How to Spot a Scam Website: 9 Checks Before Paying

Start with the address, seller and payment request

A convincing design, HTTPS or a familiar logo does not prove that a shop is legitimate. Before paying, check the exact website address, verify the seller independently and read the payment request. Use the nine checks below together; one signal alone is rarely enough to establish fraud.

This is a manual screening guide, not a security certification or a scan of a particular website. Stop if the evidence is inconsistent and verify through a contact channel you found independently.

1. Read the actual domain, not just the brand name

Copy the address into plain text and separate the hostname from the path. In the fictional example https://brand.example.checkout-test.example/pay, the address is under checkout-test.example. The brand name at the beginning does not make it a page belonging to brand.example.

Compare the full domain with an independently located official address. Watch for changed letters and extra words. These example domains are illustrative and do not identify real businesses.

2. Compare the offer with other sellers

Check the same product, condition, shipping cost and total price elsewhere. An unusually low price deserves an explanation, but a discount alone is not proof of a scam. Save the listing so you can compare what was promised with the checkout.

3. Pause when the message pressures you

A countdown, urgent account threat or demand to pay immediately can discourage verification. Open the service through its known website or app instead of the message link. Ask whether the same offer or account notice is visible there.

4. Verify who is selling

Look for a business name, reachable support, delivery terms and a clear returns policy. Check that the name on the order and payment matches the seller you intended to use. An address or phone number printed on the page can be copied; contact details alone are not enough.

5. Look beyond the reviews on the page

Compare independent descriptions of the seller with its own testimonials. Read specific complaints and responses rather than trusting an average star score. A new business may have few reviews; that calls for further checking rather than an automatic fraud verdict.

6. Separate encrypted connections from seller trust

HTTPS protects the connection between your browser and the site. It does not establish that the seller will deliver an order or that the business identity is genuine. Read the browser’s site information and take security warnings seriously. Google explains the distinction in its connection security guidance.

7. Recheck the checkout and payment recipient

Confirm the final amount, seller name and destination before authorising payment. Some legitimate shops use an external payment provider; verify that provider independently if the redirect is unexpected. Be cautious if the seller suddenly asks you to leave the normal checkout or pay an unexplained recipient.

A bank transfer is not automatically fraudulent. The question is whether the recipient, order and terms can be verified. The FTC’s online shopping guide offers further checks on sellers, reviews and payment choices.

8. Question requests unrelated to the purchase

A seller should be able to explain why it needs particular information. Stop if a support conversation asks for your account password, remote access to your device or a download unrelated to the order. A verification code in a checkout you initiated is different from a stranger asking you to read out that code.

9. Use external checks without treating them as guarantees

Check the address in Google Safe Browsing’s site status tool. A warning is a reason to stop. The absence of a warning is not proof that a new or unreported website is safe. You can also consult the NCSC’s phishing guidance for suspicious messages and reporting options.

A short decision checklist

1. Locate the official address independently and compare the full hostname.
2. Check the seller, product terms and final price.
3. Confirm the payment recipient and any redirect.
4. Check browser warnings and independent information.
5. If a check remains unresolved, pause the purchase and verify first.

Write down the address, seller name, amount and reason for concern. This makes a support enquiry more useful than simply asking whether a site “looks safe”. Do not include passwords, full card details or verification codes.

If you already shared information or paid

Stop the suspicious interaction. Reach your bank or payment provider through its official app or a known contact channel. If you shared an account password, change it through the genuine service and review account access. Keep the URL, messages, order confirmation and payment record for support or a report. Use official reporting channels available in your country.

What these checks can and cannot tell you

The aim is to identify inconsistencies before acting, not assign a universal safety score. A clean-looking website can still be misleading, and a poorly designed legitimate shop can still exist. Base your decision on corroborated information about the domain, seller and transaction.

Sources and related tools

• Google Chrome: connection security and warnings
• FTC: online shopping checks
• NCSC: phishing recognition and reporting

For a structured manual check, use our link checker or site risk review tool. Tool output is a starting point for verification, not a guarantee.

Frequently asked questions

Does HTTPS mean a shop is genuine?

No. It indicates an encrypted connection, not the identity or reliability of the seller.

Is every link in a text message unsafe?

No, but an unexpected message should be verified through the service’s independently located website or app.

Does a very low price prove fraud?

No. Compare the complete offer and verify the seller and payment recipient before deciding.

Can a checker guarantee that a site is safe?

No. New threats and unreported activity can escape automated checks. Use multiple sources and pause if the evidence conflicts.