Check the web address for signs of a fake site
The first thing to look at is the URL — the web address in your browser's address bar at the top. Real companies spend money to own their domain name, and they keep it consistent. If you're trying to reach your bank's website, the address should match exactly what you see on your bank card or statement.
Watch for slight misspellings that look close to the real thing. A fake site might use "amaz0n.com" (with a zero instead of the letter O) or "paypa1.com" (with the number 1 instead of the letter L). These are called lookalike domains, and scammers use them to trick you. Type the address yourself instead of clicking a link in an email or text message — that's the safest way to reach a site you trust.
The address should also start with "https://" not just "http://". The "s" stands for secure, and it means your information is encrypted when you send it. You'll often see a small padlock icon next to the address when a site is secure. This doesn't mean the site is legitimate, but it does mean your data is protected during transmission.
Key Takeaways
- Type web addresses yourself instead of clicking links in emails or texts, because scammers create fake sites that look almost identical to real ones.
- Look for "https://" and a padlock icon in the address bar — these show your information is encrypted, though they don't prove the site is trustworthy.
- Search for the company name plus "scam" or "reviews" to see what other people have experienced, and check the Better Business Bureau or your state's attorney general office for complaints.
- Real companies have contact information visible on their site, respond to customer complaints, and don't ask for passwords or full Social Security numbers through email or pop-up windows.
- If a deal sounds too good to be true or a site pressures you to act immediately, it's almost always a scam.
Search for complaints and reviews about the company
Before you enter any personal information, spend two minutes searching for what other people say about the site. Open a new browser tab and search for the company name plus the word "scam" or "reviews". If dozens of people report losing money or having their information stolen, you'll see it in the results.
Check the Better Business Bureau at bbb.org. Search for the company name and your state. The BBB shows you how many complaints they've received, what those complaints were about, and whether the company responded. A legitimate business usually responds to complaints, even if they don't always resolve them. A company with hundreds of unresolved complaints is a red flag.
You can also search your state's attorney general office — every state has one, and they keep records of scams and fraud complaints. Go to your state's official website and look for "attorney general" in the search box. Most have a consumer protection section where you can report a site or see if others have already reported it.
Look for real contact information and a physical address
Legitimate companies want you to be able to reach them. Look for a "Contact Us" page that lists a phone number, email address, and physical mailing address. If a site only offers a contact form with no other way to reach them, that's suspicious. Try calling the phone number — a real business will answer or have a voicemail.
Check whether the address is real. You can search the address on Google Maps to see if a business actually operates there. Some scammers list fake addresses or addresses that belong to other businesses. If the site claims to be a major company but lists only a P.O. box or a UPS store address, be cautious.
Real companies also post their privacy policy and terms of service. These are usually linked at the bottom of the page. Read at least the privacy policy to see what the company says it will do with your information. If the policy is vague, full of typos, or doesn't explain how they protect your data, that's a warning sign.
Watch for requests that legitimate companies never make
No real company will ask you for your password, full Social Security number, or credit card number through email, text message, or a pop-up window on their site. Banks, PayPal, Amazon, and government agencies have strict rules about this. If you receive an email claiming to be from your bank asking you to "verify your account" by clicking a link and entering your password, it's a scam.
Be suspicious of sites that pressure you to act immediately. Scammers create urgency by saying your account will be closed, your package won't arrive, or you'll miss out on a deal if you don't act right now. Real companies give you time to make decisions. If a site has a countdown timer, flashing warnings, or repeated messages saying "Act now," leave the site.
Watch out for sites that ask for payment through unusual methods like gift cards, wire transfers, or cryptocurrency. These payment methods are nearly impossible to reverse if something goes wrong. Real companies accept credit cards, debit cards, or bank transfers — methods that offer you some protection if you're defrauded.
Check if the site looks professional and works correctly
Scam sites are often built quickly and cheaply. Look for obvious signs of poor quality: spelling and grammar mistakes throughout the site, images that don't load, broken links that lead nowhere, or a design that looks outdated or sloppy. Real companies invest in their websites because they know customers judge them by appearance.
Try to use the site's basic functions. Can you add items to a cart? Does the search bar work? Do pages load in a reasonable time? If the site is slow, crashes, or has features that don't work, it may be a hastily built fake.
Look at the site's SSL certificate — this is the security document behind that padlock icon. Click the padlock icon in your address bar. A real company's certificate will show the company's actual name. If the certificate belongs to a different company or looks suspicious, don't enter any information.
Verify the site through the company's official channels
If you're unsure whether a site is real, contact the company directly using information you find yourself, not information from the suspicious site. Look up the company's phone number on your credit card, a past receipt, or their official social media account. Call and ask whether the website you found is legitimate.
Check the company's official social media pages — Facebook, Twitter, or Instagram. Real companies often post warnings about fake sites impersonating them. They may also have a link to their official website pinned to their profile.
If you're shopping online, use sites you already know and trust. Amazon, Walmart, Target, and other major retailers have secure checkout processes and buyer protection. If you find a product on an unfamiliar site at a price that seems too good to be true, search for that product on a site you trust first.
What to do if you think you've found a scam
If you've entered information on a site you now believe is fake, act quickly. If you gave a credit card number, call your credit card company immediately and report it. They can cancel the card and watch for fraudulent charges. If you gave your bank account information, contact your bank right away.
Report the scam site to the Federal Trade Commission at reportfraud.ftc.gov. The FTC collects reports from people across the country and uses them to investigate fraud. You can also report it to your state's attorney general office and to the Internet Crime Complaint Center at ic3.gov.
If the scam involved a specific platform — like a fake seller on Facebook Marketplace or a fraudulent listing on Craigslist — report it to that platform as well. Most have a "Report" button or link on the listing or profile.
Frequently Asked Questions
Is a padlock icon enough to know a site is safe?
No. The padlock means your information is encrypted during transmission, but it doesn't prove the site is legitimate. Scammers can buy SSL certificates too. The padlock is one small piece of the puzzle, but you still need to check the company's reputation, contact information, and whether they're asking for information in suspicious ways.
What should I do if I see a site that looks like my bank but the address is slightly different?
Don't enter any information. Close the browser tab and go directly to your bank's official website by typing the address yourself or using a bookmark. Call your bank's customer service number from the back of your card and ask if that website is legitimate. If it's not, report it to your bank and to the FTC.
Can I trust sites that have lots of positive reviews?
Positive reviews are helpful, but fake reviews exist. Look at the reviews carefully — do they sound like real customers or generic praise? Check whether the reviews are on the company's own site (which they control) or on independent sites like Trustpilot or Google Reviews (which they don't). Independent reviews are more reliable, though even those can be faked.
What's the difference between a scam site and a site that's just poorly designed?
A poorly designed site might be slow or look unprofessional, but it's usually still trying to deliver what it promises. A scam site is designed to steal your money or information. If a site asks for unusual payment methods, pressures you to act immediately, has no real contact information, or uses a lookalike domain name, it's likely a scam rather than just a bad website.
Should I ever click links in emails to reach a website?
It's safer not to. Scammers create emails that look like they're from real companies, with links to fake sites. Instead, type the web address yourself or search for the company name in your browser. If you do click a link in an email, check the address bar carefully before entering any information to make sure you're on the real site.