What was certified
The certified products are Avast Premium Security, Bitdefender Total Security, F-Secure Internet Security, Kaspersky Premium, NordVPN Next-gen antivirus, Norton 360 Deluxe and Norton VPN Ultimate.
This is a certification list, not a ranking. The announcement text doesn't give per-product detection scores. Anyone who wants to say one certified product beat another should read the detailed product reports on AV-Comparatives' site first.
How the test worked
- Timing: From Oct. 1 to 7, 2026, products faced 500 fake-shop URLs. These were randomly selected from a larger pool of URLs that were still online at the time of testing.
- False alarms: A false-alarm test with 100 popular legitimate shopping websites was also conducted.
- Pass mark: To be certified, a product had to detect at least 80% of the fake shops without a single false alarm.
- Platform: AV-Comparatives says all tests ran on a fully patched Windows 11 64-bit system with Google Chrome as the default browser. Results for other browsers, operating systems or non-default settings may differ.
The zero-false-alarm rule matters in practice. A product that cries wolf on legitimate retailers during peak shopping season teaches users to click through warnings. That's arguably worse than a missed detection.
The scam figures, and how far to trust them
The release leans on a Savi Security report. According to the AV-Comparatives release, Savi's 2026 Holiday Shopping Scam Report, published Oct. 20, says users of its Scamwise service report a new fake store roughly every three minutes, about 500 a day. It also says reports of holiday-themed fake stores grew fivefold in 60 days, and that 85% of fake stores vanish within two weeks.
Treat these as one company's numbers about reports to its own service. They aren't a census of all fake shops. I couldn't locate the underlying report independently. The direction is plausible, and the short lifespan fits AV-Comparatives' earlier work. In its November 2024 test, only 189 of 500 fake-shop cases from the June test were still online. The 2026 Savi statistics are not validated by that older data.
Why this matters to Windows users
Fake shops are a different problem from classic malware. The risk is handing card details to a criminal, or paying for goods that never arrive. A conventional antivirus scan has little to say about either.
AV-Comparatives' earlier fake-shop report separated dedicated tools from general security suites. It said non-dedicated products, meaning ordinary internet security suites, may only partly detect fake shops. It also found that most products seemed to rely on blacklists, some not very current. That is why a certification for this narrow capability is worth noting. It also shouldn't be read as an overall endorsement.
In 2024, AV-Comparatives listed Avast, AVG, F-Secure, Fake-Shop Detector, NordVPN and Norton as certified. This year's list includes Bitdefender and Kaspersky, which weren't in that 2024 list, and doesn't include AVG or Fake-Shop Detector. The 2024 and 2026 tests differ in design, so I'd avoid reading too much into that.
Practical checklist for the Black Friday rush
AV-Comparatives' advice is sensible, and none of it needs special software.
- Check the domain closely. Scammers often register names that differ from a known brand by only one or two letters.
- Look for basics. Legitimate shops typically list a physical address, phone number and email address, plus clear shipping, returns and refund policies.
- Be suspicious of extreme discounts. AV-Comparatives says discounts above 60 to 70% on luxury goods, such as designer handbags, high-end electronics or premium clothing, are a typical sign of a fraudulent site.
- Don't trust the padlock. HTTPS and the padlock icon don't prove a shop is genuine.
- Pay with buyer protection. Avoid advance payments and unfamiliar foreign bank accounts.
- Watch your statements. Set up transaction alerts with your bank so you can spot and report fraud quickly.
- Look up the domain registration. This can help reveal a suspicious site.
Limits to keep in mind
- Vendor-run test: The release comes from AV-Comparatives, and its test page matches it. Neither is independent corroboration of the Savi figures.
- Snapshot in time: The test covers one week, with a finite URL sample. Fake shops that appear after that week, or products updated afterwards, may behave differently.
- Narrow scope: Certification covers fake-shop warnings only. It doesn't measure malware protection, performance or privacy.
- Product tiers: The certified products are named editions. A cheaper or free tier from the same vendor may not include the same web protection.
Bottom line
If you already run one of the seven certified suites on Windows 11 with Chrome, keep its web protection switched on. It's a reasonable extra layer for the holiday rush. If you don't, the test doesn't justify switching suites on its own. Combine whatever protection you have with the checklist above, and use a card or payment provider that offers buyer protection.