How to report a fake store to Microsoft

Microsoft keeps its own list of unsafe sites. Microsoft Defender SmartScreen, which works in Microsoft Edge, checks “visited sites against a dynamic list of reported phishing sites and malicious software sites.” A report to Microsoft does not remove the site. If Microsoft flags it, shoppers on Edge can see a warning before the page loads.

Microsoft’s form is quick, and it takes up to 100 addresses at once. Send it alongside your Google Safe Browsing report.

Checked against Microsoft’s public pages on October 14, 2026. Microsoft can change its process, so check the linked pages before you report.

When should you report a fake store to Microsoft?

Report when the fake store pretends to be your store to collect card or login details. Microsoft’s form describes phishing as:

“Site impersonates another site to gather credentials or other sensitive information”

A clone that only copies your photos, with no checkout or login, is a copyright problem. Send that to the host with a DMCA notice.

How do you report a fake store to Microsoft?

1. Save the evidence first. Take a dated screenshot of the clone’s checkout or login page. Do not enter real card details.
2. Open the form. Use Report an unsafe site if you can sign in. Microsoft says: “Help us handle your submission efficiently by signing in with your personal Microsoft account or your corporate account.” Without an account, use the guest form.
3. Enter the addresses. Type one URL, or upload a .txt file with one URL per line. The guest form accepts “up to 100 URLs only”, in a file under 1 MB.
4. Choose the threat type “Phishing”.
5. Pick the language of the site, complete the check and submit.
6. Log the report with the date and the addresses.

What evidence should you have ready?

• The exact URL of each clone page that asks for card or login details
• A .txt file with one URL per line, if you have several clones
• A dated screenshot of each page, for your own records
• The language of the clone site

Copy-paste URL list for Microsoft

Save this as a plain .txt file, one address per line. Replace the examples with your clone addresses.

https://[clone-one.shop]/
https://[clone-one.shop]/checkout
https://[clone-two.shop]/
https://[clone-two.shop]/checkout

The guest form asks only for the addresses, the threat type and the language. The URL list is the whole report.

What happens after you report to Microsoft?

Microsoft decides whether to flag each address.

• How Microsoft reviews: it says: “Microsoft processes thousands of requests to review websites everyday. To speed up our reviews, we use automated systems built on artificial intelligence and our Intelligent Security Graph.”
• Timing: not stated by Microsoft for a single report.
• Confirmation of the result: not stated by Microsoft.

To check the result, open the clone in Microsoft Edge after a day or two. A warning page means the flag is live. The site is still online, so send your registrar and host reports too.

Other reports to send

• Google Safe Browsing, for Chrome and Google services.
• The registrar, for example Dynadot, Namecheap or GoDaddy.
• The .shop registry, for .shop clones.
• See how to report a fake Shopify store for every channel, and download all the templates.

Let Recon prepare the reports

Recon is a Shopify app that watches for clones of your store. On every plan, it finds who to report each clone to, including Microsoft and Google Safe Browsing, and writes the notices for you to review and send. Early access on Pro: one click, and Recon files the reports for you. Microsoft decides whether to show a warning. Recon never removes sites itself.

Add Recon to Shopify, or run a free website check first.

Sources

• Microsoft, report an unsafe site: microsoft.com
• Microsoft, report an unsafe site (guest): microsoft.com
• Microsoft Defender SmartScreen overview: learn.microsoft.com