How to tell if a website is legit

A convincing fake shop or sign-in page takes an afternoon to build. In 2025, nearly 30 percent of people who told the FTC they had lost money to a scam said it started on social media, with $2.1 billion lost, and more than 40 percent of those were buying something they had seen in an ad. Phishing is near its highest level in years: the Anti-Phishing Working Group counted 425,808 phishing sites in June 2026 alone, the most in a month since April 2023. The checks below tell a real site from a copy, and most take seconds.

The one-minute check

• Read the real domain.The part just before the first single slash, read from the right.
• See how old the domain is.A site registered last week shouldn’t be claiming twenty years in business.
• Run it through Google Safe Browsing.It flags sites Google currently knows to be dangerous.
• Find a real business behind it.An address, a phone number and a returns policy you can check.
• Search its name with “scam” and “complaint”.Other people’s experience, from outside the site.
• Pay in a way you can dispute.A credit card, never a gift card, wire, payment app or crypto to a stranger.

Read the real address

Everything else on a page can be copied: the logo, the photos, the layout, even the reviews. The domain can’t. To find it, look at the address, find the first single slash after the https://, and read the words just before it from the right. In yourbank.com.secure-login.example/sign-in, the site you are on is secure-login.example. The “yourbank.com” at the front is just a label its owner chose. Chrome’s own guidelines note that everything before the real domain, and everything after it, is completely under the control of the website and can be crafted to mislead.

read it from the right

Watch for three kinds of lookalike:

• Typos and swaps. A zero for an o, an extra letter, a hyphen, a different ending such as .co instead of .com.
• Real names in the wrong place. A brand’s name used as a subdomain of someone else’s site, as in the example above.
• Letters from other alphabets. A Cyrillic “а” looks identical to a Latin “a”. Browsers show some of these addresses in a coded form starting with xn--, which is a reason to stop and look.

Chrome warns about many lookalikes with a “Did you mean” message, but its documentation is clear that it can not detect all lookalike domains. Ads deserve the same caution: criminals buy search and social ads that lead to copies of real sites. For anything that involves a password or a payment, type the address yourself or use a bookmark.

Check how old the site is

ICANN Lookup is the official, free place to see when a domain was registered. Since January 2025 it has used a system called RDAP, which replaced the old WHOIS service for most domain endings. Type the domain and look for the registration or creation date.

You will usually find the owner’s name and address marked as redacted. That is normal: privacy rules require it, so it says nothing either way. The date is what matters. A store claiming decades of history on a domain registered last month is lying about something. But age cuts only one way: new businesses have new domains, and old domains can be bought, or hacked and reused.

What the padlock means, and what it doesn’t

HTTPS means the connection between your browser and the site is encrypted, so no one in between can read it. It says nothing about who is on the other end. Google’s Chrome team put it plainly in 2023: “nearly all phishing sites use HTTPS”, and in its research only 11 percent of people correctly understood what the padlock meant. That is why Chrome replaced the padlock with a neutral “tune” icon in version 117, released in September 2023. The FBI said the same years earlier: “Do not trust a website just because it has a lock icon or ‘https’ in the browser address bar.”

The useful rule is the reverse one. If a page asks for a password or a card number and is not using HTTPS, leave.

Check Google Safe Browsing

Google’s Safe Browsing site status tool shows whether a site is currently flagged as dangerous. Google says it finds thousands of new unsafe sites every day, “many of which are legitimate websites that have been compromised.” A warning is worth taking seriously. A clean result is not a clean bill of health: a scam site launched this week may not have been caught yet. If you find a phishing page, you can report it to Google so the warning reaches others.

Find the business behind the site

A real shop is run by a real business, and it leaves details you can check:

• Contact details. A street address, a phone number and an email address on the site’s own domain. Look the address up on a map, and call the number.
• Policies. The FTC says a site “must say whether you’re able to return the item for a full refund.” Vague or missing shipping and returns terms are a warning.
• The company itself. The legal name in the terms or the footer should match a business you can find in an official registry. Our guide to checking if a business is legit walks through it.
• Prices. Deep discounts on brands that never discount are the classic bait. The FTC found that many social media ads behind reported losses led to unfamiliar websites or to sites impersonating well-known brands offering big discounts.

Read reviews the right way

Reviews on the site itself prove nothing; they are as easy to fake as the site. The FTC’s advice is to search the product or company name “plus the words ‘complaint’ or ‘scam,’” and not to rely on star ratings, because “some reviews and ratings are fake or misleading.” In the US, Chrome can also show an AI-written summary of a store’s reviews from other sites: click the icon to the left of the web address.

Do website checkers work?

Free “legit checkers” combine signals such as domain age, blocklists and reports into a score. They are a reasonable second opinion, not a verdict, and their makers say so. ScamAdviser calls its score “a risk indicator, not a verdict” and warns that a scam site registered yesterday with no negative history “will score higher than it deserves until reports accumulate.” URLVoid checks a site against more than 30 blocklists and says data submitted to it is shared with security companies, so never paste in a link that contains personal details or a login token.

Pay in a way you can take back

“Paying by credit card best protects you and your money in case of a scam,” says the FTC. Under the Fair Credit Billing Act you can dispute charges for things you “didn’t accept or weren’t delivered as agreed”, your liability for unauthorized charges is capped at $50, and your dispute letter must reach the card issuer within 60 days of the first bill showing the error.

The FTC’s other rule is absolute: never buy from a seller that insists you pay with gift cards, a wire transfer, a payment app or cryptocurrency. Those payments are hard or impossible to reverse, which is exactly why scammers ask for them.

Let your password manager and browser help

A password manager is one of the best fake-site detectors you have. The UK’s National Cyber Security Centre points out that it protects you from phishing because “the password will only autofill on the correct website.” If your password manager doesn’t offer your login on a page that looks exactly like your bank’s, don’t copy and paste the password in. Stop and check the address. The same goes for a browser warning: read it before you click past it.

Already paid, or typed in a password?

Act today, and in this order:

1. Contact whoever moved the money. The FTC’s advice is to report it immediately to your card issuer, bank, payment app, gift card issuer, wire company or crypto exchange, and ask them to reverse the payment.
2. Change the password on the real site, and anywhere else you used it, then turn on two-factor authentication.
3. If you gave your Social Security number or ID documents, use IdentityTheft.gov for a recovery plan.
4. Report it to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov. Forward phishing emails to reportphishing@apwg.org, scam texts to 7726 (SPAM), and report the site to Google Safe Browsing. Type these addresses yourself: fake “recovery” sites copy them too.

Non-payment and non-delivery scams alone drew 56,478 complaints and $503.4 million in reported losses to the FBI in 2025. Reporting is how the next shopper gets warned.

Sources

1. FTC Data Spotlight, Reported losses to scams on social media eight times higher than in 2020, April 27, 2026.
2. Anti-Phishing Working Group, Phishing Activity Trends Report, second quarter 2026.
3. Chromium, Guidelines for URL display, and Lookalike warnings in Google Chrome.
4. ICANN, Launching RDAP; sunsetting WHOIS, January 27, 2025.
5. Chromium Blog, An update on the lock icon, May 2, 2023.
6. FBI, Cyber actors exploit “secure” websites in phishing campaigns, June 10, 2019.
7. Google Transparency Report, Safe Browsing site status.
8. FTC Consumer Advice, Online shopping.
9. Google, Chrome is helping you shop smarter and safer with store reviews, July 28, 2025.
10. ScamAdviser, Algorithm explainer, and URLVoid.
11. FTC Consumer Advice, Using credit cards and disputing charges.
12. UK National Cyber Security Centre, Password managers.
13. FTC Consumer Advice, What to do if you were scammed.
14. FBI Internet Crime Complaint Center, 2025 IC3 Annual Report, April 2026.