How to Check if a Website Is Legit: A Safe 12-Step Scam Detection Guide

Overview

A polished design is not proof that a site is trustworthy. Fraudulent websites can copy familiar branding, use convincing product photos, and create checkout pages that look professional. Conversely, a small or unfamiliar business may have a basic design without being fraudulent. The goal is not to judge a site by one detail, but to compare several independent clues.

Use the checklist below before sharing passwords, payment details, identity documents, or personal information. If a website is asking you to act urgently, bypass normal payment protections, or download unexpected software, pause the process. A legitimate-looking page is not worth the risk of losing an account or exposing financial information.

For a broader review, see our step-by-step fake website checker guide. If you have already entered information or paid, use the recovery checklist for what to do after a scam.

Checklist by scenario

Work through these 12 steps in order. You do not need to prove that a site is fraudulent before leaving it. Several unresolved warning signs are enough to stop and verify the business through a separate channel.

1. Start with the exact address. Read the domain carefully, including the spelling, ending, and words before the main domain. Look for substituted letters, extra hyphens, unusual subdomains, or a name that is close to—but not the same as—a known brand. Do not assume a familiar logo means you are on the official site.
2. Check how you arrived there. Be cautious with links from unsolicited email, text messages, social media advertisements, pop-ups, and QR codes. To check a link safely, avoid opening it directly when possible; instead, type the known website address into your browser or use a saved bookmark. This is especially important for bank text scams, parcel delivery scams, and fake account notices.
3. Inspect HTTPS without overtrusting it. A padlock or an address beginning with https indicates an encrypted connection between your browser and the site. It does not prove that the business is honest. Scam sites can also use encrypted connections, so treat HTTPS as a basic security feature, not a legitimacy certificate.
4. Look up the domain and registration clues. Domain lookup tools may show when a domain was registered and whether its details are publicly visible. A recently registered domain is not automatically malicious, but it deserves more scrutiny when combined with copied branding, steep discounts, or weak contact information. Registration privacy alone is not proof of a scam.
5. Find real contact information. Check whether the site provides a physical business address, a working phone number, and an email address using the same domain. Test the contact route with a non-sensitive question if you need to. Be wary of a contact form that is the only option, an address that appears copied, or support that communicates solely through a personal messaging account.
6. Read the refund, shipping, and privacy pages. Look for clear information about delivery times, returns, cancellations, data use, and customer support. Missing pages, contradictory terms, unusual restrictions, or text that refers to a different company are meaningful warning signs. A policy page can be copied, so treat it as one clue rather than final proof.
7. Compare prices and product details. An unusually low price can indicate counterfeit goods, a bait-and-switch offer, or a store that will never ship. Compare the same item on several independent sites and check whether product descriptions, stock claims, and delivery promises make sense. Pressure to buy immediately is another reason to pause.
8. Check reviews outside the website. Do not rely only on testimonials displayed by the seller. Search for the domain or business name with terms such as “complaint,” “refund,” or “review,” and compare results across unrelated sources. Reviews can be manipulated, so look for specific experiences, consistent dates, and evidence that reviewers are discussing the same business.
9. Examine payment methods. Be cautious if the seller insists on cryptocurrency, gift cards, wire transfers, direct bank transfers, or payment through an unfamiliar person-to-person account. These methods may offer less practical recourse than a payment method with established dispute processes. Never send extra money because a checkout page claims your payment failed without first checking your account independently.
10. Scan the link and observe browser warnings. A reputable online scam checker or link-scanning service can provide an additional signal, but no tool can guarantee that a site is safe. Do not paste private login links, password-reset URLs, or sensitive documents into a third-party service. If your browser blocks a page or displays a malware, phishing, or deceptive-site warning, do not override it merely to continue.
11. Reverse-search important images. Product photos, staff portraits, and business images may appear on unrelated websites. A reverse-image search can reveal that a seller reused catalog photos or copied another company’s content. Matching images do not automatically prove fraud, because legitimate retailers can use shared manufacturer images, but unexplained reuse adds to the overall risk.
12. Test the decision without pressure. Ask: Would I trust this site if the discount disappeared? Can I verify the business independently? Does the site want information that is unnecessary for the transaction? If the answer is unclear, leave the page and return later through a known route. Legitimate purchases generally do not require you to ignore your doubts.

Apply the checklist to common situations

For an unfamiliar online store, prioritize the domain, business identity, refund terms, independent reviews, and payment method. For a login page reached through a message, do not use the message link; open the service through its official app or a manually entered address. For a download page, verify the publisher, avoid bundled installers, and use the platform’s official distribution channel when available. For a marketplace seller, inspect the account history and keep communication and payment within the platform’s normal process. Our suspicious seller checklist covers that scenario in more detail.

What to double-check

Some signals are easy to misread. A professional logo, a padlock, a social media presence, or a high search ranking does not independently establish legitimacy. Search results can include paid placements, copied pages, and newly created sites. Likewise, poor grammar is a clue but not a verdict; legitimate businesses can have translation or editing problems.

When evidence conflicts, separate facts from assumptions. Confirm the company name using a source you found independently, compare the domain with an established official account, and contact the business through details that were not supplied by the suspicious message. Never use a phone number or link from a warning email to verify that same warning.

Be especially careful when a site requests a password, one-time code, identity document, remote-access application, or payment to “unlock” a refund or account. These requests often appear in phishing, tech support, and refund scams. Read our guide to tech support scam warning signs if a page asks you to install remote-access software.

Common mistakes

• Trusting HTTPS as a guarantee: Encryption protects the connection; it does not verify the operator.
• Relying on one checker: A clean scan can reflect limited data or a site that has not yet been reported. Use tools as supporting evidence.
• Searching only the brand name: Search the exact domain, spelling variations, contact details, and refund experiences.
• Entering information to “test” the site: Do not submit a real password, card number, identity document, or one-time code while investigating.
• Letting urgency make the decision: Countdown timers, account threats, and claims that stock is disappearing are reasons to slow down, not exceptions to the checklist.
• Assuming a small business is fake: Judge the quality and consistency of verifiable information rather than design polish or company size.

When to revisit

Use this checklist whenever you encounter a new store, login page, download, seller, donation request, or investment offer. Recheck a site before seasonal shopping periods, after a company changes its domain, or when you receive a new message directing you to an account page. Fraudulent copies and lookalike domains can appear after a legitimate brand becomes popular.

Tools and browser warnings also change, so revisit your personal verification routine when you change devices, browsers, password managers, or payment services. Keep a short version of the checklist near your work area or save it in a trusted notes app:

1. Read the exact domain and avoid unsolicited links.
2. Verify the business independently.
3. Check contact, refund, shipping, and privacy information.
4. Compare prices and search for outside reviews.
5. Use a payment method with appropriate protections.
6. Do not override browser warnings or share sensitive information under pressure.

If you acted before checking, stop further communication, contact your bank or payment provider through an official channel, change any exposed passwords, and watch for identity theft warning signs. For reporting options, see how to report a scam to the right platform, bank, or agency. The safest answer to “is this website legit?” is often to wait until the available evidence supports a confident decision.