Card rip scams and clone sites: check the address first
A copied site looks the same as the real one. The address does not. Here is each rated app's own address and store publisher, read on 7 October 2026, and how the common tricks work.
By Alexander Korsager · Checked 7 October 2026 · We earn nothing from any app on this site
- App Store seller
- Tilt Rips LLC
- Google Play developer
- MT Sports
Check a link before you sign in
Paste it, or load an example. The box compares the address with the ones we hold. It opens nothing and sends nothing.
Close to Courtyard, but not the address we holdcourtyard.io is written into this link, but the link goes to free-packs.example. The ending decides where you land. We have not opened it and do not say what it is.The address we hold: courtyard.ioThe check compares text only. “Not held” is a gap in our list, not a finding about the address, and a match says where a link goes, not what the app is like: that is what the reviews are for.
Every rated app's real address
26 web addresses and 27 store listings, with the name each listing is published under.
| App and terms name | Address and store publishersAddressApp Store sellerGoogle Play developer |
|---|---|
 Tilt RipsTilt Rips LLC | Addresstiltrips.comNo commissionApp Store sellerTilt Rips LLCNo commissionGoogle Play developerMT SportsNo commissionNot the terms name |
 Arena ClubArenaclub.com, Inc. | Addressarenaclub.comNo commissionApp Store sellerArenaclub.com, Inc.No commissionGoogle Play developerArenaclub.com, Inc.No commission |
 LastpackLotus Digital Inc. | Addresslastpack.comNo commissionApp Store sellerNone in our dataGoogle Play developerNone in our data |
 PhygitalsPhygitals, Inc. | Addressphygitals.comNo commissionApp Store sellerPhygitals IncNo commissionGoogle Play developerPhygitals IncNo commission |
 RepackzCollectbase Inc. | Addresscollectibles.com/repackzNo commissionApp Store sellerCollectbase Inc.No commissionGoogle Play developerCollectbase IncNo commission |
| CourtyardCourtyard, Inc. | Addresscourtyard.ioNo commissionApp Store sellerCourtyard, Inc.No commissionGoogle Play developerCourtyard.ioNo commissionNot the terms name |
 RipitRipit, LLC | Addressripit.coNo commissionApp Store sellerNone in our dataGoogle Play developerNone in our data |
 PackzPackz, Inc. | Addresspackz.ioNo commissionApp Store sellerPackz Inc.No commissionGoogle Play developerNone in our data |
 RipRip.ioMagic Peak Ventures LLC | Addressriprip.ioNo commissionApp Store sellerNone in our dataGoogle Play developerNone in our data |
| rip.funripdotfun ltd. | Addressrip.funNo commissionApp Store sellerNone in our dataGoogle Play developerNone in our data |
 Collector CryptCollector Crypt Corp. | Addressgacha.collectorcrypt.comNo commissionApp Store sellerNone in our dataGoogle Play developerNone in our data |
 MNSTRMonster Strategy, inc | Addressmnstr.xyzNo commissionApp Store sellerNone in our dataGoogle Play developerNone in our data |
 Rips by TriumphTriumph TCG, LLC | AddressNone in our dataApp Store sellerTriumph Arcade, LLCNo commissionNot the terms nameGoogle Play developerTriumph Labs Inc.No commissionNot the terms name |
 Slabz9546-9466 Quebec Inc | Addressslabz.comNo commissionApp Store sellerNone in our dataGoogle Play developerNone in our data |
 BOXED.GGLoot Labs, Inc. dba Boxed.gg | Addressboxed.ggNo commissionApp Store sellerNone in our dataGoogle Play developerNone in our data |
 Stadium VaultStadium Live Studios Inc. | Addressstadiumvault.ioNo commissionApp Store sellerStadium Live Inc.No commissionNot the terms nameGoogle Play developerNone in our data |
 Rip RushEmerald Myth Studio Limited | Addressriprush.netNo commissionApp Store sellerEmerald Myth Studio LimitedNo commissionGoogle Play developerEmerald Myth Studio LimitedNo commission |
 Underdog RipsUnderdog Sports, LLC d/b/a Underdog Fantasy | Addressunderdogsports.comNo commissionApp Store sellerUnderdog Sports, Inc.No commissionNot the terms nameGoogle Play developerUnderdog Sports Wagering, LLCNo commissionNot the terms name |
 Fanatics Instant RipsFanatics Collectibles AD, Inc. | Addressfanaticscollect.com/instant-ripsNo commissionApp Store sellerFanatics Collectibles AD, Inc.No commissionGoogle Play developerFanatics Live, Inc.No commissionNot the terms name |
 ClutchPacksBig Time Tech Ltd | Addressclutchpacks.ioNo commissionApp Store sellerBig Time Tech AGNo commissionNot the terms nameGoogle Play developerNone in our data |
 Beezie150TRE, Inc. (d/b/a Beezie) | Addressbeezie.com, also beezie.ioNo commissionApp Store sellerNone in our dataGoogle Play developerNone in our data |
 DOPAsinsa Inc. (dba DOPA!) | Addressdopa-global.comNo commissionApp Store sellerSINSA, K.K.No commissionNot the terms nameGoogle Play developerDOPA!No commissionNot the terms name |
 Packs.comMejmr LLC | Addresspacks.comNo commissionApp Store sellerNone in our dataGoogle Play developerNone in our data |
 GameStop Power PacksPowerPacks, LLC | Addressgamestop.com/powerpacksNo commissionApp Store sellerGameStopNo commissionNot the terms nameGoogle Play developerGameStop AppNo commissionNot the terms name |
 GemintJ Lab Ltd. (British Virgin Islands); seller of record Clearlake Inc. (Delaware) | Addressgemint.ioNo commissionApp Store sellerNone in our dataGoogle Play developerNone in our data |
 Crown CardsCrown Cards LLC | Addresscrowncards.ioNo commissionApp Store sellerCrown Cards LLCNo commissionGoogle Play developerCrownCardsNo commissionNot the terms name |
 ripz.ggNo company named | Addressripz.ggNo commissionApp Store sellerNone in our dataGoogle Play developerNone in our data |
Store names are from Apple's record for each listing and Google Play's US page, read on 7 October 2026. A name that differs from the terms company is not a warning sign here: it is the name to expect. “None in our data” does not mean the app has no listing.
Five patterns, and who warns about each
Each is described from an agency page or an operator's own words. 3 rated apps publish a warning of their own in the pages read.
Clone sites and lookalike addresses
A copy of an app's site sits on an address a letter or an ending away from the real one. The FBI describes criminals buying search advertisements that lead to such copies. It takes a login or a card payment.
- The tell
- The address bar. The page itself can be a perfect copy.
- The check
- Type the address, or use a bookmark you made from it. Compare it with the table on this page.
- FBI“Cyber criminals purchase advertisements that appear within internet search results using a domain that is similar to an actual business or service.”FBI IC3 public service announcement I-122122-PSA, “Cyber Criminals Impersonating Brands Using Search Engine Advertisement Services to Defraud Users”, 21 December 2022
- Phygitals: Tells users to check the address bar and bookmark the site.“Watch for lookalike domains with extra characters or misspellings.”Phygitals docs, Official LinksNo commission
- Beezie: Publishes a list of its own links and says to use no others.“Only use the official links below for information about Beezie. Be cautious of scam links.”Beezie docs, Official LinksNo commission
Phishing emails, texts and direct messages
A message that looks like the app says there is a problem with your account, a payout waiting or a pack to claim, and gives a link to sign in.
- The tell
- A link you did not ask for, and a reason to hurry.
- The check
- Do not follow the link. Open the app yourself and look for the same notice there.
- FTC“legitimate companies won’t email or text with a link to update your payment information”FTC consumer advice, “How To Recognize and Avoid Phishing Scams”, September 2022
- CISA“if you think it could be real, don't click on any link or call any number in the message”CISA, Secure Our World, “Recognize and Report Phishing”, undated
- Phygitals: Says it never asks for a password or wallet phrase by message.“Phygitals will never ask for your password, private keys, or seed phrases via social media, email, or direct message.”Phygitals docs, Official LinksNo commission
- Courtyard: Its terms list phishing among the losses it will not cover.“ANY UNAUTHORIZED THIRD PARTY ACTIVITIES, INCLUDING WITHOUT LIMITATION THE USE OF VIRUSES, PHISHING, BRUTEFORCING OR OTHER MEANS OF ATTACK”Courtyard terms of serviceNo commission
- ClutchPacks: Its terms list phishing among the losses it will not cover.“ANY UNAUTHORIZED THIRD PARTY ACTIVITIES, INCLUDING WITHOUT LIMITATION THE USE OF VIRUSES, PHISHING, BRUTEFORCING OR OTHER MEANS OF ATTACK AGAINST THE SERVICE”ClutchPacks terms of serviceNo commission
- Gemint: Its terms name phishing and spoofing as a risk of holding digital assets.“may be targeted by malicious actors using techniques including malware, hacking, phishing, spoofing, and social engineering”Gemint terms of serviceNo commission
Fake support and staff
Someone using the app's name writes first, by direct message, email or text, offering help, a prize or a refund, then asks for a code, a payment or a gift card.
- The tell
- They wrote to you first, and they want something only you hold.
- The check
- Reach support from inside the app or from the address on its own site, never from the message.
- FTC“Don’t click on links or call phone numbers in unexpected messages.”FTC consumer advice, “How To Avoid Imposter Scams”, undated
- FTC“No real business or government agency will ever tell you to buy a gift card to pay them.”FTC consumer advice, “Avoiding and Reporting Gift Card Scams”, undated
- Lastpack: Names the one address it writes from and what it never asks for.“We will only contact you from support@lastpack.com or through our official on-site support channels. Be cautious of impersonators, our team will never ask for your password, verification codes, payment details, or gift cards.”Lastpack help centre, notice on every pageNo commission
- Phygitals: Says its staff never open a direct message asking for money.“Phygitals team members will never DM you first asking for funds, personal information, or wallet access.”Phygitals docs, Official LinksNo commission
Fake codes and giveaways
A post or message in an app's name offers a code, a free pack or a giveaway, with a link to claim it. The FTC ranks fake giveaways and discounts third among impersonation scams reported in 2023.
- The tell
- You are sent to a link to claim it, instead of entering it in the app you already have.
- The check
- Enter a code only inside the real app or site. An operator's own public offers are printed on its own pages.
- FTC“A message about a giveaway, discount, or free money may seem to come from a company you know”FTC Data Spotlight, “Impersonation scams: not what they used to be”, 1 April 2024
- Stadium Vault: Says where a code is entered: inside its own app, nowhere else.“Redeem referral and qualifying promotional codes in the Stadium Vault iOS mobile app only”Stadium Vault FAQNo commission
- Lastpack: Referral rewards are not cash and cannot be sold or traded.“Referral Program benefits are not cash, have no cash value, are non-transferable, and may not be sold, assigned, traded, bartered, or exchanged.”Lastpack terms of service, 5.6No commission
- Tilt Rips: Can take promotional credit back where it finds self-referral or abuse.“We may withhold, reverse, cancel, expire, or claw back Promotional Benefits, including Rip Credits, where we reasonably determine that fraud, chargeback activity, self-referrals, duplicate accounts”Tilt Rips terms and conditionsNo commission
Accounts for sale
Someone offers an account with a balance, cards or a bonus on it, or asks to use yours. Where the terms ban the sale, the buyer holds an account the terms say cannot change hands. Packz's terms state the result: closure and forfeiture.
- The tell
- Anyone offering an account, or asking to borrow yours.
- The check
- Open your own account. Read the transfer clause in the table below before paying anyone for one.
- Packz: Its terms forbid selling or transferring an account.“You may NOT sell or assign Your User Account to any other person under any circumstances.”Packz terms, 2.2No commission
- Rips by Triumph: Its terms forbid selling or transferring an account.“you shall not sell or otherwise transfer your Triumph Account”Rips by Triumph terms of useNo commission
- Arena Club: Its terms forbid selling or transferring an account.“You cannot otherwise transfer, sell, or dispose of your Account (other than closing your Account with us) under any circumstances.”Arena Club terms of serviceNo commission
These are about someone using an app's name. Whether an app itself holds up is a different question, answered in are card rip apps legit?
How common is it?
For rip apps, we found no published figure. For every kind of business together, the FTC publishes one.
“reported losses to these impersonation scams topped $1.1 billion for the year, more than three times what consumers reported in 2020”
The FTC's counts are reports people chose to file, across all industries. They say nothing about any app on this site.
Accounts for sale
12 of the 19 terms we could read forbid selling, transferring or sharing an account.
Packz: what its terms say happens
“Any attempt to do so is in violation of these Terms, will result in closure and forfeiture of the User Account, and may result in a lifetime ban from the Service and possible legal action.”Packz terms, 2.2No commission| App and what is forbidden | The clause |
|---|---|
| PackzSelling or transferring | “You may NOT sell or assign Your User Account to any other person under any circumstances.”Packz terms, 2.2No commission |
| Rips by TriumphSelling or transferring | “you shall not sell or otherwise transfer your Triumph Account”Rips by Triumph terms of useNo commission |
| Arena ClubSelling or transferringA transfer needs its written consent | “You cannot otherwise transfer, sell, or dispose of your Account (other than closing your Account with us) under any circumstances.”Arena Club terms of serviceNo commission |
| Crown CardsSelling or transferring | “sell or transfer your Account”CrownCards terms, prohibited conductNo commission |
| Rip RushSelling or transferring | “You shall not sell or otherwise transfer your Rip Rush Account.”Rip Rush terms of serviceNo commission |
| RipitSelling or transferring | “Sell or transfer your account”Ripit terms of service, prohibited conductNo commission |
| Stadium VaultSelling or transferringA transfer needs its written consent | “You cannot otherwise transfer, sell, or dispose of your Account (other than closing your Account with us) under any circumstances.”Stadium Vault terms of serviceNo commission |
| LastpackSelling or transferring | “you shall not sell or otherwise transfer your lastpack Account”Lastpack terms of serviceNo commission |
| GemintSelling or transferring | “You may maintain only one account, and you may not share, sell, or transfer your account.”Gemint terms of serviceNo commission |
| Underdog RipsSelling or transferringFrom the Phygitals terms printed inside its Rips terms, which say parts of them may not apply to an Underdog Rip | “You agree not to create more than one account, share your account with any third party, or transfer your account to any other person without our prior written consent.”Underdog Rips terms of use, Phygitals’ Terms of Service, 3No commission |
| DOPASharing | “You may not share your Account or password with anyone”DOPA! terms and conditionsNo commission |
| BeezieSharing | “agree not to provide any other person with access to the Platform or portions of it using your user name, password, or other security information”Beezie terms of useNo commission |
The other 7 terms read have no such clause that we found. The terms of BOXED.GG, Collector Crypt, Fanatics Instant Rips, GameStop Power Packs, Packs.com, Phygitals, RipRip.io, and ripz.gg returned no readable text on 7 October 2026 and are not confirmed either way. Who is behind each app is in who owns each card rip app.
If you already clicked
In this order. The scan, the recovery site and the report are the FTC's own advice for phishing.
- 1Change the passwordFrom the real app or site, not from the message. Change it anywhere else you used the same one.
- 2Tell the operatorUse the support route on its own site, and say what you entered and where.
- 3Call your bank or card issuerIf you typed card or bank details. The FTC points anyone who gave out financial details to its recovery site.IdentityTheft.gov
- 4Scan the deviceIf something downloaded, the FTC says to update security software, run a scan and remove what it finds.
- 5Report itThe FTC takes fraud reports and the FBI takes internet crime complaints.ReportFraud.ftc.govFBI Internet Crime Complaint Center
Money already in an app is a separate matter: what its terms say about closing or freezing an account is in if a card rip app shuts down.
Questions people ask
How do I know I am on the real site?
Read the address bar, not the page. A copy can look identical; only the address differs. Compare what you see with the table above, or paste the link into the check. The part just before the first single slash decides where you are.
Why does the store listing show a different name?
Because the genuine listings often do. 6 of 15 App Store sellers and 8 of 12 Google Play developers in our data carry a name that is not the company name in the app's terms. That is why the table gives the exact name to expect. Whether each is a different company or the same one under another name is not confirmed.
Is a referral code from a stranger a scam?
Not by itself: several apps run referral programs. The risk is the link that comes with it. A code is entered inside the app you already have. Operators' own public offers are on free packs and promo codes; this site lists no personal codes.
Can I buy or sell a card rip account?
10 of the 19 apps whose terms we could read forbid selling or transferring an account, and 2 more forbid sharing one. Packz's terms say an attempt “will result in closure and forfeiture of the User Account, and may result in a lifetime ban from the Service and possible legal action”. We found no such clause in the other 7, which is not permission.
Has a card rip app been cloned?
Not confirmed either way. We did not look for clone sites or fake apps and name none here. We found no operator or agency figure for how often it happens at rip apps. The patterns on this page are the ones the FTC, FBI and CISA describe for brands in general.
Sources25
- FBI IC3 public service announcement I-122122-PSA, “Cyber Criminals Impersonating Brands Using Search Engine Advertisement Services to Defraud Users” (21 December 2022) ic3.gov
- FTC consumer advice, “How To Recognize and Avoid Phishing Scams” (September 2022) consumer.ftc.gov
- CISA, Secure Our World, “Recognize and Report Phishing” (undated) cisa.gov
- FTC consumer advice, “How To Avoid Imposter Scams” (undated) consumer.ftc.gov
- FTC Data Spotlight, “Impersonation scams: not what they used to be” (1 April 2024) ftc.gov
- FTC consumer advice, “Avoiding and Reporting Gift Card Scams” (undated) consumer.ftc.gov
- Phygitals: Phygitals docs, Official Links docs.phygitals.com
- Beezie: Beezie docs, Official Links docs.beezie.com
- Courtyard: Courtyard terms of service docs.courtyard.io
- ClutchPacks: ClutchPacks terms of service clutchpacks.io
- Gemint: Gemint terms of service help.gemint.io
- Lastpack: Lastpack help centre, notice on every page support.lastpack.com
- Stadium Vault: Stadium Vault FAQ stadium-vault.gitbook.io
- Lastpack: Lastpack terms of service, 5.6 support.lastpack.com
- Tilt Rips: Tilt Rips terms and conditions tiltrips.com
- Packz: Packz terms, 2.2 packz.io
- Rips by Triumph: Rips by Triumph terms of use docs.triumpharcade.com
- Arena Club: Arena Club terms of service info.arenaclub.com
- Crown Cards: CrownCards terms, prohibited conduct crowncards.io
- Rip Rush: Rip Rush terms of service riprush.net
- Ripit: Ripit terms of service, prohibited conduct docs.ripit.co
- Stadium Vault: Stadium Vault terms of service stadium-vault.gitbook.io
- Underdog Rips: Underdog Rips terms of use, Phygitals’ Terms of Service, 3 underdogfantasy.pactsafe.io
- DOPA: DOPA! terms and conditions dopa-global.com
- Beezie: Beezie terms of use docs.beezie.com
Every figure was read on public pages between 6 October 2026 and 7 October 2026. Nothing here has been tested with money yet. Store names, operators' pages and the agency pages were read on 7 October 2026, from Germany. No clone site, fake app or impersonator was looked for or visited, and none is named. 8 apps' terms would not load and are marked “not confirmed”.