Boichik Bagels has become the latest Bay Area business caught up in a sprawling credit card phishing scheme, with its owner discovering four separate fake websites built to look like the beloved bagel shop’s real online store. The lookalike sites copied Boichik’s images, logo and customer reviews while slashing prices by 65 percent to lure in unsuspecting shoppers looking for a deal.
Owner Emily Winston first learned something was wrong when a longtime customer flagged a suspicious site to her, according to SFGATE. She was visiting family in New Jersey at the time but quickly posted an Instagram warning telling customers not to engage with the fake site. As Boichik’s sole owner, Winston said the experience has been nothing short of an exercise in aggravation.
An October 27 warning on Instagram, reported by Bay Area Telegraph, identified boichikbakery.com as a copycat, distinct from the real boichikbagels.com. The fake site used Boichik’s photos, product descriptions and branding while advertising the same products at steep discounts. Boichik said it was trying to get the site taken down and asked customers to share the warning.
A Fourth Fake Site Surfaces
Winston later found another fake Boichik site whose URL differed from the real one by a single letter, followed by two more, bringing the total to four. SFGATE reported that three of the domains had been registered within six weeks of one another.
The copies reproduced Boichik’s menu, merchandise and items such as bialys and schmears, including small details from the real shop. Winston reported the domains and sought their removal, but said new copies appeared despite her takedown emails. She told SFGATE she suspected artificial intelligence could be helping produce the sites and that the number of copies might keep growing.
Separately, cybersecurity tracking site PhishDestroy lists boichikbagelshq.shop as a related domain.
Part of a Much Larger Scam Network
Boichik was not the only Bay Area name identified as a target: Ghirardelli Chocolate and the San Francisco 49ers were also cited by SFGATE, which reported that neither had responded by publication. Selena Larson, principal threat researcher at Sunnyvale-based Proofpoint, told the outlet that fraudsters are cloning Shopify storefronts at scale to reach shoppers across tens of thousands of consumer brands.
Larson told SFGATE she had identified roughly 50,000 websites using designs and features copied from legitimate sites, including similar JavaScript, emoji placeholders and layouts for menus and photos. The report said the operators use a software development kit called PaymentVanilla to imitate Shopify’s payment process and link fake storefronts. Larson said the Boichik scam was related to another scam, dubbed GorgonAgora, that dates back at least a year and targets both small businesses and large organizations.
Separate research from cybersecurity firm Sansec described more than 4,800 fake .shop storefronts impersonating hundreds of brands since the GorgonAgora campaign became active in August 2025; a later count put the number of confirmed storefronts at 5,714. Sansec found that checkout pages sent stolen card data to a skimmer server in Moldova. The sites used a fake Stripe iframe to collect card numbers, expiration dates, CVVs and billing details, then exfiltrated the information over an encrypted connection.
What Shoppers and Businesses Can Do
As of October 30, Winston said she wasn’t aware of any customers who had actually been defrauded, as reported by SFGATE, but she stressed that the fake site was part of a card-phishing scheme and that customers shouldn’t become its victims. Fake retail websites like the ones targeting Boichik are part of a much larger criminal ecosystem built around payment fraud, and experts say the fight against them is far from over.
Businesses facing impersonation can report fraudulent domains to the relevant domain registrars, hosting providers and registries, and alert customers through channels such as social media or email. They should avoid sharing direct links to malicious sites, which could lead customers to click through. Consumers can reduce the risk of landing on a copycat store by bookmarking legitimate shopping sites and checking unfamiliar URLs before entering payment details.
What reporting guidance can—and can’t—tell shoppers
The California Department of Justice’s general online-shopping guidance warns that scammers may use fake websites featuring stolen images and unusually low prices. It is consumer advice, not a finding about who ran the Boichik copycats or whether its customers lost money, and it does not document a specific enforcement action involving those sites. California Department of Justice, Office of the Attorney General For domain complaints, ICANN’s guidance says to report an abusive domain first to its registrar or registry operator and allow reasonable time for an investigation. That guidance does not explain why a particular Boichik lookalike remained online or reappeared.
The stakes are real: Federal Trade Commission data cited in a June 2026 news release found that people reported losing $3.5 billion to imposter scams in 2025, with reported losses nearly tripling since 2020. That same release noted that imposter scams lure consumers through email, social media, search results and other means — a pattern that mirrors exactly what’s been happening to Boichik, which operates 10 Bay Area locations and two more in Los Angeles.
