A shopper looking for a gift card can reach what looks like Bitrefill’s checkout, choose a cryptocurrency and complete a real payment—without buying anything. In research published on September 15, Malwarebytes documented a cluster of imitation sites that collect money at addresses controlled by scammers. The deception copies the purchase itself; it does not need to steal a password first.
Bitrefill sells gift cards, eSIMs and phone top-ups and genuinely accepts cryptocurrency. That makes this impersonation unusually convincing: the requested payment method fits the service. The report concerns third-party copies, not evidence that Bitrefill’s own checkout was breached.
The order looks normal until the money has gone
The researchers followed a checkout that asks for an email address, offers familiar cryptocurrency choices and lets the visitor select an amount. Its displayed maximum was $1,990—a limit on the examined page, not a measured loss per victim. Privacy and terms links help frame the interaction as routine shopping.
The screenshot also mixes dollar and euro labels. That inconsistency is a clue in this copy, not a rule that every fake will reveal itself so conveniently.
The last step supplies a payment address and QR code, converts the amount into the chosen coin and runs a countdown of almost an hour. These details make the fake feel operational. They are also poor authenticity tests: Bitrefill’s own payment documentation says each order generates a new address. A fresh address or expiring invoice can belong to a legitimate purchase, too.
The trust decision therefore happens before the transfer: who supplied that invoice? If the shopper accepts the cloned page as the merchant, the wallet can send exactly the requested amount to exactly the displayed address and still complete the scam. Two-factor authentication on an exchange does not verify that the recipient is Bitrefill.
Search traffic becomes a counterfeit purchase
Malwarebytes reports that the lookalikes appear in search results. In the examined configuration, a link back to a related domain included a search-engine tracking parameter. Commercial analytics software was also present. Together, those observations suggest operators are tracking how visitors reach the checkout and progress through it; they do not establish a conversion rate or victim total.
The domain names exploit both familiar words and unfamiliar characters. Some append payment-related wording to the brand; others use lookalike letters or internationalized names. Examples in the published indicator list include bitrefill-payments[.]com and bitrefill-pays[.]com. These are separate domains, not subdomains of bitrefill.com.
Some internationalized domains have an ASCII representation beginning with xn--, called Punycode. That prefix alone is not evidence of fraud. The relevant issue is impersonation: a name can look familiar while resolving to an unrelated operator. Copying a checkout’s design is easier than establishing its identity.
Verify the merchant before verifying the transfer
Open Bitrefill through a saved bookmark or enter bitrefill.com yourself, then begin the order there. Do not use a separate search result as a shortcut to its payment screen. Our wallet-verification guide explains why checking an address’s format or history cannot prove who owns it.
A suspicious domain can be checked with Gridinsoft Website Reputation Checker as an additional signal. A clean or unknown result is not proof that a freshly created checkout belongs to the brand.
If you paid, preserve the transaction hash, receiving address, full page URL and screenshots, then contact your exchange or wallet provider and Bitrefill through independently reached support. A completed blockchain payment generally has no ordinary chargeback. Be especially wary of recovery offers demanding another upfront payment.
This case turns a normal buying habit into the attack. The decisive check is the source of the invoice, before a convincing checkout persuades you to authorize an irreversible transfer.
References
- Malwarebytes. “Search results are sending people to fake Bitrefill checkouts.” September 15, 2026. Research report.
- Bitrefill. “Common scams to avoid when using Bitrefill.” Accessed September 15, 2026. Merchant guidance on impersonation.
- Bitrefill. “Can I pay to the same address for different purchases?” Accessed September 15, 2026. Payment-address documentation.
