Imagine you’re a plumber in Leeds. You’ve spent years building a decent reputation, a tidy website, and a steady stream of customers who find you through Google. Then one morning your phone rings and it’s an angry homeowner demanding a refund for a job you never did. Someone copied your website, took their £400 deposit, and vanished. Welcome to the website cloning scam hitting UK small businesses right now, and it’s nastier than most people realise.
This isn’t a fringe problem. Across the country, sole traders and small businesses in every sector, from florists in Bristol to electricians in Manchester to wedding photographers in Edinburgh, are discovering near-identical copies of their own websites sitting at slightly different domain names. The fake sites lift photos, testimonials, contact details, and branding wholesale. The only thing that changes is the bank account number where payments land. By the time a victim realises something is wrong, the money is gone and the scammer has moved on to the next cloned identity.
How the website cloning scam actually works
The mechanics are depressingly simple. Tools that scrape and mirror entire websites in minutes are freely available online. A fraudster picks a target, usually a local tradesperson or service business with good reviews but without a massive online footprint, grabs everything with an automated tool, registers a domain that looks plausible (think “leeds-plumbing-pro.co.uk” instead of the real “leedsplumbingpro.co.uk”), and publishes the clone. Then they either buy cheap Google Ads to push the fake site above the real one, or they create fake listings on comparison sites and directories using the cloned details.
Customers searching in a hurry, which is most people when the boiler has packed in at 7pm in January, click the first result that looks right. They fill in a contact form or call the number on the fake site. They get a quote. They pay a deposit. And then nothing. The real business has no idea any of this happened until the complaints start rolling in, by which point the fake site has often already been taken down and replaced with a fresh clone of someone else.
Why small businesses are the perfect targets
Big brands have legal teams, brand protection software, and the resources to respond fast. A florist in Bristol with two members of staff does not. Small businesses also tend to have consistent, trusted local reputations that scammers can exploit directly. A five-star Google rating built over eight years of honest work is incredibly useful if you can paste it onto a fake page and pocket the goodwill for a few weeks.
I’ve spoken to several small business owners who’ve been through this. One Bristol-based florist told me she only found out about the cloned site when a bride contacted her, furious, two weeks before her wedding. The bride had paid a £300 deposit via bank transfer to a site that had her exact photos, her exact testimonials, even her About Us paragraph word for word. Getting that money back proved almost impossible.
That’s the cruellest part of this. Authorised push payment (APP) fraud, where a victim is tricked into willingly transferring money to a fraudster’s account, has historically been one of the hardest categories to recover funds from. The Financial Conduct Authority has pushed hard for banks to improve reimbursement rates, and new rules introduced in late 2024 did require payment providers to reimburse most APP fraud victims up to £85,000. But victims still need to prove they took reasonable care, and plenty of claims get disputed or delayed.
What Trading Standards and Action Fraud are actually doing
Trading Standards operates at a local council level in the UK, which is part of the problem. Website cloning scams are often cross-regional, with the fraudster in one city, the victim in another, and the cloned business in a third. Coordinating between different Trading Standards offices is slow, and many local teams are under-resourced. Referrals to Action Fraud (the national reporting centre run by the City of London Police) generate a crime reference number, which is useful for insurance claims but rarely leads to a swift investigation for smaller amounts.
That said, there have been prosecutions. In 2025, a gang in the West Midlands was convicted after cloning more than 40 tradesperson websites over an 18-month period, netting over £200,000 in fraudulent deposits. The National Cyber Security Centre (NCSC) also runs a suspicious website reporting service that can accelerate takedowns through domain registrars. Businesses who spot a clone of their site can report it there and often see the fake page pulled within 48 to 72 hours, though by then the damage is usually done.
The NCSC has also flagged this as a growing concern in its annual Cyber Threat Report. Given that Ofcom and the CMA have been pushing hard on fake reviews and deceptive online practices, there’s pressure building for a more joined-up approach to cloned business identities specifically.
How to check if your business has been cloned
There are some practical steps any small business can take. Running a reverse image search on your main business photos through Google Images or TinEye takes about two minutes and will surface any sites using your visuals. Searching for exact phrases from your About Us page or key service descriptions in quotes will sometimes catch a cloned site that’s indexed on Google. Tools like Copyscape let you check for duplicate versions of your web copy across the internet.
My honest take: every small business owner should do this check once a fortnight. It sounds like a chore, but finding a clone early, before your customers have had a chance to lose money, is infinitely better than finding out via a furious phone call. If you do find a clone, document everything with screenshots immediately, report to Action Fraud, contact the domain registrar directly with a DMCA-style takedown notice, and alert your existing customers through your real channels straight away.
The broader issue here is that trust in local tradespeople online is quite fragile. We already know from the chaos around fake restaurant names on delivery platforms that consumers are often dealing with businesses that aren’t quite what they seem, and the website cloning scam UK small business operators are facing is a nastier, more personalised version of the same erosion of trust. And as AI tools get cheaper and easier to use, the technical barrier to cloning a website is only going to fall further.
What needs to change
The gap between reporting a cloned site and getting it removed needs to close significantly. The NCSC takedown service is useful but not well known enough among small business owners. Banks need to be faster and more consistent in applying the APP fraud reimbursement rules. And Trading Standards teams need proper funding to pursue cross-regional cases, rather than being stretched across everything from mislabelled food to dodgy landlords with no extra resource for digital fraud.
In the meantime, the best defence a small business has is visibility. Make it obvious on your real site what your legitimate payment methods are, display your Companies House registration number, and encourage customers to call a number they find independently, not just the one listed on whichever search result they clicked first. Scammers are banking on speed and panic. Slow things down and their cover falls apart fast.
Frequently Asked Questions
How do I know if my small business website has been cloned by scammers?
Run a reverse image search on your main business photos using Google Images and search for exact phrases from your website copy using quote marks in Google. Tools like Copyscape can also scan the web for duplicate versions of your text. Doing this check every couple of weeks is the most reliable way to catch a clone early.
What should I do if I've found a fake copy of my business website?
Screenshot everything immediately, then report the fake site to Action Fraud (actionfraud.police.uk) and to the National Cyber Security Centre’s suspicious website reporting service. Contact the domain registrar where the fake site is hosted and send a formal takedown request. Alert your existing customers through your genuine channels so they know to be cautious.
Can I get my money back if I paid a deposit to a cloned business website?
Under APP fraud rules introduced in late 2024, UK banks and payment providers are required to reimburse most victims of authorised push payment fraud up to £85,000, provided you took reasonable care. Contact your bank immediately, report the fraud to Action Fraud, and keep all evidence of the transaction and the fake website.
How long does it take to get a cloned website taken down in the UK?
Reporting through the NCSC’s suspicious website service can result in a takedown within 48 to 72 hours in straightforward cases. More complex situations, particularly where the domain is registered overseas, can take longer. Acting fast and contacting both the registrar and the NCSC simultaneously gives you the best chance of a quick removal.