Check the web address for signs of impersonation

Scammers often create websites with addresses that look almost like the real thing. Before you enter any information, look at the URL in your browser's address bar — not the clickable link that brought you there, but the actual web address at the top.

Real government websites end in .gov. Real banks and major companies own their exact domain name. If you're looking for your state's unemployment office, the address should be something like unemployment.state.ny.us, not unemployment-ny.com or ny-unemployment-help.net. Scammers buy domains that are one letter off or use a different ending to fool you.

Type the official web address directly into your browser instead of clicking a link in an email or text message. If you're not sure what the real address is, call the organization's phone number from a bill or official letter you already have, and ask them for their website.

Look for a padlock icon and HTTPS in the address bar

A padlock icon next to the web address means the connection between your computer and the website is encrypted — your information is scrambled so others cannot read it. The address should also start with https:// rather than http://. The "s" stands for secure.

This does not mean the website is legitimate — a scam site can have a padlock too. But it does mean that if you enter information, it will not be intercepted by someone on the same wifi network. Always look for the padlock before entering passwords, credit card numbers, or Social Security numbers.

If you are on a website asking for sensitive information and there is no padlock, leave immediately. Do not enter anything.

Key Takeaways

  • Government websites end in .gov, and real companies own their exact domain name — check the address bar, not the link that brought you there.
  • A padlock icon and https:// in the address bar mean your information is encrypted, but they do not prove the site is real.
  • Scammers copy the look of real websites but use slightly different addresses, so type the official web address directly instead of clicking email links.
  • Real organizations have contact information, working phone numbers, and clear privacy policies that explain what they do with your data.
  • If a website pressures you to act fast, asks for money upfront, or promises something that sounds too good to be true, it is probably a scam.

Search for the organization's real contact information

Legitimate websites display a real phone number, mailing address, and email contact somewhere on the page — usually in a footer or a "Contact Us" section. Call that number and ask if the website you found is theirs. If the number is disconnected or the person who answers has never heard of the website, you have found a fake.

Be cautious of websites that only offer a contact form with no phone number. Real government agencies and established companies almost always publish a phone number so people can reach them. If you cannot find a way to call, that is a warning sign.

You can also search the organization's name plus the word "scam" or "fake" in a search engine. If many people have reported the website as fraudulent, you will see those reports. This is not foolproof — new scams may not have reports yet — but it catches the ones that have already hurt people.

Watch for pressure to act fast or pay money upfront

Scammers create urgency to stop you from thinking clearly. Phrases like "act now," "limited time," "your account will be closed," or "you must pay today" are red flags. Real organizations give you time to make decisions.

Legitimate government programs do not ask you to pay money to receive benefits or information. If a website is asking for a fee to help you with unemployment, housing, taxes, or any government service, it is a scam. The actual government service is free.

Be especially suspicious of websites that ask you to wire money, buy gift cards, or pay through an untraceable method. These are signs the person taking your money has no intention of providing what they promised.

Check for a privacy policy and professional appearance

Real websites explain what they do with your information. Look for a "Privacy Policy" link, usually at the bottom of the page. It should describe what data they collect, why they collect it, and who they share it with. If there is no privacy policy, or if it is vague and confusing on purpose, that is a warning.

Professional websites are also usually free of spelling mistakes, broken images, and outdated information. Scammers often copy real websites quickly and do not maintain them. If the page looks sloppy or has obvious errors, treat it as suspicious.

That said, a polished appearance alone does not make a site real. Scammers have gotten better at making fake websites look professional. Use this as one check among several, not the only one.

Verify the website through a trusted source

If you are unsure whether a website is real, do not enter your information. Instead, find the organization through a source you already trust. If you are looking for a government service, go to the official state or federal website and find the link from there. If you are looking for a company, call their main phone number from a bill you have at home.

You can also ask someone you trust — a family member, a librarian, or a local community center — to help you check. Many libraries offer free help with online safety and can verify whether a website is legitimate.

Taking an extra five minutes to verify a website before entering your information can save you from identity theft, fraud, and financial loss.

Frequently Asked Questions

Can a scam website have a padlock and HTTPS?

Yes. A padlock means your connection is encrypted, but it does not prove the website is real. Scammers can buy security certificates just like legitimate businesses. Always check the web address and contact information in addition to looking for the padlock.

What should I do if I already entered my information on a fake website?

Contact your bank or credit card company immediately if you entered financial information. If you entered your Social Security number, place a fraud alert with the three credit bureaus (Equifax, Experian, and TransUnion) by calling 1-888-397-3742. Monitor your credit report for suspicious activity.

Is it safe to click links in emails from companies I know?

No. Scammers copy the look of real company emails and send them to thousands of people. Instead of clicking the link, type the company's web address directly into your browser or call their phone number from a bill. Real companies understand this and do not mind if you verify through another route.

How do I know if a .gov website is real?

All legitimate government websites end in .gov. If a website claims to be government but ends in .com, .net, or any other ending, it is not an official government site. You can also search the agency name on the official state or federal website to find the real link.

What if the website looks exactly like the real one but the address is slightly different?

That is a common scam tactic called "typosquatting." Scammers buy addresses that are one letter off or use a similar word. Always type the official address directly instead of clicking links. If you are not sure of the exact address, call the organization and ask them to spell it out for you.