Flash storage scams have been around for years and remain a lucrative way for scammers to profit from an item that likely costs only a few dollars in parts. These scams include USB flash drives, SD cards, and even SSDs, but they all employ a similar tactic. These products are listed as high-capacity storage priced well below market value — firmly in the too-good-to-be-true category. Unfortunately, this type of hardware fraud doesn’t exist in a vacuum, thriving across multiple online marketplaces and playing on external factors, like the roaring demand for AI that has fueled spiraling RAM costs and steadily driven up SSD prices.
While the majority of these scams prey on those who probably don’t know any better, others are becoming more sophisticated, making it hard for even the tech-savvy to spot them. Case in point: a very convincing fake Samsung 990 Pro that was spotted and tested by Japanese tech publication Akiba PC Hotline. There are subtle differences that give the fake away, but on the surface — and even down to the packaging — the lines are very blurred.
This is in addition to other scams that seem to be becoming more common. There are counterfeit GPUs, often using the FrankenGPU tactic, or the deluge of fake DDR5 that’s on the market. Until online retailers can get a grip on all the fake storage being sold, you should think twice about buying any suspiciously cheap storage, like that cheap 2TB USB flash drive you might have seen.
How the fake flash drive scam works and what to avoid
While the trafficking of counterfeit goods in the US is illegal, most of these criminals operate outside of the country, making it hard to prosecute them individually. It is also likely that these sellers are operating across multiple third-party seller accounts, making them harder to track and take action against. So, understanding the tactics and being vigilant is the best way to avoid being taken advantage of.
The scam starts with a product listing showing a high-capacity (somewhere between 2TB and 16TB) storage device, like a USB flash drive, for a price well below what it should cost legitimately. These listings have been found on Amazon, Walmart, eBay, Temu, AliExpress, and other places. As of this writing, we can currently find “2 TB flash drives” on eBay for as little as $18.99 and at Walmart for $29 — both would be guaranteed fakes. This is always the biggest tell.
These drives will typically have a cheap NAND flash chip of 32GB or 64GB, a cobbled-together SD card, or may even be completely hollow. What’s worse is that many of these fakes have altered firmware or controllers that will spoof the host operating system and report a false capacity, meaning the OS will recognize it, format it, and write to it just the same. Once the capacity is exceeded, the oldest data is overwritten, causing wrap-around corruption. Once this data is overwritten, it’s usually not recoverable.
You can also spot a fake based on capacities that exceed what is actually available in the consumer market. M.2 SSDs currently top out around 8 TB, and most traditional USB thumb drives can be had in capacities up to 2 TB. You should avoid unknown or no-name drives and any product page that has vague specifications or descriptions, and pay careful attention to reviews.
How to test a flash drive
There are a handful of ways you can test a USB drive you’ve bought, or one you already own, in order to gauge its authenticity. For Windows users, you can use a tool called H2testw to verify the capacity of the drive. Visit the H2testw website and follow the instructions listed. Once the write test is complete, you’ll get a notification saying the test was completed without errors. Any other results indicate that there’s something wrong with the drive.
You can also use FakeFlashTest, which doesn’t depend on the firmware registry and instead performs a block-level data test across all data blocks of the drive. On macOS and Linux, you can use F3 (Fight Flash Fraud), an open-o the previous two tools mentioned for Windows, and it will write pseudorandom data to the drive and attempt to read it back
