Key takeaways:

Temu is a legitimate online marketplace. That doesn’t mean that the products sold through it are safe or of high quality, nor does it mean that anything using the Temu name is authentic or automatically safe
Because of its high name recognition and reputation for bargains, fraudsters often impersonate the company to scam the public
Criminals impersonate Temu to make phishing emails appear legitimate, carry out tech support scams, and engage in other forms of fraud and cyber attack

What does safe online shopping look like?

There’s a big difference between online shopping and visiting a mall.

Bricks-and-mortar retailers need to be located near their customers. They need to buy and stock products in multiple locations, and they are physically present if you have a problem.

Online retailers work differently. They can act as the virtual storefront for thousands of manufacturers, resellers and merchants without having to hold their stock – or inspect it for safety or quality. They also don’t need to be in the same location, or even on the same continent, as their customers.

In this article, we’re going to look at security, privacy and how to recover if you fall victim to a scam when shopping online via the Chinese retailer Temu.

Consumers need to be vigilant when shopping online in ways they do not need to be when shopping in physical stores. There are four main considerations:

Security: How do you shop and pay for goods? Can someone get access to your account, payment methods or device?
Privacy: Linked intrinsically to security, it’s important to know what data or permissions an online service asks for and what you, as a consumer, can control.
Consumer protection: You need to know what happens if something you’ve bought is late or doesn’t arrive, or if it’s faulty, dangerous, or not as described.
Product quality: Again, tied to consumer protection, product quality is concerned with whether an item is as described, of expected quality, authentic and appropriate for sale or use in your country.

Is Temu a legitimate company, and what does that guarantee?

Temu is a legitimate business that began operations in 2022, offering consumers in multiple international markets a huge selection of products at very attractive prices. Part of the reason for the low prices was how Temu operates: most products were originally shipped direct to consumers from warehouses or manufacturers in China, removing the need to store inventory in multiple countries, avoiding customs charges by shipping cheap products individually to buyers, and taking advantage of the affordability of China’s postal system. In this respect, it is similar in approach to Chinese online retailers like Alibaba and Shein.

The company operates in much the same way as eBay, Amazon or Alibaba, acting as a middleman between consumers and producers that replaces traditional importers, distributors and retailers and uses the internet to keep costs down.

One thing to be aware of is that manufacturers in China do not need to follow the same safety or modern slavery laws as manufacturers elsewhere – and they may not necessarily bear this in mind when selling overseas. Multiple consumer safety groups in Europe have reported the presence of toxic chemicals in products sold via Temu.

Recently, Temu has established a local presence in over 90 countries to reduce shipping and customs complications, and to shorten delivery times.

There are three types of cyber-related risks to be aware of when shopping on Temu that also apply when shopping with other online retailers:

Marketplace and listing risks: A product offered for sale may be counterfeit, of low quality or misrepresented. It may not even arrive at the consumer’s doorstep. If there is a problem, returning, exchanging or successfully requesting a refund may be difficult or impossible.
Account and privacy risk: Personal data and information, permissions and credentials associated with shopping with a merchant may be misused, stolen or sold.
Impersonation risk: Successful online brands are often misappropriated by criminals to make their scams appear legitimate and attractive to the public. Criminals regularly impersonate brands such as Temu to disguise fake websites, apps, messages, promotions, or support communications as legitimate communication.

There’s a clear distinction to be made between an unsatisfactory transaction with Temu, and a fraudulent impersonation of Temu that results in a cyber threat. If the product you ordered from Temu doesn’t turn up, that might be an issue with the postal service or straight-up fraud by a supplier – but it doesn’t mean your information has been put up on the Dark Web for criminals to make use of. But a message that successfully deceives someone into thinking they are communicating with Temu is a significant cyber threat.

How do scammers exploit the Temu brand?

The internet has, unfortunately, made impersonating trusted brands as easy as right-clicking on a company logo and stealing it. Look at it this way: If your local café sells delicious and very affordable pastries, and you used to go to school with the owner, then it’s pretty difficult to be fooled by a criminal impersonating them to try and sell fake pastries or attempt to steal your wallet; you’d be pretty suspicious if they didn’t look like the proprietor and were selling pastries from a truck instead of their cafe. But with an online retailer, criminals can misuse a well-known brand to get people to lower their guard, especially if they’ve recently been interacting with that brand. If you receive a text message, email or phone call that appears to be from Temu, then it can feel believable – especially if you regularly shop there.

This problem is most definitely not restricted to Temu, by the way: we’ve detailed how it affects other giant online retailers like Amazon, and popular online travel agents like Booking.com and AirBnB. Another thing to note is that the nature of these businesses is often reflected in the types of messages and scams criminals produce when stealing the brand’s identity. Temu is no different: The way it attracts and sells to people is exploited by criminals in their frauds, too.

Fake Temu offers, codes and free gifts

A straightforward way to avoid falling victim to this scam is to log into Temu’s website (enter the details directly in your browser rather than clicking on a link), or open the official app to check your messages.

Fake Temu texts, emails and delivery alerts

The lever here is urgency: the scammer sends a message alerting the recipient to a refund, delayed delivery, or order issue, all with the intention of creating panic and a sense of urgency. The good news is that there’s a single thing that defuses this: a quick check of your Temu account on the website or app will reveal any problems.

Fake delivery alerts, reward offers, and customer support scams often rely on phishing links designed to steal your credentials or payment details. See how ESET HOME Security Ultimate helps detect and block phishing attempts before they can do harm.

Fake delivery alerts, reward offers, and customer support scams often rely on phishing links designed to steal your credentials or payment details. See how ESET HOME Security Ultimate helps detect and block phishing attempts before they can do harm.

Fake Temu websites, apps and customer support

Once more, these sorts of scams rely on brand recognition. Criminals can create lookalike domains or domains that appear at first glance to be associated with Temu. In some cases, fake apps impersonating Temu are used to mislead victims. Social media accounts that impersonate Temu employees or teams (such as customer support) also look for and actively engage with customers voicing their frustration or issues publicly, and attempt to steal data by impersonating the company.

Again, the lever here is urgency or distress, and the safest option is to check your Temu account independently.

Not sure whether a link is safe? Before you click, check suspicious URLs with the free ESET Link Checker and help avoid phishing websites, scams, and other online threats.

Not sure whether a link is safe?

Before you click, check suspicious URLs with the free ESET Link Checker and help avoid phishing websites, scams, and other online threats.

Misleading Temu listings and less common scams

As with other online marketplaces, Temu can suffer from merchants who are less than honest, and use Temu’s systems to perpetrate fraud. This can include brushing scams, phony job offers and suspicious pallet or liquidation deals. If you’ve not heard of it before, a brushing scam involves a merchant sending an unexpected package to a member of the public. Since the postal system and the online platform’s system show a package was delivered, the merchant can then create a fake review of a product that the unsuspecting (and by now quite puzzled) customer never received.

Phony job offers often suggest writing product descriptions or reviews and require an initial payment from the victim to access training materials or a work web site. Victims are approached by text message, social media, email or web message board. Needless to say, these are scams.

Often the big warning sign is if the seller asks the buyer to communicate or make payment off the Temu platform itself, for example, a money transfer or text message conversation. This removes many of the protections Temu can provide to customers who fall victim to fraudulent sellers’ scams.

Temu scams simplified

Here are the most common frauds and scams – note that almost all of them originate outside of Temu and the Temu marketplace, instead relying on stolen branding to mislead victims into clicking on emails, adverts or links on fake websites.

Scam type

Where it appears

What the scammer wants

What to do instead

Fake promo code, gift card or free-gift offer

Social posts, ads, texts or email

Open Temu independently and check whether the offer appears in the official app or web site.

Delivery text or email phishing

SMS, email or messaging apps

Credentials, card data or a malicious download

Do not use the message link. Check delivery status by visiting your account independently.

Copycat Temu site or fake app

Search ads, social ads, unofficial app stores or direct links

Type the official address yourself or install only from an official app store; check the name of the app publisher.

Fake support, refund or account-alert contact

Phone calls, search results, social replies, email or texts

Passwords, one-time codes, remote device access or payment

Find support through the official Temu account. Never use a phone number or link supplied in an unexpected message.

Fake influencer, referral or celebrity offer

Social media, video comments or group chats

Clicks, credentials, downloads or recruitment into another scheme

Treat outside offers as unverified. Check promotions in the official app/site and read the terms.

Misrepresented or counterfeit listing

Marketplace product pages

Payment for an item that is poor quality, counterfeit or not as described

Check seller/product reviews, specifications, images and return terms before buying.

Fake job or pallet/liquidation deal

Social media, email, messaging apps or standalone websites

An upfront payment, identity data or card details

Do not pay to get a job or access a liquidation deal. Verify any opportunity through an official company channel.

Is Temu safe to buy from or use with a credit card?

By and large, yes – but use your judgment. Temu got started by offering deals that appeared too good to be true, and it’s worth noting that some consumer protections do not apply to – or may be difficult to enforce on – overseas purchases. Examine the individual listing carefully, as well as the details of the seller and how they want to take payment; remember that payments and communications off the platform would make it impossible for Temu to look at any complaints and are also a red flag for fraud. Other than that, the following common-sense checks are worth making:

Read product and merchant reviews critically: overwhelming positive reviews might be a sign that the merchant has paid for or faked positive reviews. Also look for recent changes to the tone of reviews, and any recurring complaints about the product or the merchant.
Carefully check the product descriptions, dimensions, any supplied images (including those in reviews) and details on compatibility.
Unusually cheap products, especially electronics or luxury goods, are a warning flag and a reason to check and verify what you’re getting.
Understand the buyer protection, refund and return rules before you order.
Keep order confirmations and payment records.

Finally, ensure you use a payment method that gives you some protection for purchases. Online payment platforms, credit cards and individual banks all provide payment protection to a greater or lesser extent, so an understanding of what protections you can rely on should something go wrong is vital. Remember that an online purchase from China is not as easy to return as a purchase from a physical store, and factor that into your assessment of the risk.

Is the Temu app safe? Privacy, permissions and account protection

As with any valuable brand, there’s a lot of incentive for criminals to impersonate Temu and its app. Aside from fake websites, fake apps are a known tactic, either presented as direct download from a non-Temu website or as a way to access secret deals or discounts. Regardless, downloading apps or installing apps from anywhere other than a legitimate source are incredibly risky, and can result in your personal or payment details being stolen and misused.

Instead, take the following practical steps to ensure the app you install is a genuine one:

Download only from your smartphone’s official app store, or via an official route. It’s usually safer to go to your smartphone’s app store and search for an app than it is to click on a random link on the web.
Check the app’s publisher and review permissions: if you don’t need the app to use a permission, feel free to deny or limit it.
Never re-use a password and use strong multifactor authentication. Most smartphones now provide autogenerated, unique long passwords when you create an app or web page account, and these are worth using. For multifactor authentication, a dedicated authenticator app is considered less open to manipulation than SMS authentication codes.
Never share passwords or authentication codes, even if the person asking for them claims to be from Temu tech support.
Check and adjust your payment methods and account settings regularly.

One last piece of advice: a smartphone app is often built by the provider to ease the process of using their services – in this case, buying stuff. Switching to only accessing Temu through a web browser achieves two things: It can limit the amount of data shared with the merchant, and it can add a little bit of friction to reduce the number of impulse buys you might be tempted to make.

Are Temu free gifts, rewards, discounts and coupons legit?

Temu has built its customer base on low-cost products, and part of the process of publicizing it has involved all kinds of promotions, which may or may not represent good value for money. Often, legitimate discounts or coupons come with strings attached: a minimum spend, a time limit or a referral requirement. All are intended to get you buying more stuff.

That said, the prevalence of these promotions makes them attractive camouflage for scammers.

There’s a clear distinction between in-platform rewards that come with conditions attached – which might make them less of a bargain than they first appear – and actual criminal activity by third parties impersonating Temu or a merchant.

Before you click on that promo banner, it’s worth running through our checklist:

Have you been presented with the promotion within Temu’s website or app? If it’s a web ad or unsolicited link in a message, then be cautious and avoid clicking on it.
What are the terms and conditions? Read these very carefully before proceeding – it might get expensive.
Does the promotion require a payment to release the prize? If so – it’s very likely to be a scam.
Is there pressure to recruit more customers to unlock a discount or gift?
Is there urgency to act – or a need to install software or download files?
Can you check the ‘normal’ price as well as seeing the discounted price?

How to shop safely on Temu

A lot of the scams that focus on online marketplaces depend on the victim being distracted, in a hurry or under stress. Bear this in mind when interacting with any online merchant – or any scammers that impersonate them. Here’s a quick checklist:

Always interact via the official website or the official app. If on the web, type the address into the browser yourself, rather than clicking on a link that might lead you elsewhere
Always take a pause before you react to an urgent message. It might be an offer, a refund or a delivery message, but scammers will count on stress, hurry and panic to get people to respond. Taking a couple of breaths (or even stepping away from the computer or phone for a moment) is always advisable in these situations. You’re not in an operating room, and a two-minute break isn’t going to lead to catastrophe.
Always check the seller, listing details, reviews and terms and conditions before buying.
Use a protected payment method, and keep all records of payment, shipping and other communications.
Don’t use links in text messages or emails to track orders – use the official site or app.
Always ensure you use a unique, complex password and MFA to log in.
Keep an eye on payment transactions and always use the official support route detailed on the website if any problems arise.

A lot of the scams surrounding Temu are identical to those affecting other online merchants; if you also shop on Shein, see our guide to Shein security, privacy and scam risks.

What to do if you clicked, paid, downloaded or shared information

Firstly: don’t panic. Take calm, measured action to reduce the risk, and follow the steps below.

If you clicked a suspicious link but did not enter information

Close the web page, check to see if any files have downloaded, and stop any downloads in process. Run a security scan and change any passwords that you might have entered.

If you entered a password or one-time code

Go to the Temu app or web page (type in the address – don’t click on a link) and reset your password. Your password should be unique to Temu – if you’ve used it on other web pages or accounts, it’s time to reset them on every single one, with a different password each time. A password manager that helps you create a unique password and store it for use is a great help here. Once you’re logged into your Temu account, check for any recent activity (such as purchases) and address that. If you haven’t enabled MFA, now is absolutely the time to do it.

If you entered payment details or see an unauthorized charge

Call your card issuer, bank or payment provider on their fraud line, which is often printed on the payment card or easily retrieved through the provider’s official app. Alert them to potential fraud, review recent transactions and ask about the process of disputing suspicious or fraudulent charges.

If you paid a scammer or shared identity information

If you’re in the USA, then the Federal Trade Commission has a website that will help you. Go to identitytheft.gov and follow the steps to recover from the theft and report it. Next, you’ll need to report the incident to Temu: go to the official website or app and search the help section for the right route to report fraud and identity theft.

A scam doesn't end with a suspicious click. If personal information falls into the wrong hands, the consequences can go far beyond a single shopping account. Identity Protection, included in ESET HOME Security Ultimate, helps you stay informed about potential exposure of your personal data and take action sooner.

A scam doesn't end with a suspicious click.

If personal information falls into the wrong hands, the consequences can go far beyond a single shopping account. Identity Protection, included in ESET HOME Security Ultimate, helps you stay informed about potential exposure of your personal data and take action sooner.

If an unexpected package arrives

This is likely a brushing scam. Don’t call any numbers, go to web sites or scan any QR codes on or in the package. Go to the official Temu app or website and check for any activity that isn’t you. Change your password and, if you can find it, report the seller by following the steps in Temus’ help menu.

Expert insight

"Criminals have always targeted recognizable brands because half of the social engineering has already been done for them by simply being known. Therefore, the biggest risk with Temu isn’t necessarily Temu itself, but the trust people place in the name. Criminals are more successful when they target brands where people are likely to have recently made a purchase from to land that more convincing email or text message. Therefore, a text about a delayed Temu delivery or a refund for example can feel completely plausible for a large number of potential victims. Essentially, if the narrative fits, the targets are more likely to engage. But urgency should always trigger suspicion, not action and people should never use the link or phone number they’ve been sent. Open the official app or website yourself and check for any correspondence as those extra few seconds can be the difference between spotting a scam and handing a criminal your personal or financial details." - Jake Moore, Global Security Advisor

"Criminals have always targeted recognizable brands because half of the social engineering has already been done for them by simply being known. Therefore, the biggest risk with Temu isn’t necessarily Temu itself, but the trust people place in the name.

Criminals are more successful when they target brands where people are likely to have recently made a purchase from to land that more convincing email or text message. Therefore, a text about a delayed Temu delivery or a refund for example can feel completely plausible for a large number of potential victims. Essentially, if the narrative fits, the targets are more likely to engage.

But urgency should always trigger suspicion, not action and people should never use the link or phone number they’ve been sent. Open the official app or website yourself and check for any correspondence as those extra few seconds can be the difference between spotting a scam and handing a criminal your personal or financial details."