Canonical URL: https://giftcard.news/fraud-security/malwarebytes-fake-bitrefill-checkouts-gift-card-payments/ --- description: A September 15 investigation documents lookalike sites that reproduce the retailer’s purchase flow and direct cryptocurrency to scammers. title: Malwarebytes finds fake Bitrefill checkouts diverting gift-card payments image: https://giftcard.news/images/social/v1/malwarebytes-finds-fake-bitrefill-checkouts-diverting-gift-card-payments-3dac6bd3f4a10f506c0c6866b0d3ae8a.jpg --- 1. [Home](https://giftcard.news/) 2. [Fraud & Security](https://giftcard.news/fraud-security/) # Malwarebytes finds fake Bitrefill checkouts diverting gift-card payments A September 15 investigation documents lookalike sites that reproduce the retailer’s purchase flow and direct cryptocurrency to scammers. By [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) September 15, 2026 1 min read [ Google News ](https://google.com/preferences/source?q=giftcard.news&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) Share [ ](https://x.com/intent/post?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fmalwarebytes-fake-bitrefill-checkouts-gift-card-payments%2F%3Futm%5Fsource%3Dx%26utm%5Fmedium%3Dsocial&text=Malwarebytes+finds+fake+Bitrefill+checkouts+diverting+gift-card+payments&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "X") [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fmalwarebytes-fake-bitrefill-checkouts-gift-card-payments%2F%3Futm%5Fsource%3Dlinkedin%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "LinkedIn") [ ](https://wa.me/?text=Malwarebytes+finds+fake+Bitrefill+checkouts+diverting+gift-card+payments+https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fmalwarebytes-fake-bitrefill-checkouts-gift-card-payments%2F%3Futm%5Fsource%3Dwhatsapp%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "WhatsApp") ![Customer hands holding a blue card at a retail payment terminal](https://giftcard.news/images/variants/v1/malwarebytes-finds-fake-bitrefill-checkouts-diverting-gift-card-payments-customer-hands-holding-w1280.webp) Illustrative card transaction; not a photograph of an affected customer, website or security incident. Photo: SpotOn / Unsplash [Malwarebytes](https://giftcard.news/company/malwarebytes/) has documented a group of websites impersonating [Bitrefill](https://giftcard.news/company/bitrefill/)'s checkout to divert cryptocurrency from people trying to buy gift cards. In a September 15 investigation [\[S01\]](#article-source-1), researcher Stefan Dasic described lookalike domains that copied the retailer's branding and purchase flow. The examined checkout offered payments of up to $1,990, then displayed a cryptocurrency address, QR code and countdown timer. The money was directed to addresses controlled by scammers. The report concerns unaffiliated imitation sites, rather than a disclosed intrusion into Bitrefill accounts or systems. Bitrefill's own storefront [\[S02\]](#article-source-2) sells digital gift cards, prepaid payment cards, mobile refills and eSIMs. Its normal gift-card purchase process accepts cryptocurrency and delivers a redemption code, helping explain why that payment method can appear plausible in a copied checkout. Malwarebytes found variants that changed letters in the brand name or added payment-related wording. Some used internationalized domain names with visually similar characters. It also observed commercial analytics software and a link parameter referring to a search engine, evidence it said pointed to traffic tracking. The report published domain indicators but did not establish total victim losses, transaction volumes or the campaign's starting date. The $1,990 figure describes the examined checkout's payment ceiling, not a measured loss. ## In this article ### Companies * [Bitrefill](https://giftcard.news/company/bitrefill/) * [Malwarebytes](https://giftcard.news/company/malwarebytes/) ### Sources and documents * [\[S01\] Original primary announcement](https://www.malwarebytes.com/blog/threat-intel/2026/09/search-results-are-sending-people-to-fake-bitrefill-checkouts?utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) — Malwarebytes * [\[S02\] Official supporting context](https://www.bitrefill.com/us/en/?utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) — Bitrefill Share [ ](https://x.com/intent/post?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fmalwarebytes-fake-bitrefill-checkouts-gift-card-payments%2F%3Futm%5Fsource%3Dx%26utm%5Fmedium%3Dsocial&text=Malwarebytes+finds+fake+Bitrefill+checkouts+diverting+gift-card+payments&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "X") [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fmalwarebytes-fake-bitrefill-checkouts-gift-card-payments%2F%3Futm%5Fsource%3Dlinkedin%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "LinkedIn") [ ](https://wa.me/?text=Malwarebytes+finds+fake+Bitrefill+checkouts+diverting+gift-card+payments+https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fmalwarebytes-fake-bitrefill-checkouts-gift-card-payments%2F%3Futm%5Fsource%3Dwhatsapp%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "WhatsApp") ![Portrait of Daniel Brooks](https://giftcard.news/images/variants/v1/daniel-brooks-editorial-portrait-w320.webp) About the author ## [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) Journalist — Payments, Security & PCI DSS Daniel Brooks covers payment networks, financial technology, payment security, gift card fraud and PCI DSS for Gift Card News. From reading to building ## Your next move in gift cards. Tell us what you’re building. We’ll help you explore suitable providers. [Find a provider ](https://giftcard.news/find-a-provider/) ## Related articles [Fraud & Security](https://giftcard.news/fraud-security/) News ### [giftee Group estimates JPY 550 million loss after unauthorized e-gift issuance](https://giftcard.news/fraud-security/giftee-unauthorized-egift-issuance-estimated-loss-2026/) [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) October 26, 2026 3 min [Fraud & Security](https://giftcard.news/fraud-security/) News ### [San Francisco settlement creates $1.525 million Vanilla gift-card fund](https://giftcard.news/fraud-security/san-francisco-vanilla-gift-card-restitution-fund/) [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) October 23, 2026 4 min [Fraud & Security](https://giftcard.news/fraud-security/) News ### [Valuedesign reports card-data leak as MOS resets PINs](https://giftcard.news/fraud-security/valuedesign-value-card-data-leak-mos-card-2026/) [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) October 23, 2026 4 min ```json {"@context":"https://schema.org","@graph":[{"@type":"NewsMediaOrganization","@id":"https://giftcard.news/#publisher","name":"Gift Card News","url":"https://giftcard.news/","description":"News and analysis covering gift cards, retail, loyalty, rewards and payments worldwide.","logo":{"@type":"ImageObject","url":"https://giftcard.news/icon-512.png","contentUrl":"https://giftcard.news/icon-512.png","width":512,"height":512,"@id":"https://giftcard.news/#logo"},"publishingPrinciples":"https://giftcard.news/editorial-policy/","correctionsPolicy":"https://giftcard.news/editorial-policy/"},{"@type":"WebSite","@id":"https://giftcard.news/#website","url":"https://giftcard.news/","name":"Gift Card News","description":"News and analysis covering gift cards, retail, loyalty, rewards and payments worldwide.","inLanguage":"en","publisher":{"@id":"https://giftcard.news/#publisher"},"potentialAction":{"@type":"SearchAction","target":"https://giftcard.news/search/?q={search_term_string}","query-input":"required name=search_term_string"}},{"@type":"Person","@id":"https://giftcard.news/author/daniel-brooks/#person","name":"Daniel Brooks","url":"https://giftcard.news/author/daniel-brooks/","description":"Daniel Brooks covers payment networks, financial technology, payment security, gift card fraud and PCI DSS for Gift Card News.","jobTitle":"Journalist — Payments, Security & PCI DSS","image":{"@type":"ImageObject","url":"https://giftcard.news/images/daniel-brooks-editorial-portrait.webp","contentUrl":"https://giftcard.news/images/daniel-brooks-editorial-portrait.webp","width":1254,"height":1254,"caption":"Illustrated portrait representing the Daniel Brooks editorial profile.","@id":"https://giftcard.news/images/daniel-brooks-editorial-portrait.webp#image","encodingFormat":"image/webp","description":"Illustrated portrait for Daniel Brooks, a Gift Card News editorial pen name","creditText":"Gift Card News / AI-generated illustration"}},{"@type":"ImageObject","url":"https://giftcard.news/images/malwarebytes-finds-fake-bitrefill-checkouts-diverting-gift-card-payments-customer-hands-holding.webp","contentUrl":"https://giftcard.news/images/malwarebytes-finds-fake-bitrefill-checkouts-diverting-gift-card-payments-customer-hands-holding.webp","width":1920,"height":1440,"caption":"Illustrative card transaction; not a photograph of an affected customer, website or security incident.","@id":"https://giftcard.news/images/malwarebytes-finds-fake-bitrefill-checkouts-diverting-gift-card-payments-customer-hands-holding.webp#image","encodingFormat":"image/webp","description":"Customer hands holding a blue card at a retail payment terminal","creditText":"SpotOn / Unsplash","isBasedOn":"https://unsplash.com/photos/customers-interacting-with-a-cashier-and-a-point-of-sale-system-u1DVI-1UUV8"},{"@type":"NewsArticle","@id":"https://giftcard.news/fraud-security/malwarebytes-fake-bitrefill-checkouts-gift-card-payments/#article","url":"https://giftcard.news/fraud-security/malwarebytes-fake-bitrefill-checkouts-gift-card-payments/","headline":"Malwarebytes finds fake Bitrefill checkouts diverting gift-card payments","description":"A September 15 investigation documents lookalike sites that reproduce the retailer’s purchase flow and direct cryptocurrency to scammers.","datePublished":"2026-09-15T00:00:00.000Z","dateModified":"2026-10-04T13:49:46.642Z","inLanguage":"en","mainEntityOfPage":{"@id":"https://giftcard.news/fraud-security/malwarebytes-fake-bitrefill-checkouts-gift-card-payments/#webpage"},"isPartOf":{"@id":"https://giftcard.news/#website"},"isAccessibleForFree":false,"hasPart":[{"@type":"WebPageElement","isAccessibleForFree":false,"cssSelector":".reader-restricted"}],"image":[{"@type":"ImageObject","url":"https://giftcard.news/images/malwarebytes-finds-fake-bitrefill-checkouts-diverting-gift-card-payments-customer-hands-holding.webp","contentUrl":"https://giftcard.news/images/malwarebytes-finds-fake-bitrefill-checkouts-diverting-gift-card-payments-customer-hands-holding.webp","width":1920,"height":1440,"caption":"Illustrative card transaction; not a photograph of an affected customer, website or security incident.","@id":"https://giftcard.news/images/malwarebytes-finds-fake-bitrefill-checkouts-diverting-gift-card-payments-customer-hands-holding.webp#image","encodingFormat":"image/webp","description":"Customer hands holding a blue card at a retail payment terminal","creditText":"SpotOn / Unsplash","isBasedOn":"https://unsplash.com/photos/customers-interacting-with-a-cashier-and-a-point-of-sale-system-u1DVI-1UUV8"}],"articleSection":"Fraud & Security","keywords":["Bitrefill","Malwarebytes"],"mentions":[{"@type":"Organization","@id":"https://giftcard.news/company/bitrefill/#entity","name":"Bitrefill","url":"https://giftcard.news/company/bitrefill/"},{"@type":"Organization","@id":"https://giftcard.news/company/malwarebytes/#entity","name":"Malwarebytes","url":"https://giftcard.news/company/malwarebytes/"}],"wordCount":202,"citation":[{"@type":"CreativeWork","name":"[S01] Original primary announcement","url":"https://www.malwarebytes.com/blog/threat-intel/2026/09/search-results-are-sending-people-to-fake-bitrefill-checkouts","publisher":{"@type":"Organization","name":"Malwarebytes"}},{"@type":"CreativeWork","name":"[S02] Official supporting context","url":"https://www.bitrefill.com/us/en/","publisher":{"@type":"Organization","name":"Bitrefill"}}],"author":[{"@id":"https://giftcard.news/author/daniel-brooks/#person"}],"publisher":{"@id":"https://giftcard.news/#publisher"}},{"@type":"WebPage","@id":"https://giftcard.news/fraud-security/malwarebytes-fake-bitrefill-checkouts-gift-card-payments/#webpage","url":"https://giftcard.news/fraud-security/malwarebytes-fake-bitrefill-checkouts-gift-card-payments/","name":"Malwarebytes finds fake Bitrefill checkouts diverting gift-card payments","description":"A September 15 investigation documents lookalike sites that reproduce the retailer’s purchase flow and direct cryptocurrency to scammers.","datePublished":"2026-09-15T00:00:00.000Z","dateModified":"2026-10-04T13:49:46.642Z","inLanguage":"en","isPartOf":{"@id":"https://giftcard.news/#website"},"mainEntity":{"@id":"https://giftcard.news/fraud-security/malwarebytes-fake-bitrefill-checkouts-gift-card-payments/#article"},"breadcrumb":{"@id":"https://giftcard.news/fraud-security/malwarebytes-fake-bitrefill-checkouts-gift-card-payments/#breadcrumbs"},"primaryImageOfPage":{"@id":"https://giftcard.news/images/malwarebytes-finds-fake-bitrefill-checkouts-diverting-gift-card-payments-customer-hands-holding.webp#image"}},{"@type":"BreadcrumbList","@id":"https://giftcard.news/fraud-security/malwarebytes-fake-bitrefill-checkouts-gift-card-payments/#breadcrumbs","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://giftcard.news/"},{"@type":"ListItem","position":2,"name":"Fraud & Security","item":"https://giftcard.news/fraud-security/"},{"@type":"ListItem","position":3,"name":"Malwarebytes finds fake Bitrefill checkouts diverting gift-card payments","item":"https://giftcard.news/fraud-security/malwarebytes-fake-bitrefill-checkouts-gift-card-payments/"}]}]} ```