How to Tell if a Website Is Legit Before You Buy

The quick checklist

Before you pay a shop you have not used before, check these ten things. One warning sign is worth investigating. Several together usually mean walk away.

1. The web address is spelled exactly right
2. The domain is not brand new
3. Independent reviews exist and are mostly positive
4. There is a real address, phone number and company details
5. Returns, refunds and delivery terms are clear
6. Prices are not far below every other shop
7. The site offers protected payment methods
8. The writing and images look professional and original
9. The social media accounts are real and established
10. A safety-check tool does not flag the site

1. Read the address carefully

Scam sites often imitate real brands with a small change: amaz0n-deals.com, nike-outlet-sale.shop or apple.support-store.net. The real domain is the part just before the first single slash. In apple.support-store.net, the site is support-store.net, not Apple.

Type well-known shops' addresses yourself, or use a bookmark, rather than clicking links in ads, texts or emails. Our guide to scam texts and phishing emails explains lookalike links in more detail.

2. Check how old the domain is

Fake shops are created and abandoned quickly. Look up the domain on a WHOIS service, such as ICANN Lookup, to see when it was registered. A shop that claims to be an established brand but whose domain is weeks or a few months old is a serious red flag, especially just before Black Friday and Christmas.

3. Look for independent reviews

• Search the shop's name with words such as "scam", "reviews" or "complaints".
• Read reviews on independent sites and forums, not just testimonials on the shop itself, which can be invented.
• Be suspicious of a wall of five-star reviews posted in the same week, or no reviews at all.

4. Find real contact details

A legitimate shop usually lists a physical address, a phone number and, in many countries, a company registration number. Check the address on a map: is it a real business location, or a house or random field? Contact forms and free email addresses only are a warning sign.

5. Read the returns and delivery terms

Look for clear terms on returns, refunds, delivery times and who pays return postage. Scam sites often have vague policies, copied text that mentions a different shop's name, or terms requiring you to post returns to another country at your own expense.

6. Be suspicious of prices that are too good

Big brand trainers at 80 percent off, new games consoles at half price, designer bags for a fraction of retail: these are the bait. If a price is far below every other retailer, ask why. Countdown timers and "only 2 left" banners are designed to rush you.

7. Check how you can pay

• Credit cards give the strongest protection in many countries, including chargebacks.
• PayPal and similar services offer buyer protection on eligible purchases.
• Bank transfer, cryptocurrency, gift cards and payment apps sent to individuals are favourites of scammers, because the money is almost impossible to get back.

If the only options are a bank transfer or crypto, or the card option "fails" and you are pushed to transfer instead, stop.

8. Look at the site itself

Spelling mistakes, stretched or watermarked product photos, and the same images as other shops all suggest a site was thrown together. A quick reverse image search on a product photo can reveal it was copied from the real brand.

9. Check social media

Links to social media accounts should go to real, established profiles with a history of posts and genuine comments, not new pages with comments turned off.

10. Use a safety-check tool

Free tools can help, though none is perfect:

• Google Safe Browsing site status checks whether Google has flagged a site as dangerous.
• Some consumer organisations run website checkers that combine domain age and other signals. Get Safe Online's checker is one example in the UK.
• Most browsers warn you about known dangerous sites. Do not click past those warnings.

A clean result does not prove a site is legitimate, because new scam sites may not be flagged yet.

The padlock myth

The padlock and https only mean your connection is encrypted. They do not mean the business is real. Most scam sites have a padlock, because certificates are free.

If you have already paid

1. Call your bank or card issuer straight away and ask about a chargeback or fraud claim. Time limits apply, so act fast.
2. Change the password you used on the site, and anywhere you reused it. A password manager makes unique passwords easy.
3. Watch your statements for unfamiliar charges.
4. Report the site: in the US to the FTC at ReportFraud.ftc.gov, in the UK to Report Fraud (formerly Action Fraud), or to your national fraud reporting service.
5. Be wary of "recovery" services that contact you offering to get your money back for a fee. They are often the same scammers.

If you entered personal details, our guide on checking whether your data was in a breach explains what to do next.

Key takeaways

• The padlock proves nothing about honesty.
• Check the exact domain, its age and independent reviews before you pay.
• Prices far below everyone else's are the most common bait.
• Pay by credit card or a protected method, and never by transfer, crypto or gift card to a shop you do not know.