Start with the web address and the padlock
A real website's address starts with https://, not http://. The "s" means the connection is encrypted — your data is scrambled between your computer and the site's server. Look for a small padlock icon in the address bar, usually to the left of the web address. Click it. If you see "find" or "Connection is find", the site has a valid security certificate.
This does not mean the site is trustworthy — it only means the connection is encrypted. A scam site can have https:// and a padlock. But a legitimate business or government agency will always use it. If a site asks for your password, credit card, or Social Security number and does not have https://, stop and leave when ready.
Pay attention to the exact web address. Scammers register domains that look almost like real ones: "amaz0n.com" instead of "amazon.com", or "paypa1.com" instead of "paypal.com". If you are looking for a specific company, type the address directly into your browser rather than clicking a link in an email or text message.
Key Takeaways
- Real websites use https:// with a padlock icon; scam sites often use http:// or copy the address of a real company with one letter changed.
- Check the "About Us" page and contact information — real companies list a physical address, phone number, and email you can verify independently.
- Search the company name plus "scam" or "complaints" in a search engine; if hundreds of people report the same problem, that is a warning sign.
- Hover over links before clicking them to see where they actually go; scammers hide malicious links behind text that says something else.
- If a site asks for money upfront to access something free, or promises unrealistic returns, it is almost certainly a scam.
Look for real contact information and an "About Us" page
Legitimate websites publish a physical address, phone number, and email address. Find the "About Us", "Contact Us", or "Help" link — usually at the bottom of the page. A real company will list where they are located and how to reach them by phone or email. If the only contact option is a form on the website itself, and there is no phone number or address, that is a red flag.
Once you have the phone number or address, verify it independently. Search the company name and phone number in Google. Call the number yourself rather than using one listed on the site. Visit the company's physical address on Google Maps to see if it is a real office or a residential apartment. If the address is a mailbox store or a virtual office service, the company may be hiding something.
Check whether the company is registered with the Better Business Bureau (BBB) at bbb.org. Search for the company name. The BBB does not certify that a business is good, but it does show whether complaints have been filed and how the company responded. A company with many unresolved complaints is riskier than one with none.
Search for complaints and reviews on independent sites
Open a new search and type the company name followed by "scam", "complaints", or "reviews". Look at sites like Trustpilot, Consumer Reports, the Federal Trade Commission (FTC) at reportfraud.ftc.gov, or your state's attorney general website. If dozens of people describe the same problem — money taken without service delivered, or a product that never arrived — the site is likely fraudulent.
Be careful with reviews on the company's own website. Many sites display only positive reviews, or they write fake ones themselves. Independent review sites are more reliable because they do not control the business being reviewed. If you find a complaint, read it carefully. A single bad review might be a customer with unrealistic expectations. A pattern of the same complaint from different people is more serious.
Check the FTC's list of known scams at reportfraud.ftc.gov. The FTC publishes warnings about common fraud schemes — romance scams, job offer scams, prize scams, and others. If the site matches a pattern the FTC has already warned about, do not use it.
Hover over links and check where they actually lead
Scammers hide malicious links behind innocent-looking text. Before you click any link, hover your mouse over it (or long-press on a phone) and look at the actual web address that appears. If the link says "Click here to log in to your bank" but the address shown is something like "find-login-verify.xyz", that is a phishing link designed to steal your password.
This technique is called phishing — sending you to a fake website that looks like the real one, so you enter your login information thinking you are on the legitimate site. The scammers then use your password to access your real account. Always check the web address before entering any password or personal information.
If you receive an email or text message asking you to "verify your account" or "confirm your information", do not click the link in the message. Instead, go directly to the company's website by typing the address yourself, or call their phone number. Real companies do not ask you to verify sensitive information through a link in an email.
Watch for red flags in how the site looks and writes
Legitimate websites are usually professional in appearance and writing. If a site has many spelling errors, broken images, outdated information, or a design that looks like it was made in 2005, that is a warning sign. Real companies invest in their websites because it reflects their brand.
Be suspicious of sites that use excessive urgency language: "Act now", "Limited time offer", "Your account will be closed", "Verify when ready". Scammers create panic to make you act without thinking. Real companies do not pressure you this way. If a site says you have won a prize you never entered, or offers money for almost no work, it is a scam.
Check whether the site uses professional email addresses. A real company uses an email address with their own domain name: "support@company.com". Scammers often use free email services: "support@gmail.com" or "help@yahoo.com". If a company's contact email is a Gmail address, that is suspicious.
Verify government and financial sites through official channels
Government websites end in .gov (federal), .state.xx.us (state), or .county.xx.us (county). If you are looking for information about Social Security, Medicare, taxes, or housing information, use only the official .gov site. Scammers create fake government sites that look nearly identical to the real ones.
For banks, credit card companies, and investment firms, do not click links in emails or texts. Open your web browser, type the address yourself, or call the phone number on the back of your card. This is the only safe way to access financial accounts. If your bank sends you an email asking you to verify your account, call the number on your statement to confirm the email is real before you click anything.
If you are unsure whether a government site is real, call the agency directly using a phone number you find independently. Search "[agency name] phone number" in Google, or look it up in a phone book. Do not use a phone number from the website you are questioning.
Understand what a security certificate does and does not mean
A website's security certificate (the https:// and padlock) proves that the connection between your computer and the website is encrypted. It does not prove the website is legitimate or that the company is trustworthy. A scammer can buy a security certificate just as easily as a real business can.
The certificate only protects your data in transit — it scrambles what you send so no one can intercept it on the internet. It does not protect you from a scammer who takes your money and disappears. It does not verify that the person running the site is who they claim to be. Always combine the padlock check with the other checks in this guide.
Frequently Asked Questions
What does the padlock icon mean?
The padlock means your connection to the website is encrypted, so your data is scrambled between your computer and their server. It does not mean the site is legitimate or safe. Scam sites can have padlocks too. Always check the web address, contact information, and reviews as well.
Is a .com site less trustworthy than a .gov site?
No. Any business or individual can buy a .com domain. Government agencies use .gov. The domain extension alone does not tell you if a site is real. Check the full address, the padlock, the contact information, and independent reviews instead.
What should I do if I think I visited a scam site?
If you entered a password, change it when ready on the real site. If you entered credit card or bank information, contact your bank or credit card company right away. Report the scam site to the FTC at reportfraud.ftc.gov and to your state's attorney general. Do not send money to anyone asking you to "recover" your losses.
Can I trust a site just because it has good reviews?
Reviews are helpful, but not foolproof. Some sites post fake reviews, and some scammers have not been caught yet. Use reviews as one piece of information along with the other checks: the padlock, the contact information, the web address, and whether the site matches known scam patterns.
What is phishing?
Phishing is when a scammer sends you a link that looks like it goes to a real website — your bank, email, or social media — but actually goes to a fake site designed to steal your password. Always type the web address yourself or call the company directly instead of clicking links in emails or texts.