TL;DR: To check if a website is legit, look at the exact domain spelling, run it through a free checker like Google Safe Browsing and Get Safe Online’s Check a Website, look up how old the domain is, and search the store’s name plus “scam” or “complaint”. The padlock only means the connection is encrypted, not that the seller is honest. If anything feels off, don’t pay, and if you do buy, use a credit card: US law lets you dispute charges for goods that never arrived, and in the UK Section 75 covers single items over £100 and up to £30,000.
Last updated: November 3, 2026. By Veer. Guidance checked on November 3, 2026 against the FTC, the UK’s National Cyber Security Centre, MoneyHelper and Report Fraud. This is a researched guide built from official consumer advice, not a test of any checker tool.
Holiday shopping season is when fake shops do their best business. A sponsored post shows a $300 coat for $49, the site looks polished, checkout takes a card, and the parcel never comes. The good news is that most fake stores fail a handful of quick checks you can run in about five minutes, before you hand over a card number.
This guide walks through those checks in order, from the ten-second ones to the slightly nerdier ones, then covers what to do in the US and UK if you’ve already paid.
How do you check if a website is legit?
Check the domain, check its reputation, and check how it wants to be paid. A legit store has a correctly spelled domain that’s usually been registered for years, a track record you can find outside its own pages, real contact details and a normal card checkout. A scam site usually fails at least two of those.
Here’s the quick version:
| Check | Takes | Red flag |
|---|---|---|
| Read the domain letter by letter | 10 seconds | Misspelled brand, extra words, odd ending (e.g. nike-outlet-sale.shop) |
| Run a free scam checker | 30 seconds | Low trust score or a “dangerous” warning |
| Look up the domain age | 1 minute | Registered in the last few weeks or months |
| Search “store name + scam / complaint” | 2 minutes | Complaints about non-delivery or fake goods |
| Check contact and returns pages | 1 minute | No address or phone, a copy-paste returns policy |
| Sanity-check the prices | 30 seconds | Big brands at 70–90% off across the whole site |
| Look at payment options | 30 seconds | Only bank transfer, gift cards, crypto or payment apps |
| Trust how you got there | 10 seconds | You arrived from an ad, text or email rather than typing the address |
1. Read the domain letter by letter
Scam stores often borrow a real brand’s name and bolt something onto it: a hyphenated “outlet” or “sale”, a swapped letter, or an unusual ending like .shop or .top. Look at the address bar, not the logo, because logos are easy to copy.
The FTC’s advice is simple: instead of clicking a link in an email or ad, type the store’s address yourself so you know where you’re headed. If you use a password manager, it helps here too: most only offer to autofill on the exact domain you saved, so a login box that stays empty on a “Nike” page is a warning sign. (We compared the main options in Bitwarden vs 1Password vs Proton Pass.)
2. Run the site through a free scam checker
Free checkers catch a lot of known-bad sites in seconds. They can’t prove a brand-new site is safe, but a bad result is a clear stop sign.
- Google Safe Browsing site status: Google says its Safe Browsing tech “examines billions of URLs per day” and the lookup tells you whether a site is currently flagged as dangerous. It’s best at malware and phishing, less so at shops that simply never ship.
- Get Safe Online’s Check a Website: a UK service run with the fraud-prevention body Cifas and ScamAdviser. It gives a trust score built from more than 40 data sources plus reports of malicious sites. It can’t check shortened links (like bit.ly) or email addresses, and it works for non-UK sites too.
- VirusTotal: paste a URL and it’s checked against many security vendors’ blocklists. Handy for links you got in a text or email.
Use two of them. If both are clean, keep going down the list; a clean score on a store that opened last month doesn’t mean much on its own.
3. Look up how old the domain is
Domain age is one of the most useful signals there is. Real retailers have usually held their domain for years, while fake shops tend to be registered shortly before a sales season and abandoned after.
Go to ICANN Lookup, type the domain, and look for the creation or registration date. Many registrars hide the owner’s name for privacy, which is normal, so don’t read anything into that. A creation date from a few weeks ago on a site claiming to be “established in 1998” is a lie you just caught.
4. Search for other people’s experiences
Search the store’s name plus “scam”, “complaint” or “reviews”, as the FTC recommends. Look on Reddit, Trustpilot and news sites, not just the testimonials on the store itself.
Read reviews with some suspicion. The FTC points out that fake reviews can be positive or negative and warns against relying on star ratings alone. A wall of five-star reviews posted in the same week, all vague, is worse than no reviews.
5. Check the contact, returns and “about” pages
A legit store tells you who it is. Look for a physical address you can find on a map, a working phone number or at least a real support email on its own domain (not a free Gmail address), and a returns policy that names a country and a returns address.
Scam sites often have returns pages copied from another store, sometimes with the wrong company name still in them. If the “about us” text is generic enough to describe any shop on earth, that’s a bad sign.
6. Sanity-check the prices
Discounts are normal in November. A whole site of premium brands at 70–90% off is not. If a $1,000 laptop is listed at $199, it’s either a typo the store will cancel or a trap.
Compare the price against two or three big retailers. If nobody else is close, assume the deal isn’t real.
7. Look at how it wants you to pay
This is the check that protects your money even if the others miss something. The FTC says plainly: never buy from online sellers who insist on gift cards, wire transfers, payment apps or cryptocurrency, because those are hard to reverse.
A credit card is the safest way to pay at an unfamiliar store:
| United States | United Kingdom | |
|---|---|---|
| Main protection | Fair Credit Billing Act billing-error dispute | Section 75, Consumer Credit Act |
| Covers | Items not delivered as agreed, wrong amounts, unauthorized charges | Single items over £100 and up to £30,000 that aren’t supplied, are faulty or were misrepresented |
| Deadline | Written dispute must reach the issuer within 60 days of the first bill showing the charge | Within 6 years, per FCA guidance |
| Debit cards | Ask your bank; protections are weaker | Not Section 75, but you can ask for a “chargeback” |
| Unauthorized-charge limit | Your liability is capped at $50 | N/A |
In the UK, Section 75 still applies if you paid only part of the price, such as a deposit, by credit card, according to MoneyHelper. PayPal has its own buyer disputes, which Citizens Advice says you have 180 days to open.
8. Don’t trust the padlock on its own
The padlock (https) means your connection to the site is encrypted. It does not mean the business is real. The FTC puts it bluntly: “Scammers know how to encrypt sites, too.” A missing padlock on a checkout page is a reason to leave; a padlock is not a reason to stay.
The same goes for how you found the site. Fake stores lean on social media ads, scam texts and emails because those skip the search results where complaints would show up. If you got there from a text, read our guide to stopping spam texts on iPhone too.
What to do if you already paid a fake website
Act fast, because card disputes have deadlines. Contact your card issuer or bank first, then report the site.
- Call your card issuer or bank and tell them the charge is fraudulent or the goods never arrived. In the US, follow up in writing within 60 days; in the UK, say you’re claiming under Section 75 or asking for a chargeback.
- Change any password you typed into the site, and turn on stronger sign-in where you can (see passkeys explained and is SMS 2FA safe?).
- Report it. In the US, use ReportFraud.ftc.gov and, for internet crime, the FBI’s IC3. In England, Wales and Northern Ireland, use Report Fraud (0300 123 2040), which replaced Action Fraud on December 4, 2025; in Scotland, call Police Scotland on 101. Anyone can report the site itself to the NCSC, which says it can investigate and take down scam websites.
- Watch for follow-up scams. Your email and phone number are now on a scammer’s list. Our guide on how to check if your email has been compromised shows what to look for.
Verdict
You don’t need special software to spot most fake stores. Read the domain, run it through two free checkers, look up the domain age and search for complaints; that catches the large majority of obvious scams in five minutes. Then pay with a credit card, because no checklist is perfect and the card is your safety net.
If a deal only exists on one site you’d never heard of until an ad showed it to you, skip it.
FAQ
How can I tell if a website is legit for free?
Paste the address into Google Safe Browsing’s site status page and Get Safe Online’s Check a Website, look up the domain’s creation date on ICANN Lookup, and search the store name with “scam” or “complaint”. All of these are free.
Does https mean a website is safe?
No. Https only means the connection is encrypted. The FTC notes that scammers can encrypt their sites too, so the padlock says nothing about whether the seller is honest.
Is a new website always a scam?
No, every real store was new once. But a domain registered in the last few weeks, combined with huge discounts on big brands and no findable reviews, is a strong warning sign.
What is the safest way to pay on an unfamiliar website?
A credit card. In the US, the Fair Credit Billing Act lets you dispute charges for items not delivered as agreed if you write within 60 days of the first bill. In the UK, Section 75 covers credit card purchases of single items over £100 and up to £30,000.
How do I report a fake website?
In the US, report it at ReportFraud.ftc.gov. In the UK, report the website to the NCSC, and if you lost money, report it to Report Fraud (England, Wales and Northern Ireland) or Police Scotland on 101.
Can I get my money back from a scam website?
Often, if you paid by credit card and act quickly. Debit card chargebacks and PayPal disputes may also work. Bank transfers, gift cards and crypto are much harder to recover, which is why scammers ask for them.
Sources: FTC: Online Shopping; FTC: billing errors and the Fair Credit Billing Act; FTC: Using Credit Cards and Disputing Charges; NCSC: Report a scam website; Report Fraud launch notice; Get Safe Online: Check a Website; Google Safe Browsing site status; MoneyHelper: Section 75 and chargeback; Citizens Advice: card and PayPal refunds; FCA refunds guidance; ICANN Lookup. All checked November 3, 2026.
