Brand impersonation, online ads, and malicious merchants help purchase scam network prey on victims

Recorded Future Payment Fraud Intelligence identified lidlorg.com as part of a network of 71 likely purchase-scam e-commerce domains (active since Feb 2025) that impersonate brands, run ad campaigns, and reuse a set of merchant accounts to defraud buyers and enable card compromise and transaction laundering; the report maps domain-to-merchant links, assesses attribution scenarios (single operator vs. third-party cash-out ecosystem), and provides mitigation guidance for card issuers and merchant acquirers.