Is Shein Legit? The Store Is Real — Its Record and Its Impostors Are the Story

Legit retailer — with a documented record and a standing wave of impostors. Shein is a real store that does deliver, but real isn't spotless: New York's attorney general documented a 2018 breach of 39 million Shein and 7 million Romwe accounts that the company downplayed, ending in a $1.9 million settlement and a mandatory security overhaul. If you shop, use a unique password, pay with a method that gives you a dispute path, and share the minimum data — and make sure the site is actually Shein, because the day-to-day scam risk is the lookalike clone stores trading on its name.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL free Read the full guide

Why this question never goes away

Shein is a real retailer — parent company Zoetop, which also owns Romwe — and millions of orders do arrive. But real isn't the same as spotless. In 2018, attackers stole 39 million Shein and 7 million Romwe account credentials, including more than 800,000 New Yorkers'. New York's attorney general found the company contacted only a fraction of affected customers, failed to even alert more than 32.5 million accounts, publicly claimed only 6.42 million consumers were impacted, and said it had seen no evidence credit card data was taken — statements the AG calls misrepresentations. The 2022 settlement: $1.9 million in penalties plus a mandatory security overhaul. The practical takeaways: if you shop there, use a unique password, pay with a method that gives you a dispute path, and share the minimum data. And the day-to-day scam risk usually isn't Shein itself — it's the wave of lookalike clone stores trading on its name, which is where a link check earns its keep.

Five red flags — any one is enough

A “Shein” site that isn't shein.com — lookalike domains with extra words, hyphens, or odd TLDs are the clone pattern.

Prices even lower than Shein's, on a site that looks like Shein — the clone's hook.

Reusing your Shein password anywhere — 39 million account credentials were stolen in the breach the NY AG documented.

A “Shein warehouse sale” or clearance link arriving via social ad or DM — the impersonation wave's delivery channel.

Paying on any fashion site in a way with no dispute path — gift cards, wire transfers, or crypto are gone like cash.

Your next three moves

Verify through a channel you open yourself — shop only at shein.com or the official app, typed or opened by you. Treat any “Shein warehouse sale” or clearance link arriving by social ad or DM as the impersonation wave's delivery channel until the domain proves otherwise.

Refuse the ask: no account on a lookalike “Shein” domain with extra words, hyphens, or an odd TLD; no reused Shein password anywhere — 39 million account credentials were stolen in the breach the NY AG documented; and no payment by gift card, wire, or crypto on any fashion site.

Report lookalike clone stores at reportfraud.ftc.gov and to your state attorney general — the NY AG's investigation is what put Shein's record on the record — and paste the link into the $2 instant check for a 0–100 scam risk score before you buy.

Is Shein a real company that actually delivers?

Yes — a real retailer (parent company Zoetop, which also owns Romwe), and millions of orders do arrive. Real isn't the same as spotless: the documented record includes a breach of 39 million Shein and 7 million Romwe accounts and a $1.9 million NY AG settlement.

What did the New York AG's investigation find?

Per the AG: after the 2018 breach the company contacted only a fraction of affected customers, failed to even alert more than 32.5 million accounts, publicly claimed only 6.42 million consumers were impacted, and said it had seen no evidence credit card data was taken — statements the AG calls misrepresentations. The 2022 settlement added a mandatory security overhaul.

How do I shop on Shein more safely?

Use a unique password — 39 million account credentials were stolen in the breach the NY AG documented — pay with a method that gives you a dispute path (never gift cards, wire, or crypto), and share the minimum data.

How do I know the site I'm on is actually Shein?

Check the domain: a “Shein” site that isn't shein.com — extra words, hyphens, or odd TLDs — is the clone pattern, and prices even lower than Shein's are the clone's hook. Paste the link into the $2 instant check for a 0–100 scam risk score before you buy.

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Spot the scam before it spots you.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.