Scam guide

How to check if a website is legit: a 9-step checklist

Updated 2026-10-28 · 7 min read · by the FraudScan team

Scam websites have become hard to spot by eye. A fake bank login or online shop can copy the real design pixel for pixel, use a padlock icon and even rank in search ads. What they cannot fake as easily is the evidence around the page: who owns the domain, how old it is, how it wants to be paid and what other people have experienced.

Work through the nine checks below before you log in, pay or hand over personal details. Most take less than a minute, and you rarely need all nine. Two or three red flags together are usually enough to walk away.

1. Read the domain name carefully

Phishing sites live on look-alike domains. The trick is that the real brand name appears somewhere in the address — just not in the place that matters. The part that counts is the name directly before the ending (.com, .net, .co.uk). Everything to the left of it can be chosen freely by whoever registered the domain.

paypal.com.secure-login.net belongs to secure-login.net, not PayPal.
arnazon.com / rnicrosoft.com swapped letters (rn for m) that look identical at a glance.
yourbank-verify.com extra words such as verify, secure, support or login added to a brand name.

2. Check how old the domain is

Scammers register new domains constantly, because old ones get reported and blocked. A shop or "bank" whose domain was registered a few weeks ago is a major warning sign. You can see the registration date with any public WHOIS / RDAP lookup — FraudScan's live check shows it automatically, together with the registrar and hosting country.

3. Don't trust the padlock alone

HTTPS and the padlock icon mean the connection between you and the site is encrypted. Free certificates take minutes to obtain, so almost every phishing page has one. The padlock is a minimum requirement, never proof that a site is legitimate.

4. Look at how you are asked to pay

Legitimate shops offer payment methods with buyer protection, such as credit cards or established payment services. Be very careful when a site only accepts bank transfer, cryptocurrency, gift cards or payment to a personal account, or when the card option mysteriously "fails" and you are pushed to another method. Once that money is sent, it is very hard to get back.

5. Compare the price with reality

Discounts of 70–90% on branded goods, phones that cost a fraction of the usual price, or investments that pay a fixed percentage every day are the bait, not a lucky find. If an offer is far better than anywhere else, assume there is a reason.

6. Find the company behind the site

A real business can be identified. Look for a company name, registration number, physical address and a working phone number, then check that they match each other and an official business register. Contact pages with only a web form or a free email address, addresses that turn out to be residential or invented, and copied legal pages full of another company's name are all bad signs.

7. Search for independent reviews

Search the domain together with words like scam, reviews or complaints. Prefer independent review platforms, forums and consumer sites over testimonials on the site itself, which can be invented. Be wary of a burst of five-star reviews posted on the same days with similar wording.

8. Notice pressure and urgency

Countdown timers, "only 2 left" banners, warnings that your account will be closed within 24 hours, or a chat agent pushing you to deposit right now are designed to stop you from thinking. A real company will still be there tomorrow.

9. Check the site against a scam database

Finally, search the exact domain on FraudScan. A match means other people have reported it and a moderator has reviewed the evidence. If it isn't listed yet, run the live check: it reads the domain age, hosting and the page itself and flags things like password, card or one-time-code forms.

No result does not mean a site is safe — new scams appear every day. If your other checks raised doubts, trust them.

What to do if you already entered your details

Card details: call your bank using the number on the back of your card and block the card.
Password: change it on the real website (and anywhere you reused it), then turn on two-factor authentication.
One-time code or remote access: tell your bank immediately — these allow scammers to approve payments.
Evidence: keep screenshots, the link and any messages, and report the site on FraudScan so others are warned.

Not sure?

Check it in seconds

Paste the suspicious message, link or screenshot. We compare it with reported scams and scan the website for you, free.

Open the AI scam checker Report a scam

Frequently asked questions

Is a website with HTTPS safe?

Not necessarily. HTTPS only encrypts the connection. Most phishing sites use free HTTPS certificates, so you still need to check the domain, its age and how it asks you to pay.

How can I see how old a domain is?

Use a public WHOIS or RDAP lookup and look for the registration date. FraudScan's live check shows the domain age, registrar and hosting country automatically.

What is the fastest way to check a suspicious link?

Don't open it. Copy the link or the whole message into FraudScan's AI scam checker, which looks the domain up in reported scams and scans it for warning signs.