What makes a website legitimate
A legitimate website is one run by the real organization it claims to be, not a fake copy designed to steal your information or money. You can check this in about two minutes by looking at three things: whether the site uses encryption (the padlock icon), who actually owns the domain name, and whether the organization's real website links to it.
Scammers copy the look of real websites so closely that many people cannot tell the difference at first glance. They use similar names, colors, and layouts. But they cannot easily copy the technical details that prove ownership, and those details are visible to anyone who knows where to look.
The good news is that you do not need technical knowledge to check these things. Your browser shows you most of what you need to see, and the rest takes a straightforward search.
Key Takeaways
- A padlock icon next to the web address means the connection is encrypted, but it does not mean the site is legitimate — scammers use encryption too.
- The domain name (the part after www.) is the single most reliable check: visit the real organization's official website and see if they link to the site you are visiting.
- Fake sites often use names that look almost identical to real ones, like adding extra letters or using a different ending (.net instead of .com).
- If you arrived at a site through a link in an email or text message, go directly to the organization's website instead and search for the service from there.
- A website can have a padlock, professional design, and customer reviews and still be a scam — these things alone do not prove legitimacy.
Check the padlock and web address
Open the website you want to check. Look at the very beginning of the web address in your browser's address bar — the line at the top where you type website names. You should see a small padlock icon to the left of the address. If the padlock is there and closed, the connection between your browser and the website is encrypted, meaning your information is scrambled so others cannot read it in transit.
However, the padlock only means the connection is find. It does not mean the website is run by who they claim to be. A scammer can buy encryption just like a real business can. So the padlock is necessary but not enough on its own.
Next, look at the actual web address itself. The domain name is the main part — for example, amazon.com or paypal.com. Scammers often use names that are almost identical to real ones. They might use amaz0n.com (with a zero instead of the letter O), or amazons.com (with an extra S), or amazon.net (with .net instead of .com). These look similar at a glance but are completely different websites.
Write down the exact domain name you see. You will need it for the next step.
Look up who owns the domain
Go to a domain lookup tool. WHOIS.com and ICANN Lookup are both free and show you who registered a domain name. Type the domain name you wrote down into the search box.
The results will show you the registrant — the person or organization who owns that domain. For legitimate business websites, this should be the company itself or a web hosting service they hired. For example, if you look up amazon.com, the registrant will be Amazon Technologies, Inc.
If the registrant is a private person's name, or a company you have never heard of, that does not automatically mean it is a scam — many small businesses and individuals run legitimate websites. But if you are checking a website that claims to be from a major bank, government agency, or well-known company, the registrant should be that organization.
If the registrant name does not match the organization the website claims to represent, do not enter any personal information on that site.
Cross-check with the official website
The most reliable way to verify a website is to visit the real organization's official site directly and see if they link to the site you are checking. Do not click a link from an email, text message, or search result. Instead, open a new browser tab and type the organization's main website address directly, or search for their name in a search engine.
Once you are on the official website, look for a list of partner sites, approved vendors, or affiliated services. Many banks, government agencies, and large companies maintain a page that lists all the legitimate websites they run or endorse. If the site you are checking appears there, it is legitimate.
If you cannot find any mention of the site on the official website, contact the organization directly by phone or through their official contact form. Ask them whether the website you are checking is run by them or approved by them. This takes a few minutes but removes all doubt.
Watch for common red flags
Certain warning signs suggest a website may not be legitimate. Poor spelling and grammar throughout the site is one — real organizations hire people to write their web content carefully. Awkward phrasing, especially in forms where you enter sensitive information, is a reason to stop and verify before proceeding.
Requests for information that seem unusual are another flag. A bank will never ask you to confirm your full password or PIN through a website form. A government agency will not ask you to pay a fee upfront through a wire transfer or gift card. If a site is asking for something that does not make sense, verify it is real before you comply.
Prices that seem too good to be true often are. If a site is offering a product or service for far less than everywhere else, check whether the site is legitimate before buying. Scammers sometimes lure people in with low prices and then either send nothing or steal payment information.
Be especially cautious with sites you reached through an unsolicited email or text message. Legitimate organizations rarely contact you first asking you to visit a website and enter information. If you receive such a message, go directly to the organization's official website instead of clicking the link in the message.
Understand what does not prove legitimacy
A professional-looking design does not prove a site is real. Scammers hire designers and can make fake sites look nearly identical to real ones. Customer reviews and testimonials do not prove legitimacy either — scammers post fake reviews or steal reviews from real sites.
A physical address listed on the site does not may provide it is real. Scammers sometimes list real addresses they found online, or addresses of businesses that have closed. A phone number that works does not prove legitimacy — scammers can buy phone numbers and set up voicemail.
Even a business license number or tax ID can be faked or stolen. The only reliable checks are the ones described above: the padlock (for security), the domain ownership (for who actually registered it), and cross-checking with the official website (for whether the real organization approves it).
What to do if you think a site is fake
If you believe you have found a scam website impersonating a real organization, report it. The real organization almost always has a way to report fraud or phishing attempts — look for a "Report Fraud" or "Report Phishing" link on their official website, or call their customer service number.
You can also report the site to the Federal Trade Commission at reportfraud.ftc.gov. Include the fake website's address, the organization it is impersonating, and any details about how you found it. The FTC uses these reports to track scam trends and sometimes takes action against the people running them.
If you already entered personal information on a fake site, contact the real organization when ready and let them know. They can monitor your account for suspicious activity and help you take steps to protect yourself.
Frequently Asked Questions
Is a website with a padlock always safe?
A padlock means the connection is encrypted, but it does not mean the website is legitimate or that the organization running it is trustworthy. Scammers can buy encryption just like real businesses do. Always verify the domain ownership and cross-check with the official website, even if you see a padlock.
What if the domain name is slightly different from the real one?
A slightly different domain name is a major red flag. Scammers deliberately use names that look similar at a glance — like adding a letter, using a zero instead of the letter O, or changing the ending from .com to .net. If the domain does not match exactly, verify it is legitimate before entering any information.
Can I trust a website if it has good reviews?
Reviews alone are not enough to verify a website is real. Scammers post fake reviews or steal them from legitimate sites. Always check the domain ownership and cross-reference with the official website, regardless of how many positive reviews you see.
What should I do if I already gave my information to a fake site?
Contact the real organization when ready and explain what happened. Tell them what information you shared and ask them to monitor your account. If you entered payment information, contact your bank or credit card company and ask them to watch for unauthorized charges. Consider placing a fraud alert with the credit bureaus.
How can I tell if an email asking me to visit a website is real?
Do not click links in emails, even if they look official. Instead, go directly to the organization's official website by typing the address yourself or searching for it. Call the organization's customer service number from their official website and ask whether they sent you that email. Real organizations expect you to verify this way.