Check the web address and look for the lock icon
The first thing to check is whether the website uses HTTPS — the secure version of HTTP. Look at the address bar at the top of your browser. If the web address starts with "https://" instead of "http://", that's a good sign. You'll also see a small padlock icon next to the address, usually on the left side of the bar. That lock means the connection between your computer and the website is encrypted, so your information won't be intercepted.
This doesn't mean the website is automatically trustworthy — scammers can get HTTPS certificates too. But it does mean the site has taken at least one basic security step. If a site is asking for your credit card, password, or personal information and doesn't have HTTPS, do not enter that information. Leave the site immediately.
Key Takeaways
- Real websites use HTTPS (with a padlock icon) and have contact information, a physical address, and a privacy policy you can actually read.
- Scam sites often have misspelled domain names, poor grammar, and urgent language pushing you to act right now without thinking.
- Search the company name plus "scam" or "reviews" to see what other people have experienced, and check the Better Business Bureau or your state's attorney general office.
- Hover over links before clicking them to see where they actually go — scammers hide malicious links behind legitimate-looking text.
- If a deal sounds too good to be true, or a site is pressuring you to pay before you can see what you're buying, it probably is a scam.
Look for contact information and a real address
Legitimate businesses want you to be able to reach them. Scroll to the bottom of the website and look for a "Contact Us" page or footer section with an email address, phone number, and physical mailing address. A real company will have all three. If you only see a contact form with no other way to reach them, that's a red flag.
Try calling the phone number or visiting the address on Google Maps. If the phone number doesn't work, or the address is a mailbox store or an apartment building that has nothing to do with the company, be suspicious. You can also search the address on the Better Business Bureau website (bbb.org) to see if it's registered to a real business.
Read the privacy policy and terms of service
Every real website should have a privacy policy that explains what they do with your information. Look for a link at the bottom of the page — it's usually labeled "Privacy Policy" or "Terms of Service." Click it and actually read a few paragraphs. If the policy is written in clear language and explains what data they collect and why, that's a good sign.
If there's no privacy policy at all, or it's full of legal jargon that seems designed to confuse you, walk away. Scam sites often skip this step entirely or copy privacy policies from other websites. If the policy mentions selling your data to third parties without your permission, or if it's vague about what happens to your information, don't enter any personal details.
Search for reviews and complaints about the site
Open a new browser tab and search for the company name plus the word "scam" or "reviews." Read what other people have written. If dozens of people are reporting that they never received their order, or that they were charged twice, or that customer service ignored them, that's real evidence the site has problems.
Check the Better Business Bureau (bbb.org) and your state's attorney general office website. Both maintain databases of complaints against businesses. You can also search the company name on Trustpilot or Google Reviews to see ratings from actual customers. A site with no reviews at all, especially if it's been around for a while, is worth questioning.
Watch for poor grammar, spelling, and design
Scammers often operate from outside the United States and may not have native English speakers writing their websites. Look for misspelled words, awkward phrasing, or sentences that don't make sense. Professional companies hire people to proofread their sites. If you see multiple errors on the homepage alone, that's a warning sign.
The same applies to the overall design. Real businesses invest in websites that look professional and work smoothly. If the site looks like it was built in 2005, has broken images, or buttons that don't work, be cautious. Scammers often don't bother with polish because they're only running the site for a few weeks before moving on to a new one.
Hover over links to see where they actually go
Before you click any link on a website, hover your mouse over it without clicking. At the bottom of your browser window, you'll see the actual web address the link points to. Scammers hide malicious links behind text that looks legitimate. For example, a link might say "Click here to verify your account" but actually point to a fake login page designed to steal your password.
If the link text doesn't match the web address shown at the bottom, don't click it. If a link says it's going to the company's homepage but the address shown is something random or misspelled, that's a scam. This technique takes five seconds and catches a lot of phishing attempts before they happen.
Be suspicious of urgent language and pressure to pay
Scam sites use language designed to make you panic and act without thinking. Watch for phrases like "Act now," "Limited time offer," "Your account will be closed," or "Verify immediately." Real companies don't need to rush you. They're confident you'll come back.
If a site is pressuring you to pay before you can see what you're buying, or before you've had time to research the company, that's a major red flag. Legitimate retailers let you review your order before payment. If a site demands payment upfront and won't let you see details, or if it only accepts wire transfer or gift cards (which can't be reversed), assume it's a scam and leave.
Check the domain name for misspellings
Scammers often register domain names that are very similar to real companies. For example, a fake Amazon site might be "amaz0n.com" (with a zero instead of the letter O) or "amazn.com" (missing a letter). These look almost identical at a glance, but they're completely different websites.
If you're visiting a site for a company you know, type the address directly into your browser instead of clicking a link from an email or search result. This way you know you're on the real site. If you're unsure, go to the company's official website first and look for a link to the page you need. That guarantees you're in the right place.
Frequently Asked Questions
What should I do if I think I've been on a scam website?
If you entered a password, change it immediately on the real website. If you entered credit card information, contact your bank or credit card company right away and ask them to watch for fraudulent charges. You can also report the scam to the Federal Trade Commission at reportfraud.ftc.gov. Do not send any money to the site, and do not click any links in emails from the site.
Is a website with HTTPS always safe?
HTTPS means the connection is encrypted, but it doesn't mean the website is trustworthy. Scammers can get HTTPS certificates. It just means your data won't be intercepted while traveling to the site. You still need to check the other signs — contact information, reviews, grammar, and the domain name — to know if the site itself is real.
What if a company's website looks old or outdated?
An old-looking website isn't automatically a scam, but it is a reason to be extra careful. Small or older companies sometimes don't update their sites often. Check for the other signs: HTTPS, contact information, a privacy policy, and reviews from other customers. If those check out, the site is probably legitimate even if it looks dated.
Can I trust sites that have a lot of followers on social media?
Social media followers can be bought, so a large following doesn't may provide a site is real. Check the quality of the followers and the comments on posts. Real followers leave thoughtful comments and ask questions. Fake followers often leave generic praise or nothing at all. Still verify the site using the other methods — contact information, HTTPS, reviews, and a real privacy policy.
What's the difference between a scam site and a site with bad customer service?
A scam site is designed to take your money or steal your information. A site with bad customer service is a real business that doesn't respond to complaints well. Read the reviews carefully. If people say they never received orders or were charged without permission, it's likely a scam. If people say shipping was slow or customer service was rude, it's probably just a bad business.