fake Walmart websites work

Malwarebytes has published an extensive list of 120 domains impersonating Walmart. All these domains end with .shop, whereas Walmart has only one official website, Walmart.com. We visited a few of these fake websites, and here's what we observed.

These websites copy everything from the legitimate Walmart website, including the logo, color scheme, and menu options. However, there are several telltale signs that indicate something is off.

1. Missing website elements: There’s no option to search for items or products on these fake websites. Plus, when we tried clicking the "Explore Now" button on the homepage, we realized it was not a button at all, but just an image.
2. Unorganized catalog: The official Walmart homepage lists various product categories and selected items as you scroll down. However, no such categories are visible on these fake websites. Instead, you're immediately shown liquor and electronics at unbelievably discounted prices. For instance, we found a pair of headphones worth $187.72 listed for just $19.88, and a Windows 11 laptop listed for $48.16.
3. Generic descriptions: On further investigation, we found that these products didn’t carry any brand names but instead had generic descriptions such as "15.6-inch Windows 11 laptop" or "13.3-inch small PC monitor."
4. Invokes urgency: We observed that when you click on a product to view its details, you'll see messages such as "Hurry up, low stock, only six left" or "Order now and get it between July 30 and August 1." There's also a message claiming that a certain number of people are viewing the product at that very moment.

These tactics are the main driving force behind these scams. Called social engineering attacks, they’re designed to create a sense of urgency, making you believe you'll miss out on a great deal if you don't act immediately. As such, they encourage users to react impulsively without doing their due diligence.

However, the real threat starts once you select an item and proceed to buy it. You're led to a fake checkout page, where you'll need to enter all your details: your name, address, phone number, email, along with your credit card details.

What scammers can do with your data

All the information you fill out gets harvested by the scammers. Given the sheer amount of personally identifiable information at stake, malicious parties have enough to piece together a convincing profile to impersonate you and target you with highly personalized scams.

For instance, scammers might use your name, address, and phone number to attempt identity theft, open new lines of credit in your name, or file fraudulent tax returns to claim refunds.

Scammers may also carry out SIM-swapping attacks using your phone number, where they trick your carrier into transferring your number to a device under their control, giving them access to one-time passwords and 2FA codes for your other accounts.

Similarly, your email address could be used for follow-up phishing attacks, where scammers might impersonate legitimate businesses such as banks, delivery services, or other companies and trick you into installing malware or infostealers.

What can you do to protect yourself

There are several steps you can take to, first, avoid falling for a phishing scam, and second, safeguard your data should you unfortunately fall prey to one.

To avoid fake shopping websites:

1. Avoid clicking on suspicious links from unknown senders. These fake websites are usually delivered through phishing or smishing messages that may impersonate Walmart and claim to inform you about an ongoing offer on its website, along with a malicious link. Only shop from Walmart's official website or application.
2. Watch out for warning signs. Look for any spelling mistakes in the website URL, such as “rn” instead of “m.” Also, look up the business’s name alongside words like “scam” or “fraud” online to find out if something fishy is going on.
3. Use a third-party antivirus program, particularly one with online web protection. It can flag suspicious websites before you visit or interact with them, adding a layer of defense even if a phishing link slips past your own judgment. These tools also scan all downloads and remove any malware you might have downloaded, perhaps through a fake invoice PDF.

If you have unfortunately shopped on a fake Walmart site and handed over your sensitive info, there are still steps you can take to protect your data.

1. Contact your card issuer. Report your credit card as compromised and work with your financial institution to close the card completely. Your bank will likely issue you a new card with a new number.
2. Set up transaction alerts. Monitor your bank and credit card statements for the next few months. If you notice any suspicious charges or transactions that you didn’t make, practice safe banking and report them to your financial institution immediately.
3. Place a credit freeze. This will prevent anyone from opening new lines of credit in your name until you unfreeze your credit yourself.
4. Use an identity theft protection service. It’ll look for your information in known breaches and on the dark web and alert you if it finds anything. Many of these services also offer identity theft restoration services that can help repair some of the damage.

Bottom line

A new study has uncovered an ongoing online scam, with 120 fake Walmart websites targeting shoppers with unrealistic discounts and harvesting their sensitive information. Thankfully, though, it’s completely avoidable through basic cyber hygiene.

Although the fake websites look legitimate, there are several differences that give them away. For instance, there’s no search bar or product categories, and the sites feature unbelievable discounts on products with generic descriptions.

To stay safe, never click on unknown links from suspicious senders and consider using third-party protection tools such as an antivirus program. If you have already interacted with a fake Walmart site, however, block your card, place a credit freeze, and consider getting an identity theft protection service.

4.8

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Get Deal

On Aura Identity Theft's website

2026 Editors’ Choice

Best Overall Identity Theft Protection Service

Identity Protection

Aura Identity Theft

PROMOTION: Save Up to 68%

• ID theft protection that monitors your SSN, bank accounts, credit cards, and brokerage and retirement accounts for suspicious activity
• Every plan includes the full feature set, so no additional cost to unlock monitoring, insurance, or restoration
• Bundles data removal with identity theft protection, antivirus, VPN, and a password manager in one subscription

Author Details

Krishi Chowdhary

About the Author

Krishi Chowdhary specializes in digital privacy, cybersecurity, and consumer technology. He has written extensively on online privacy tools and broader cybersecurity topics, including online scams, data breaches, age verification, and emerging digital threats. Krishi believes technology reporting should empower readers, not confuse them, and is committed to making even the most technical subjects easy to understand without compromising on accuracy or depth. His work has appeared in leading technology publications, including CNET, ExpressVPN, and TechRadar, where he has covered topics ranging from cybersecurity incidents and privacy product announcements to artificial intelligence and major technology news