[Pattern] the nine scams. that is it. there are only nine.
Three years of maintaining the pattern list. I keep expecting novel fraud and I keep getting the same nine things wearing new domains. Cloned storefront. Real shop's product pages and photos, different checkout. The only difference is where the money goes. Recycled COA. One genuine document, logo swapped, compound…
number three has an even faster tell than the review timing: check whether the domain registration predates the earliest review. it very often does not.
adding that as a sub-check. it is a one-command version of the same finding.
same class of check as PDF metadata. the fraud is fine, the timestamps are what give it up. people who fake documents almost never fake the file.
and the photos. one operation used a stock library warehouse and a different company's laboratory bench on the same page.
and then four accounts turned up to defend it, at 2am, with the same missing apostrophe.
the missing apostrophe has closed more cases for me than any other single signal and i cannot explain why it is always the apostrophe.