How to Check If a Website Is Legit Before You Buy or Log In

To answer “is this website legit?”, run a few quick checks before you pay or type a password: look up how long the domain has existed, search the site’s name alongside words like “scam” and “reviews” on independent sites, confirm it lists real contact details, and check what payment methods it accepts. A padlock in the address bar only means the connection is encrypted, not that the business is honest. If the site is brand new, has no independent reviews and wants payment by wire, gift card or crypto, walk away.

None of these checks is proof on its own. Scam sites are built by professionals and can look polished. What protects you is stacking several checks together and treating a single red flag as a reason to slow down.

What a fake website usually looks like

A fake or fraudulent website is any site set up to take your money or your details without delivering what it promises. Most fall into a few familiar patterns.

• Fake online stores selling popular products, designer goods or sold-out items at prices well below what everyone else charges. The goods never arrive, or something cheap and different turns up.
• Lookalike sites that copy a real bank, retailer, delivery company or government agency, often with a web address that is one letter off or adds an extra word.
• Phishing login pages reached from a text or email, built to capture your username, password or one-time code.
• Fake ticket, rental and pet sites that ask for a deposit before you can see anything in person. Our guides to ticket scams and puppy scams cover those in detail.
• Investment and crypto platforms that show impressive gains on a dashboard but won’t let you withdraw.

Check 1: Look up the domain’s age with WHOIS

A domain registration lookup (often called WHOIS, now largely provided through a newer system called RDAP) shows when a web address was registered and when it expires. ICANN, the organization that coordinates domain names, runs a free lookup at lookup.icann.org, and most domain registrars offer one too.

1. Copy the site’s domain, for example the part that reads example.com, not the full page link.
2. Paste it into a WHOIS or RDAP lookup tool.
3. Find the creation or registration date.

A shop that claims to have served customers for a decade but whose domain was registered a few weeks ago is a serious warning sign. A young domain isn’t automatically a scam, since new businesses start every day, but it means you should lean harder on the other checks.

Don’t read much into hidden owner details. Privacy protection is standard at many registrars and legitimate businesses use it all the time.

Check 2: Understand what HTTPS does and doesn’t prove

The padlock and “https” at the start of an address mean the connection between your browser and the site is encrypted, so others on the network can’t read what you send. That matters, and you should never enter payment details on a site without it.

It says nothing about who runs the site or whether they’ll ship your order. Security certificates are free and quick to get, and scam sites routinely have them. Treat HTTPS as a minimum, not a sign of trust.

While you’re in the address bar, read the domain carefully. Watch for swapped letters, extra hyphens, unusual endings, or a real brand name followed by extra words such as “outlet”, “support” or “secure-login”.

Check 3: Read reviews on independent sites

Reviews and badges on the site itself are controlled by whoever runs it, so they tell you very little. Look elsewhere.

• Search the site’s name plus “scam”, “complaints” or “reviews”. The FTC’s consumer advice suggests exactly this kind of search before you buy from an unfamiliar seller.
• Check independent review platforms such as Trustpilot, the BBB and Google reviews, and look for discussions on forums like Reddit.
• Read the negative reviews first and look for patterns: orders never arriving, refunds refused, wrong items.
• Be wary of a total absence of reviews for a store claiming to be popular, or of a sudden burst of short, glowing reviews posted within days of each other.

Also check social media carefully. Many fake stores advertise through social ads, and the comments under those ads are sometimes the first place customers complain.

Check 4: Test the contact details

A legitimate business usually makes it easy to reach a person. A scam site usually doesn’t.

• Look for a physical address and search it on a map. An address that turns out to be a residential house, an empty lot or another company’s office is a red flag.
• Look for a working phone number and, if the purchase is large, call it.
• Check the email address. A business that only offers a free webmail address or a contact form is harder to hold accountable.
• Read the returns and privacy pages. Copied text, another company’s name left in by mistake, or policies that make refunds nearly impossible are all warning signs.

Check 5: Look at how it wants you to pay

Payment method is one of the most telling signals. The FTC advises paying online with a credit card where you can, because credit cards generally give you the right to dispute charges for goods you didn’t receive.

Payment method	What it tells you
Credit card through a normal checkout	Standard for real stores, and gives you dispute rights if something goes wrong
Debit card or a well-known payment service with buyer protection	Reasonable, though protections vary and are often weaker than a credit card’s
Bank wire, Zelle or another instant bank transfer	A warning sign for a store, since these are hard to reverse
Gift cards or cryptocurrency	A strong sign of a scam; real retailers don’t require them

Be especially careful if the checkout “fails” and you’re then asked to pay another way, or offered a discount for paying by transfer. That is a common way of steering buyers away from protected payment methods.

Check 6: Run a free safety check

Google’s Safe Browsing site status tool, part of Google’s Transparency Report, lets you paste in a web address and see whether Google currently flags it as dangerous, for example for phishing or malware. Many browsers use the same data to show warning screens.

A clean result doesn’t mean a site is safe. New scam sites often haven’t been reported yet. A flagged result, on the other hand, is a clear reason to stay away.

Other warning signs worth noticing

• Prices far below every other seller, especially on items that are sold out elsewhere.
• Pressure and countdown timers telling you the deal ends in minutes.
• Spelling and grammar errors, stock photos and product descriptions copied from other stores.
• No social media presence, or accounts created very recently with few real followers.
• Requests for more information than a purchase needs, such as your Social Security number or bank login.

A worked example

This is an illustrative scenario, not a real case.

Marisol sees a social media ad for a popular brand of stand mixer at well under half the usual price. Before buying, she spends ten minutes checking:

• Domain age: a WHOIS lookup shows the domain was registered last month, even though the site’s “About” page talks about years of trading.
• Reviews: searching the store’s name with “scam” brings up a forum thread from buyers who never received their orders.
• Contact details: the listed address is a residential street in another country, and there’s no phone number.
• Payment: the checkout accepts only bank transfer after the card option “fails”.

Any one of these might be explainable. Together, they make the decision easy. She closes the tab, reports the ad through the social platform and buys from a retailer she already knows.

What to do if you already paid or logged in

If you’ve already bought from a site that turns out to be fake, or entered a password on one, act quickly and calmly. It happens to careful people.

1. Contact your card issuer or bank using the number on your card or statement, explain what happened and ask about disputing the charge or stopping the payment.
2. Change your password on the real site and anywhere else you used the same one, starting with your email. Turn on two-step verification.
3. Watch your statements for unfamiliar charges, and consider replacing the card if you entered its details.
4. Keep evidence: the web address, screenshots, order confirmations and any messages.

Card disputes and chargebacks give you the best chance of getting money back. Wire transfers, gift cards, cryptocurrency and payment-app transfers are often hard or impossible to reverse, though you should still report them to your bank or the payment provider straight away.

Be wary of anyone who contacts you afterwards promising to recover your money for a fee. That is usually a second scam, covered in our guide to recovery scams.

Where to report a fake website

• ReportFraud.ftc.gov for scams and fraud in the US.
• The FBI’s Internet Crime Complaint Center at ic3.gov, especially if you lost money.
• IdentityTheft.gov if your personal details have been misused.
• Google’s Safe Browsing reporting form for phishing or unsafe sites, which can help others get warned.
• The platform that showed you the ad, using its own reporting tool.
• The real company being copied, through its official website.

Our guide on how to report a scammer covers each route, plus reporting options outside the US.

If the fake site is copying your own business, that is an impersonation problem as well as a scam. See what to do if someone is impersonating you online, and our brand monitoring service can help you spot lookalike sites and ads early.

How to protect yourself next time

• Bookmark the sites you buy from and log in to, and use the bookmark instead of links in messages.
• Use a password manager. It won’t autofill your password on a lookalike domain, which is a useful early warning.
• Pay with a credit card for online purchases from sellers you don’t know.
• Give yourself a pause before any purchase that feels urgent or unusually cheap.

Frequently asked questions

Does a padlock mean a website is safe?

No. The padlock means your connection to the site is encrypted. It doesn’t tell you who runs the site or whether they’re honest, and scam sites commonly have one.

Is a new website always a scam?

No. Real businesses launch new sites all the time. A young domain just means you should rely more on the other checks, such as independent reviews, real contact details and safe payment options.

Are website checker tools reliable?

They help, but they can only flag sites that have already been reported or detected. Use them alongside your own checks, and treat a clean result as “not known to be bad” rather than “safe”.

Can I get my money back from a fake website?

It depends on how you paid. Credit card disputes give you the best chance. Bank transfers, gift cards and crypto are much harder to recover, but report them to your bank or provider immediately, and to the FTC.