2026-10-19 Fraud Seller's notes

A Supplier's Website You Cannot Tell From the Real One

Peter Yang's own column. He sells chemicals from China, and he has sat on the buying side of the same trade - the judgement here came from buying, and gets used on the selling side. The view is his. SUNWARD INDUSTRY sets the commercial terms, and a price comes as a written quotation.

A name has to be the same name in a domain, in a bank account, in a company register and in a shipping document. A page is read, and anything that is read can be assembled out of characters that render exactly like the ones you expect — a Cyrillic letter standing where a Latin one should be, at the same size, in the same font, in the same word. The site is a claim about what somebody sells, and the evidence is in those four places rather than on the page — a website cannot fake a name that has to hold in all of them. I have met it in a trade where the first result on the page was not the company, the collection account was where it broke, and the seller's own embassy in China was the way back to the real one. So stop reading the page and read the domain: copy it rather than click it and look at the characters one at a time, and arrive at the site from a link you trust rather than from a search result.

A name has to be the same name in a domain, in a bank account, in a company register and in a shipping document, and a supplier's website cannot fake that, because a page is read and the name has to hold in four places at once. There are now counterfeit supplier sites built out of characters belonging to other alphabets, chosen because they render as the letters you are expecting. To my eye the two pages are the same picture, and that is the problem: not that they are well made, but that I have no instrument that can tell them apart.

How do I check a supplier website is not fake before I pay?

You cannot check the page itself, because a page is read, and what is read can be assembled out of characters that render exactly like the ones you expect. What you can check is the name. A name has to be the same name in a domain, in a bank account, in a company register and in a shipping document, and it has to hold in all four at once, which is why the substitution on the page cannot travel with it. So the evidence sits in the domain and in the documents behind it, and the page is a claim about what somebody sells rather than a description of a company.

Why the first result is not the real company

Before the characters, there is the simpler problem, and it has been here longer. Search ranking is something you can buy, and what is being ranked for is an enquiry, not a factory. A site can be run up to outrank a manufacturer that has been shipping the same material for years, and can hold that position, and the practical effect is that the company you go looking for is not the one you find. The genuine supplier is still out there. They are just underneath something that was built to be above them.

I do not think this is a failure of search. A ranking reflects what the ranking is for, and it answers a different question from the one you arrived with. I have written about that at length in the note on the result that outranks the factory, where the same point is the whole subject.

What compounds it is that the ranking decides the order of your attention, and therefore the order of your judgement. Nobody sits down and compares three suppliers carefully. They look at the top of the page, they have an impression, and the impression is made before they know there was a decision to make. By the time a buyer is consciously assessing anybody, the assessment has usually already been made by something that cost money to put at the top of a page.

Where the substitution actually is

Now the newer part, and it is not about ranking at all. It is about the fact that a letter is a shape and not a sound.

Some characters from one script render as characters in another. A Cyrillic letter can stand exactly where you expect a Latin one, at the same size, in the same font, in the same word. Put that into a company name, or a domain, or a logo caption, and the page is correct in every respect a reader cares about. The branding is right. The photography is right. The product list is plausible and the industry language is fluent. There is a phone number and somebody answers it.

Here is why none of that helps me. Reading is not character inspection. When I read a page I process words and shapes and the general impression of a page being legitimate, and I skip over the individual glyphs entirely — that is what skipping over them is for. The substitution is written in the one place my attention does not go, and it is written there precisely because it is the one place nobody looks. Nothing in normal reading surfaces it. I would rather say that plainly than pretend I have got better at spotting it, because I have not.

What makes it worse is that the substitution is not aimed at outsmarting a careful reader. It is aimed at the part of attention that runs on its own, and care does not help, because care is applied to what you have already noticed. Fifteen years of reading supplier pages has given me a very good sense of what a normal page looks like, and a counterfeit page that renders correctly is, to that sense, indistinguishable from a real one. The expertise is real. It is simply expertise in reading pages, which is not the same thing as expertise in making the goods.

Where I first met this

The place I ran into it at scale was not chemicals. It was meat out of South America, when I was the one buying — I was helping a Chinese company buy meat products out of South America to bring back and sell in China. The information around that trade was false in large quantities, and it was false at every level at once. There were websites for companies that were not there. There were people writing to me as the contact at a named company, in that company's name, about that company's own products.

Two things from that business are why I still think about it. The sequence is the part I remember, because it is also the part that works. I found the company the way everybody finds a supplier: I searched, and the first company's website carried the contact details, and the sales contact there was a man. It was the collection account that did not add up. After that I went to that country's embassy in China, asked them for the company, and they gave me the contact details. When we rang, the sales person of that same name was a woman — the person on the website had not been the company's contact at all.

None of that needed a clever eye. It needed a search, a bank detail that did not add up, and a telephone call to a government body — and the embassy is the step almost nobody takes, because it is slower than email and it sounds bureaucratic. It is also the only step in the chain that cannot be faked, because nobody at an embassy has any reason to protect a company that does not exist.

It is not an isolated loss either. The companies that get taken in on South American meat procurement are losing more than ten million dollars a year between them, and none of it comes back, because the counterparty you would have to claim against is the thing that was never there in the first place.

That second kind is what changed how I read supplier pages afterwards. I had been treating a supplier's website as evidence about a supplier. What the South American meat trade taught me was that the level underneath the page can be made up just as easily as the page itself - a specific person, a specific job title, a specific company. The fake was not only the storefront. The name on the email was part of it.

So I stopped looking at a supplier site for somebody to ask about. The person on the site is the part of the structure that is easiest to write for an audience, and putting a question to it produces a fluent answer about exactly the kind of thing the question was about. The part that has to be the same thing in several places at once is the part that was not written for anybody, and that is where the evidence is.

The same trick, in a shop with a queue

It is tempting to assume this is something that happens in chemicals, and it is worth saying that it does not stay there. The same substitution turns up in consumer retail, where there is a much bigger queue behind it. Security researchers reported in the weeks before the October 2026 Prime Big Deal Days that they had found complete fake Amazon storefront websites in Germany and in Japan, and fake Amazon sign-in pages aimed at users in Japan, in Vietnam and in the United Kingdom. Check Point Research counted newly registered Amazon and Prime Day domains at 1,284 in September 2026, up from 905 in July, and KnowBe4's Threat Lab measured Amazon impersonation attacks rising by 188 per cent between late August and September.

The mechanism in those pages is the one described above, and it has a name: a homoglyph attack, a Latin letter replaced by the letter from another script that renders as the same shape. The example that gets quoted is Amazon's own address, with the Latin "a" swapped for the Cyrillic one — on a phone screen, in the font the reader has, the two are the same character to the eye. ESET's global security advisor Jake Moore made the point that the old advice stops working: a reader who checks the address carefully is checking for a difference that the substitution was built to remove.

There is one detail in that reporting which is the part I find most instructive for a buyer. The campaigns that use it no longer carry the ordinary tells. Generative tooling strips out the spelling mistakes, the clumsy phrasing and the obviously foreign wording that shoppers have been trained to notice, and replaces them with fluent local text. The warning signs a whole generation of buyers has been relying on were removed from the product deliberately.

Why a well-made site means almost nothing

The general form of the argument is older than the characters. An operation aimed at industrial buyers will spend money on the parts of the site that look expensive and skip the parts that are. Real photographs, a real catalogue, correct terminology, an answered phone line. Those are costs, not proofs, and the ratio between them and the actual question — does this company exist and will it ship — is very poor.

Which leaves the awkward bit. If the page cannot be evidence and the rank cannot be evidence, what is the site for? It is good for what it was always good for: telling you what somebody claims to sell, and roughly at what level they work. That is not nothing. It is just a much smaller thing than people are using it for, and it does not move at all when the copy is polished.

What the page cannot fake

What the whole thing cannot do is be the same entity that exists somewhere else. The substitution works on a page because a page is read. It does not work in the same way on a name that has to be the same name in four places at once, and that is the limit of the trick. It is the same limit as the one I described when I wrote about the payment details — the structure survives the disguise, and the disguise survives everything else.

So I no longer read a supplier's site the way I did ten years ago. I read it as a claim, in good faith, made by somebody, about what they sell. That is a legitimate thing to read and I am happy to read it. What I have stopped doing is treating it as a description of a company, because I was never in a position to know.

The practical consequence is small but it changes the order of things. The page tells me what to be interested in, and then nothing else. What I am actually dealing with is somewhere behind it — a company that can be found outside its own marketing, or one that cannot. That is a slower way to work and it is not how anybody buys anything, but it is the only version of the question that the counterfeit page has no answer to.

Questions this note answers

How do I check a supplier website is not fake before I pay?

A supplier's website is a claim about what somebody sells, and the evidence is in the name rather than on the page. A name has to be the same name in a domain, in a bank account, in a company register and in a shipping document, and it has to hold in all four at once. So stop reading the page and read the domain: copy it rather than click it, and look at the characters one at a time, because a Cyrillic letter can stand exactly where you expect a Latin one, at the same size, in the same font, in the same word. Arrive at the site from a link you trust rather than from a search result, because the search result is where the substitution is aimed.

How do counterfeit supplier sites get past a careful reader?

They use letters that belong to another alphabet but render as the letter you expect - a Cyrillic character standing in for an "a", for instance. Visually the page is correct, the branding is correct, the language is correct, and there is a phone number that somebody answers. Reading is not character inspection: the substitution is written in the one place my attention does not go, and care does not help, because care is applied to what you have already noticed. Fifteen years of reading supplier pages has given me a very good sense of what a normal page looks like, and a counterfeit page that renders correctly is, to that sense, indistinguishable from a real one.

Does a professional-looking website mean the supplier is real?

It means somebody spent money on it, and that is all. A phishing operation aimed at industrial buyers will have working photography, a real product list, correct industry language and a phone number that a person answers. Those are costs, not proofs, and the ratio between them and the actual question - does this company exist and will it ship - is very poor. The evidence is not on the site: it is in the name, in the bank account, in the company register and in the shipping document.

Can somebody impersonate a real supplier and contact me as them?

Yes, and I have seen it. The place I met it at scale was not chemicals but South American meat, when I was the buyer: there were websites for companies that were not there, and there were people writing to me as the contact at a named company, in that company's name, about that company's own products. It is worth separating from a fake website, because a fake website asks you to trust a page, while an answer written as a named contact asks you to trust a person, and people are trusted more readily than pages. It also puts the part of the structure you can check - the name - in front of you, and the fabricated part behind it. The company I was dealing with was reached the other way round: I searched, the first result's website gave me a man's name and a bank account, and it was the embassy in China that put me back on to the real company, where the sales contact of the same name was a woman.

Is fake-site trickery specific to chemical suppliers?

No, and the same substitution runs through consumer retail. Security researchers reported in the weeks before the October 2026 Prime Big Deal Days that they had found complete fake Amazon storefront websites in Germany and in Japan, and fake Amazon sign-in pages aimed at users in Japan, in Vietnam and in the United Kingdom. The method has a name - a homoglyph attack - and the example that gets quoted is Amazon's own address with the Latin "a" swapped for the Cyrillic one, which on a phone screen in the reader's own font is the same character to the eye. Check Point Research counted newly registered Amazon and Prime Day domains at 1,284 in September 2026, up from 905 in July, and KnowBe4's Threat Lab measured Amazon impersonation attacks rising by 188 per cent between late August and September. The campaigns no longer carry the ordinary tells either, because generative tooling strips out the spelling mistakes and the foreign wording that shoppers have been trained to notice.