A friend forwards a link to an unbelievable sale. An ad promises a phone at half price. A text says your parcel is stuck and needs a small fee. In each case, the real question is the same: can you trust this website?
You do not need to be a security expert to answer that. With a few quick checks, most of them taking seconds, you can check if a website is safe before you type in a password or card number. Here is how.
1. Read the address carefully
Scammers count on you glancing at a web address rather than reading it. Look for:
- Misspellings like amaz0n, paypa1 or g00gle.
- Extra words such as amazon-deals-support.com or secure-login-bank.net. The real brand’s site is usually just its name followed by .com or a country domain.
- Odd endings like .xyz, .top or .shop on a site claiming to be a big, well-known company.
The part that matters is just before the first single slash. In paypal.com.account-verify.info/login, the real domain is account-verify.info, not PayPal.
2. Do not trust the padlock alone
The padlock icon (HTTPS) means the connection between you and the site is encrypted. It does not mean the site is honest. Scam sites get free certificates in minutes, so a padlock is the bare minimum, not a seal of approval. If a site asking for your details has no padlock at all, though, close it.
3. Run the address through a free checker
Copy the link (do not click it) and paste it into one of these:
- Google Safe Browsing site status, on Google’s Transparency Report, tells you whether Google has flagged the site as dangerous.
- VirusTotal checks the link against dozens of security vendors at once.
A clean result is a good sign but not a guarantee, since brand-new scam sites may not be flagged yet. A flagged result is a clear signal to stay away.
4. Check how old the website is
Many scam shops are only weeks old. Search the domain name on a WHOIS lookup service to see when it was registered. A site claiming “trusted since 2005” whose domain was registered last month is lying to you.
5. Look for real contact details
Legitimate businesses tell you who they are. Look for a physical address, a working phone number and a proper contact page. Be suspicious if the only option is a web form or a Gmail address, or if the “About us” page is vague and full of generic stock phrases.
6. Search for reviews outside the site
Reviews on the website itself mean very little, since they can be invented. Search the shop’s name followed by reviews or scam and see what comes up on independent sites and forums. No footprint at all for a shop claiming to be big is a warning sign by itself.
7. Watch for pressure and too-good-to-be-true prices
Countdown timers, “only 2 left” banners, and prices 70 or 80 percent below every other shop are classic tactics. Real sales exist, but if a brand-new phone costs a third of its normal price, there is a reason, and it is not generosity.
8. Check how they want you to pay
Safe shops accept credit cards or established payment services that offer buyer protection. Be very cautious if a site only accepts bank transfers, gift cards or cryptocurrency. Once that money is gone, it is almost impossible to get back.
9. Let your browser help
Modern browsers block known dangerous sites with a full-screen red warning. Make sure this protection is on. In Chrome, go to Settings > Privacy and security > Security and choose Enhanced protection or at least Standard protection. If you ever see that red warning page, believe it and go back.
What to do if you already clicked or paid
Do not panic, but act quickly:
- If you entered a password, change it right away on the real site and anywhere else you reused it. Our guide to creating strong passwords makes this easier.
- Turn on two-factor authentication for important accounts.
- If you entered card details, call your bank and ask them to block the card.
- Run a security scan on your device.
Most dodgy links arrive by email or text, so it is worth learning how to spot a phishing email or message as well.
Quick recap
To check if a website is safe, read the address slowly, remember the padlock only means encryption, run the link through Google Safe Browsing or VirusTotal, and look at the site’s age, contact details and outside reviews. If the price is unreal or the payment method is unusual, walk away. Two minutes of checking beats weeks of chasing a refund.
