Check the web address for signs of a fake site
The URL — the address in your browser's address bar — is often the first place a scam shows itself. Real websites use HTTPS at the start of the address, not HTTP. The "S" means the connection is encrypted, and browsers show a small padlock icon next to it. If you do not see that padlock, the site is not secure and you should not enter passwords or payment information there.
Look at the domain name itself, which is the main part after the slashes. Scammers often use addresses that look almost like the real thing — for example, "amaz0n.com" instead of "amazon.com" (zero instead of the letter O), or "paypa1.com" instead of "paypal.com" (the number one instead of the letter L). These are easy to miss when you are in a hurry. If you are looking for a specific company's website, type the address directly into your browser instead of clicking a link in an email or text message.
Hover your mouse over any links on the page without clicking them. In the bottom left corner of your browser, you will see where that link actually goes. If the link says "Click here to update your account" but the address shown is something completely different, that is a red flag.
Look for contact information and a physical address
Legitimate businesses post real ways to reach them. Scroll to the bottom of the page and look for a phone number, email address, or mailing address. Call the phone number if you have doubts — a real company will answer or have a voicemail. If there is no contact information at all, or only a contact form with no other way to reach them, that is suspicious.
A physical mailing address is especially important. Scam sites often have no address, a fake address, or an address that belongs to a mail-forwarding service. You can check an address using Google Maps — type it in and see if a real business is actually located there. If the address is a residential home or a UPS store, that is a warning sign.
Be cautious of sites that only offer a contact form and promise to "get back to you within 48 hours." Real companies usually have phone support or live chat available during business hours.
Key Takeaways
- Real websites use HTTPS with a padlock icon in the address bar; HTTP without the S means the connection is not encrypted and you should not enter sensitive information.
- Scammers use URLs that look almost identical to real ones, so type addresses directly into your browser instead of clicking links from emails or texts.
- Legitimate businesses display a phone number, email, or physical mailing address at the bottom of the page; scam sites often have no contact information at all.
- Check the company's social media accounts and search for reviews on independent sites like Trustpilot or the Better Business Bureau to see what other people report.
- If a site asks for your password, credit card, or Social Security number, verify you are on the real website by calling the company directly using a number you find yourself.
Search for reviews and complaints about the site
Before you do business with a website, search for the company name plus the word "scam" or "reviews" in Google. Read what other people have written about their experience. Look for patterns — if many people report the same problem, that is meaningful. A few negative reviews on any large site are normal, but dozens of complaints about money not being refunded or products never arriving is a serious warning.
Check the Better Business Bureau website at bbb.org. Search for the company name and your state. The BBB shows how long a business has been registered, how many complaints they have received, and how they responded. A business with no BBB listing at all is suspicious, especially if it claims to be established.
Look at the company's social media accounts if they have them. Real businesses respond to customer messages and post regularly. Scam accounts often have few followers, no recent posts, or stolen photos. If you see the same product photos on multiple different company websites, those are likely stolen images being used by scammers.
Watch for common scam warning signs
Certain phrases and tactics appear on almost every scam site. Be wary if the site asks you to wire money, send gift cards, or use cryptocurrency — these payment methods cannot be reversed if you are defrauded. Real companies accept credit cards and PayPal because those services offer buyer protection.
Scam sites often have poor spelling and grammar throughout. Real businesses proofread their pages. If you see multiple typos, awkward phrasing, or sentences that do not make sense, that is a sign the site was not built by professionals.
Be suspicious of prices that seem too good to be true. If a brand-new laptop is selling for half the normal price, or a luxury item is available for a fraction of what it costs elsewhere, the site is probably not legitimate. Scammers use unrealistic deals to get you to enter your payment information quickly without thinking.
Verify the site's security certificate
Click on the padlock icon in your browser's address bar. This shows you the security certificate for the website. A real certificate will show the company name and an expiration date. If the certificate is expired, or if the company name on the certificate does not match the website you are visiting, do not enter any personal information.
The certificate tells you that the connection between your computer and the website is encrypted, but it does not may provide the business itself is legitimate. A scammer can purchase a security certificate. However, the lack of a certificate is always a red flag.
If you see a warning message from your browser saying the certificate is not trusted or the connection is not secure, leave the site immediately. Your browser is warning you for a reason.
Check if the company is registered and licensed
For financial services, insurance, or investment sites, verify the company is registered with the appropriate government agency. Banks and credit unions are listed in the FDIC database at fdic.gov. Investment advisors are registered with the SEC at investor.gov. Insurance companies are regulated by your state's insurance department.
Search the company name on these official sites. If they claim to be a bank but do not appear in the FDIC database, they are not a real bank. If they claim to offer investment advice but are not registered with the SEC, that is illegal.
For other types of businesses, search your state's Secretary of State website to see if the company is registered as a business in that state. This does not mean the business is trustworthy, but it does mean they have gone through a basic registration process.
Use browser tools and security extensions
Most modern browsers have built-in protection against known scam sites. Chrome, Firefox, Safari, and Edge all warn you if you try to visit a site that has been reported for phishing or malware. If your browser shows a warning, trust it and do not proceed.
You can also use free browser extensions like uBlock Origin or Malwarebytes Browser Guard that flag suspicious sites. These tools check websites against databases of known scams and malware. They are not perfect, but they catch many common threats.
If you are still unsure about a site, do not use it. There are always other options. A few extra minutes of research now can save you from fraud later.
Frequently Asked Questions
What does HTTPS mean and why does it matter?
HTTPS means the data you send to the website is encrypted, so hackers cannot intercept your password or credit card number. HTTP without the S sends your information unencrypted. Always look for the padlock icon and HTTPS before entering sensitive information.
Can a website have a padlock and still be a scam?
Yes. The padlock only means the connection is encrypted; it does not mean the business is legitimate. A scammer can purchase a security certificate. Always check other signs like contact information, reviews, and whether the company is registered with government agencies.
What should I do if I already entered my credit card on a suspicious site?
Contact your credit card company immediately and report the transaction. They can cancel the card and issue a new one. Monitor your account for unauthorized charges over the next few months. If you see fraud, report it to your card issuer right away.
Are all sites without a physical address scams?
Not necessarily. Digital-only businesses like software companies or online services may not have a physical office. However, they should still have a phone number, email, or live chat support. If they have no way to contact them at all, that is suspicious.
How can I tell if a site is using stolen photos?
Right-click on a product photo and select "Search image with Google." If the same photo appears on multiple unrelated websites or on the manufacturer's official site with a different price, the site is likely using stolen images.