Two numbers crossed paths this week, and almost nobody put them in the same sentence.

The first: a brand-new fake online store now appears roughly every three minutes. That is the headline finding of the Holiday Shopping Scam Report 2026 from Scamwise, the free scam checker built by anti-fraud company Savi, based on more than 250,000 shopping sites that real people submitted for checking between March and October. More than 100,000 of them were judged definitely or likely a scam.

The second: Meta’s shopping agent Muse hit 10.2 million US downloads in its first 40 days, per Sensor Tower data reported by TechCrunch, a launch velocity only 11 other apps in history have matched, most of them mobile games. On Meta’s earnings call, Mark Zuckerberg said shopping is the overwhelming use case, and more than a quarter of Muse users have made purchases averaging over $200.

Ten million households are handing purchase tasks to machines. An industrial fake-store economy is minting new storefronts every three minutes. And the retailers with the strongest defenses against fraud are, one by one, locking the doors on the agents. This is not three separate stories. It is one system, and its load-bearing wall is the assumption that a lower price is a better deal.

The front doors are closing, one retailer at a time

The most vivid case study of the month comes from The RealReal, the secondhand luxury consignment platform. As The Verge reported, the retailer’s website puts an item “on hold” for 20 minutes once it lands in a shopping cart, making it unavailable to other buyers. A human can only be so indecisive. An agent does not care. Verge’s reporters instructed Meta’s Muse to re-add the listing the moment each hold expired, effectively walling off inventory from every other shopper for hours at a time.

The RealReal’s chief technology officer, Luke Friang, told The Verge the company has now reconfigured its bot defenses so that it is “much more difficult for all agents to log in, add items to cart, and check out.” Agents can still surface listings. They just cannot buy.

The consignment site is not alone. Per Gizmodo’s roundup this week, Tapestry (the parent of Coach and Kate Spade) and Kohl’s do not allow AI shopping agents to complete purchases at all, according to the Wall Street Journal. Chewy and Neiman Marcus block some agents. Adidas blocks Muse, per widespread user reports. Airlines are a fortress of their own: Delta told TechCrunch that it has “no partnership or integration that enables a third-party AI agent to shop for or book Delta flights on a customer’s behalf,” while United simply points to terms of use that bar any “robot, spider, other automatic device” without written permission. eBay has suspended accounts over agentic activity. Yelp permits no non-human traffic unless the agent’s operator pays for its data licensing program.

Then there is the biggest door of all. Amazon blocked Muse from its retail site in September, and, as Acrew Capital notes, has gone to court with Perplexity and shut out dozens of other agents, while promoting its own in-house assistant, Alexa for Shopping. Meanwhile Reuters reported on October 22 that US banks have detected unauthorized AI agents operating in customer accounts and are moving to block third-party agents entirely.

The nuance matters: Walmart has partnered with Muse, and its agent failures are accidental, caused by human-verification buttons that agents cannot press. An industry group including Meta, Walmart, Stripe, Sierra, Genesys, Rocket, NiCE and Decagon is now drafting an open standard for agent-to-business communication to separate authorized agents from hostile ones. But the direction of travel is unmistakable. The most defensible properties in commerce are the least accessible to third-party agents.

What blocking actually does: rerouting, not stopping

Here is the mechanism everyone covering the blocking war keeps missing. Blocking does not delete the demand. Ten million Muse installs represent people who want things bought on their behalf. When Amazon, The RealReal, Delta and the banks say no, the agent does not give up. It does what it is built to do: it keeps shopping, somewhere else.

Acrew Capital framed it precisely in a Money20/20 post-mortem published this week: “Amazon has blocked Meta’s Muse, gone to court with Perplexity, and shut the door on dozens of other agents. So when your agent goes hunting for the best price, it gets pushed toward the long tail of the internet. That is great news for small merchants, and I mean that. It is also exactly where roughly 500 new fake stores get reported to Scamwise every day, and without the right controls, it is where the risk lives.”

That is the trade. The long tail is genuinely good for small merchants who finally get agent-mediated distribution the platforms never gave them. It is also the native habitat of the fake-store industry. And the fake-store industry, per Scamwise’s data, is no longer a collection of one-off con artists.

The store is the scam now

The report’s own framing is blunt: “Scammers used to fake products. Now they fake the whole store.” Today’s fraudulent retailers run “like real retailers, with a catalog, a marketing department and a merchandising calendar.”

The catalog: clothing and apparel lead at 30 percent of confirmed scam stores, followed by electronics at 13 percent, tools at 11 percent, jewelry and watches at 6 percent. Single-product cons have become boutiques with hundreds of products, size charts and return policies, filled out overnight with AI-generated content. One store Scamwise flagged listed an item at $49.99 that retails for about $2,600.

The merchandising calendar: World Cup merch in June, summer wear in July, back-to-school in August, football in September, Halloween decor by early October. Fake holiday stores have been live since June, and holiday-themed fakes have grown 5x in the last 60 days. The report’s sharpest line: “The store that scams you on Black Friday most likely doesn’t exist yet.”

The marketing department: at least one in five fake stores was traced back to an ad on a major platform, and of the ad fingerprints Scamwise captured, 42 percent came from search ads and 39 percent from Meta. In Acrew’s words, “The scam store found you. You did not find it.”

The trust hijack is the most damning part. More than half of these stores do not live on some shady TLD. They sit on reputable shopping infrastructure: Shopify, Amazon, Etsy, eBay. The myshopify.com domain alone accounts for nearly 10 times the scam-store cases of every other platform combined. The platform’s logo does the trust work.

And the disposability: 40 percent of scam stores were less than 90 days old when checked, and 7 in 10 are dead within 90 days of being reported. These are pop-ups, not businesses. When one dies, another is live within days, sometimes hours.

The alignment problem nobody is talking about

It is tempting to assume agents are safer than humans here. In one sense they are. Acrew’s author, recounting a Money20/20 conversation with Savi founder Patrick Coughlin, notes that scam stores were engineered to beat a human: the countdown clock, the model in the sweater, the price that feels too good. Agents do not fall for any of that.

Then comes the blind spot. Agents are built to complete the task, and the task we hand them is usually some version of “find me the best price.” As Acrew puts it: “The one signal that would make a person pause is the exact thing an agent is optimizing for. That is not a flaw in the agent. It is doing precisely what we asked. The gap is that nobody has given it a way to ask the next question.”

Read that against the Scamwise dataset. Eighty percent of scam stores lead with an impossible discount or lazy pricing. The too-good price “is not a tell anymore. It is the business model.” The single strongest statistical fingerprint of a fake store is, functionally, the objective function of a shopping agent. We have built millions of price-optimizing machines and pointed them at the one corner of the internet where price optimization is the attack.

The backdrop makes it worse. The Global Anti-Scam Alliance puts worldwide scam losses above $1 trillion a year. Scam attempts are not evenly distributed: once a scammer finds a good mark, that mark gets sold and resold, and almost nobody tells the people on the list. Even the senior-citizen trope is backwards: Coughlin’s data shows Gen Z falls for online scams at multiples of the Boomer rate. And the next frontier, in his framing, is agent-to-agent: scam agents running at scale, negotiating with your agent, a machine-speed problem requiring machine-speed defenses.

The trust stack authenticates the buyer, not the buy

The industry’s response to agentic commerce risk is real and well-funded, but look at where it points. World’s Proof of Human verifies the person behind the agent. The banks verify the account. Visa and Mastercard’s agent frameworks verify identity, intent and payment integrity. The Meta-Walmart-Stripe open standard will verify which agents are authorized to talk to which businesses. Scamwise itself now ships an API and an MCP server so partners can build store-vetting into their products.

Every one of those layers answers: who is allowed to transact? None of them answers the question that actually determines whether the transaction was a good idea: is this store real, is this product what it claims, and are the reviews backing it authentic? As Acrew compressed it: the agent and the scam store want exactly the same thing, to complete the transaction. The entire emerging trust stack is optimized to let legitimate transactions complete. It has almost nothing to say about transactions that complete perfectly and shouldn’t.

That is the evidence layer, and it is the gap this newsletter exists to cover.

What checking before buying has to include

If the blocking war reroutes agents toward the long tail, then pre-purchase verification has to become part of the agent loop, not an afterthought. Three components:

  • Store-level vetting. Domain age, platform history, impossible-price detection, the disposability fingerprint. Scamwise’s checklist is the consumer version: a days-old store with no track record, a “powered by” logo, an ad in your feed, and a countdown clock are all bait.
  • Product-level evidence. On marketplaces the store is often legitimate; the listing is not. Sponsored placements, hijacked listings and manufactured review histories do the same work a fake storefront does, inside platforms everyone trusts.
  • Review integrity. A 4.8-star average means nothing if the corpus is fabricated. What matters is review quality: verified purchase patterns, linguistic authenticity, temporal distribution, the difference between a product that earned its rating and one that bought it.

That third component is where GoBuy lives. GoBuy filters fake reviews out and weights authentic ones up, computes a Smart Score from 0 to 100 based on review quality rather than review quantity, and deliberately shows only the top seven products in a category instead of thousands of sponsored noise. AI agents can consult all of it through our MCP endpoint at gobuy.ai/api/mcp before committing a single dollar, and the GoBuy Verified badge marks products that have held a score of 80 or above across 90 days. For humans still shopping the old way, the Chrome extension injects the trust panel directly onto Amazon product pages. The point is not to slow agents down. It is to give them the next question.

Acrew’s closing line from Money20/20 is the right one to end on, because it converts a threat model into a product roadmap: “The agents that win consumer trust will be the ones that can show they checked before they bought. That is a product advantage, not a compliance cost.”

The front doors are closing. The long tail is open for business, and so are 500 new fake stores a day. The agents, and the humans behind them, need somewhere to check before they buy.

Start at gobuy.ai, or if you are building an agent, wire it into the trust layer first: gobuy.ai/agent-docs.