Check the web address and security features first
A real website shows three things in your browser's address bar: a padlock icon, "https://" at the start of the address, and a domain name that matches the organization. The padlock means your connection is encrypted. The "https" (not just "http") means the site uses security protocols. The domain should be the official name — for example, amazon.com is real, but amaz0n.com (with a zero) is fake.
Look at the full address before you enter any information. Scammers often use addresses that look almost right: paypa1.com instead of paypal.com, or bankofamerica-login.net instead of bankofamerica.com. Hover your mouse over links (without clicking) to see where they actually go. If a link says it goes to one place but the address bar shows another, the site is not what it claims.
If you are on a phone, the address bar may be hidden. Tap the top of the screen to reveal it before entering passwords or payment information.
Key Takeaways
- Real websites show a padlock icon and start with "https://" in the address bar, and the domain name should match the organization's official name.
- Scammers create fake addresses that look almost identical to real ones, so check the full address before entering any sensitive information.
- Look for contact information, an "About" page, and a privacy policy — real organizations publish these and make them easy to find.
- Search the organization's name plus "scam" or "fake" to see if others have reported problems, and check whether the site appears in official directories or lists.
- If a site asks for unusual information, offers something that sounds too good to be true, or pressures you to act immediately, treat it as suspicious.
Look for real contact information and an "About" page
Legitimate websites publish a way to reach them. Look for a "Contact Us" page with a phone number, email address, or mailing address. Real organizations answer emails and phone calls. If you find only a contact form with no other way to reach them, that is a warning sign.
An "About" page should tell you who runs the site, where they are located, and what they do. It should name real people or a real company. If the page is vague, uses stock photos, or gives no actual information, the site is probably not legitimate.
Check whether the organization has a physical address you can verify. Search the address on Google Maps to see if a real business is there. Scam sites often list fake addresses or addresses that belong to someone else.
Search for the organization's name and look for complaints
Type the organization's name into a search engine along with words like "scam," "fake," "complaint," or "review." If many people report problems, you will see results. Check sites like the Better Business Bureau (bbb.org), the Federal Trade Commission (ftc.gov), or Trustpilot to see whether others have reported issues with this website.
Real organizations often appear in official directories or lists related to their industry. A bank should appear in your state's banking regulator's list. A charity should be listed on Charity Navigator or GuideStar. A retailer should have a physical store location you can visit or a verifiable business registration.
Be cautious of sites with very few or very new reviews, especially if all the reviews are extremely positive. Real businesses have mixed reviews from real customers.
Check the privacy policy and terms of service
Legitimate websites publish a privacy policy that explains what they do with your information. The policy should be easy to find (usually at the bottom of the page) and should be written in clear language, not legal jargon that makes no sense. If there is no privacy policy, or if it says they will sell your information to anyone, that is a red flag.
The terms of service should explain what you can and cannot do on the site. Real organizations take time to write these documents because they protect both the business and the customer. If the site has no terms of service, or if the terms are confusing or one-sided, be suspicious.
Read the privacy policy before you enter any personal information. If it says the site will share your data with third parties without your permission, or if it does not explain how your information is protected, do not use the site.
Watch for red flags in how the site behaves
Be suspicious if a site asks for unusual information. A legitimate retailer will ask for your name, address, and payment method — but not your Social Security number or driver's license number unless you are applying for credit. A real bank will never ask you to confirm your password or account number by email or chat.
Scam sites often use pressure tactics. They may say "Act now — this offer expires today" or "Verify your account immediately or it will be closed." Real organizations do not rush you into decisions. They give you time to think and do not threaten you.
Look at the site's design and writing. Real organizations hire professionals to build their websites and proofread their content. If the site has spelling errors, broken images, or a design that looks outdated or poorly made, it may not be legitimate. Scammers often copy real websites but make small mistakes.
Verify the site through the official organization directly
If you are unsure whether a website belongs to a real company, contact the company through a different method. Look up their phone number in a phone book or on a previous bill, then call and ask whether the website is theirs. Do not use a phone number from the website itself — find it independently.
For banks, retailers, and government agencies, go to their official location in person or call their main number to ask about the website. If you received an email that claims to be from a company, do not click links in the email. Instead, go directly to the company's official website by typing the address into your browser.
If a site claims to represent a government agency, check the official government website. Real government sites end in .gov. If a site ends in .com or .net and claims to be a government agency, it is fake.
Use browser tools and security software
Most web browsers include built-in security features. Chrome, Firefox, Safari, and Edge all warn you if you try to visit a site that is known to be dangerous. If your browser shows a warning, do not ignore it — leave the site immediately.
Consider using a password manager like Bitwarden, 1Password, or Dashlane. These tools store your passwords securely and will not fill in your password on a fake website, because the address does not match the real one. This protects you even if you accidentally visit a scam site.
Antivirus software like Windows Defender (built into Windows), Malwarebytes, or Norton can scan websites for malware. These programs run in the background and alert you if you try to visit a dangerous site. They are not perfect, but they catch many scams.
Frequently Asked Questions
What does the padlock icon mean?
The padlock means your connection to the website is encrypted, so information you send (like passwords or credit card numbers) is scrambled and cannot be read by others. However, encryption does not mean the website is legitimate — a scam site can also have a padlock. Always check the address and look for other signs of legitimacy too.
Is a website with a .com address less safe than one with a .org or .gov?
No. Anyone can buy a .com, .org, .net, or .info address. The ending does not tell you whether a site is real. What matters is the full address and the organization behind it. A real nonprofit might use .org, but a scammer can buy a .org address too. Always verify the organization independently.
What should I do if I think I visited a scam website?
If you entered a password, change it immediately on the real website. If you entered a credit card number, contact your bank right away. If you entered personal information like your Social Security number, consider placing a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion). Report the fake website to the Federal Trade Commission at reportfraud.ftc.gov.
Can I trust a website just because it has good reviews?
Not always. Scammers can fake reviews or pay people to write positive ones. Look at the reviews across multiple sites — if one site has all five-star reviews but other sites show complaints, be cautious. Real businesses have mixed reviews from real customers with specific details about their experience.
Is it safe to use public WiFi to visit websites?
Public WiFi is not secure, so avoid entering passwords or payment information on public networks. Even on a secure website with a padlock, someone on the same WiFi network might be able to see what you are doing. If you must use public WiFi, use a VPN (virtual private network) like ProtonVPN or Mullvad to encrypt your connection.