Knowing how to check if a website is safe takes about five minutes, and it is the cheapest fraud control you will ever use.
Fake shops, cloned brand sites and phishing pages are built to look convincing at a glance, so the checks need to go one layer deeper than the logo and the padlock.
This guide walks through the checks security analysts use when they triage a suspicious URL, adapted for anyone about to type a card number: reading the domain correctly, inspecting the TLS certificate, checking domain age, verifying the business behind the site and using reputation tools.
It ends with a one-page checklist and what to do if you have already paid.
Why fake websites are hard to spot
Online shopping fraud is one of the most reported scam types in the United States. The FTC’s Consumer Sentinel Network Data Book 2024 (2025) lists 383,441 online shopping reports, with 76% of those reporters losing money and $432 million in total reported losses.
Phishing volume stays high as well. The Anti-Phishing Working Group observed 853,244 phishing attacks in the fourth quarter of 2025, with eCommerce/retail and payment brands together accounting for over 16% of targeted sectors, according to the APWG Phishing Activity Trends Report Q4 2025 (2026).
These sites are not crude. Researchers documented a campaign that pushed more than 100 fake web stores into search results through hijacked legitimate websites, and another that used 71 typosquatted sites impersonating a German retailer, promoted through social media ads. Search rank and paid ads are not proof of legitimacy.
Step 1: Read the domain name correctly
The domain is the single most important thing on the page, and most people read it wrong. Browsers show the full hostname, but your eye goes to the familiar brand word.
How to find the real domain
Look at the part immediately to the left of the top-level domain (.com, .co.uk, .shop). In brand.com.account-verify.shop, the registered domain is account-verify.shop, not brand.com. Everything to the left is a subdomain the attacker controls.
Common lookalike tricks
- Letter swaps: “rn” in place of “m”, as in a recent campaign that used rnicrosoft.com to impersonate Microsoft.
- Homoglyphs: Cyrillic or Greek characters that look identical to Latin letters. Our report on new homoglyph attack techniques shows how these fool both people and some filters. If a URL shows “xn--” when pasted into a text editor, it uses internationalized characters.
- Extra words: brand-sale, brand-outlet, brand-official, or a different top-level domain.
- Shortened links: CISA’s Recognize and Report Phishing guidance lists untrusted shortened URLs and misspelled addresses (its example is “amazan.com”) among the main warning signs.
The safest habit is to avoid clicking through to a payment page at all. Type the shop’s address yourself or use a bookmark.
Step 2: Do a TLS certificate check
The padlock means the connection is encrypted. It does not mean the site is honest. Free, automated certificate authorities issue certificates to anyone who controls a domain, including criminals.
A 2026 campaign shows this clearly: attackers registered lookalike domains and obtained valid SSL/TLS certificates from legitimate authorities so their fake sign-in pages loaded over HTTPS.
What a certificate can still tell you
- Click the site-information icon in the address bar and open the certificate details.
- Check the issued-to name. It should match the domain you meant to visit, not a near miss.
- Check the validity start date. A certificate issued a few days ago on a site claiming years of trading is worth noting.
- For organizations, an Organization Validated (OV) or Extended Validation (EV) certificate lists a verified company name. Its absence is not a red flag on its own; its presence is a modest positive.
- Advanced users can search public Certificate Transparency logs (for example crt.sh) for the domain to see when certificates were first issued and which other hostnames share them.
Treat a missing padlock on a payment page as an absolute stop. Treat a present padlock as neutral.
Step 3: Check domain age and registration data
Most fake shops live for weeks, not years. Domain age is therefore one of the strongest fake website signs available to a consumer.
Since 28 January 2025, the Registration Data Access Protocol (RDAP) has replaced WHOIS as the authoritative source for generic top-level domain registration data, and ICANN directs users to its RDAP-based ICANN Lookup tool (per ICANN’s 2025 announcement).
What to look for
- Creation date: a domain registered in the last few months that claims to be an established retailer is a strong warning.
- Registrar and expiry: fake shops are often registered for one year only. This is weak evidence on its own but adds weight.
- Privacy-redacted contacts: normal for individuals and many companies under privacy law, so do not treat redaction alone as suspicious.
Analysts can script the same check. This command queries a public RDAP bootstrap service and prints the registration event dates:
curl -s https://rdap.org/domain/example.com | jq ‘.events[] | {eventAction, eventDate}’
Step 4: Verify the business behind the site
A genuine merchant leaves a trail that exists outside its own website. Check at least three of the following.
| Check | Legitimate sign | Warning sign |
|---|---|---|
| Contact details | Physical address, working phone, company registration number | Only a web form or a free email address |
| Company register | Registration number matches the government company register | Number missing, or belongs to an unrelated firm |
| Licensing | Regulated sectors show a licence you can confirm on the regulator’s site | Licence logo with no number or link |
| Policies | Specific returns, shipping and privacy terms | Copied text naming another shop |
| Prices | In line with the market | Large discounts on scarce or premium goods |
| Payment options | Card and well-known wallets with buyer protection | Only bank transfer, crypto or gift cards |
Licensing applies to any regulated sector: a bank, an insurer, a pharmacy, or a gambling operator such as Ivy Casino should state who regulates it and a licence number you can confirm on that regulator’s own website. If the licence cannot be found in the regulator’s public register, do not pay.
Payment method matters as much as the site. The FTC reported in March 2025 that losses paid by bank transfer or cryptocurrency exceeded losses from all other payment methods combined in 2024, according to its fraud data release.
A card payment gives you chargeback rights; a wire or crypto transfer usually does not.
Step 5: Use reputation tools and reviews carefully
Reputation tools add a second opinion but have blind spots, since new scam sites may not be listed yet.
- Browser warnings: keep Safe Browsing (Chrome, Firefox) or SmartScreen (Edge) enabled. Never click past a red warning page on a site that wants payment.
- URL scanners: services such as VirusTotal or urlscan.io show whether security vendors flag a domain and what the page loads. Do not submit URLs that contain personal tokens.
- Reviews: search the domain plus “scam”, “review” and “complaint”. Read the negative reviews on independent platforms, and be wary of a site with only perfect reviews, all posted recently.
- Social ads: check the advertiser’s page age and history before trusting an ad’s link.
Practitioner example: triaging a suspicious shop in five minutes
Illustrative scenario. A user forwards a social media ad offering a popular games console at 60% off. Here is how an analyst would work it.
- Domain: the link resolves to a hostname with the retailer’s name followed by “-deals.shop”. The registered domain is not the retailer’s.
- RDAP: the domain was registered nine days earlier with a one-year term.
- Certificate: a valid domain-validated certificate issued the same day as registration. Encryption is fine; identity is unproven.
- Business details: no company number, a contact form only, and a returns policy naming a different store.
- Checkout: card entry “fails” and the page offers a bank transfer discount instead.
Verdict: block and report. Each signal alone could be innocent, but five together are conclusive. Seasonal events increase this pattern, as covered in our guide to popular Black Friday scams and their red flags.
What to do if you already paid a fake website
- Call your card issuer or bank immediately using the number on your card. Ask to block the card and dispute the charge.
- If you paid by bank transfer, ask your bank to attempt a recall straight away. Speed matters.
- Change any password you entered on the site, and enable multi-factor authentication where you reused it.
- Report the site: in the US to ReportFraud.ftc.gov and the FBI’s IC3, and to your browser’s phishing report option.
- Watch for follow-up phishing that uses the details you entered.
Key takeaways
- Learning how to check if a website is safe starts with reading the registered domain, not the brand name in the page.
- A TLS certificate check confirms encryption, not honesty; criminals routinely use valid certificates.
- Domain age from RDAP or ICANN Lookup is one of the strongest fake website signs available to consumers.
- Verify the business outside its own site: company register, regulator licence and independent reviews.
- Pay by card or a protected wallet; avoid bank transfer, crypto and gift cards for unknown sellers.
- If you paid a fake site, contact your bank first, then report it.
FAQ
How can I check if a website is legit before buying?
Confirm the registered domain is the real brand’s, check the domain’s creation date with ICANN Lookup, verify the company’s registration and contact details elsewhere, read independent reviews and pay only by card or a protected wallet.
Does a padlock mean a website is safe?
No. The padlock means the connection is encrypted with a TLS certificate. Scammers obtain valid certificates for their own domains, so the padlock does not prove who runs the site.
How do I check a website’s domain age?
Enter the domain at lookup.icann.org and look at the registration (creation) date. A very new domain claiming to be a long-established retailer is a strong warning sign.
What are the most common fake website signs?
Lookalike domain names, a very recent registration date, prices far below market, missing company details, copied policies and pressure to pay by bank transfer, crypto or gift card.
What should I do if I entered my card on a fake website?
Call your card issuer immediately to block the card and dispute charges, change any reused password, and report the site to the FTC, IC3 or your national fraud reporting service.
