Start with the address bar
The first place to check is the web address itself — the line at the very top of your browser that starts with http:// or https://. A legitimate website almost always uses https://, which means the connection between your computer and the website is encrypted. If a site asks for your password, credit card, or personal information and the address starts with just http://, stop and leave.
Look at the domain name — the part after www. and before the first single slash. Scammers often use addresses that look almost like real companies. For example, a fake bank site might be amaz0n.com (with a zero instead of the letter O) or paypa1.com (with the number 1 instead of the letter L). Type the official name into a search engine first, then click the link from the search results rather than typing what you think the address might be.
Key Takeaways
- Real websites use https:// in the address bar, especially if they ask for passwords or payment information.
- Check the exact spelling of the domain name — scammers use lookalike addresses with numbers substituted for letters.
- Look for contact information, a physical address, and a privacy policy posted somewhere on the site.
- Search for the company name plus the word "scam" or "reviews" to see what other people have reported.
- Hover your mouse over links before clicking them to see where they actually lead.
Look for contact information and a privacy policy
Legitimate businesses post ways to reach them. Scroll to the very bottom of the website — most real sites have a footer with an email address, phone number, or a contact form. If there is nothing at the bottom and no "Contact Us" link anywhere on the page, that is a warning sign. A real company wants you to be able to reach them if something goes wrong.
Also look for a privacy policy — a document that explains what the site does with your information. You will usually find a link to it at the bottom of the page, sometimes labeled "Privacy" or "Terms of Service". If the site collects any information from you and has no privacy policy, do not enter your details there.
Search for the company name with "scam" or "reviews"
Open a new search and type the company or website name followed by the word "scam" or "reviews". If hundreds of people have reported problems, you will see it. Real companies have some complaints — that is normal — but scam sites often have patterns: people saying they never received what they paid for, or that their credit card was charged multiple times, or that customer service never responds.
Check the dates on those complaints. If they are all from five years ago and the company has since fixed the problem, that is different from complaints posted last week. Also look at whether the company responds to complaints. Legitimate businesses usually reply to negative reviews, even if just to explain their side.
Check what the site asks you for
Be suspicious of any site that asks for information it should not need. A clothing store does not need your Social Security number. A bank does not need you to confirm your password by email — real banks never ask you to send passwords through email or chat. If a site asks for information that seems odd for what it is supposed to do, leave and contact the real company directly using a phone number you find yourself.
Watch out for sites that ask you to pay upfront for something that should be free. Government services are free. Job listings that require you to pay a fee before you can explore are usually scams. If a site says you have won a prize but need to pay shipping or taxes first, that is a scam.
Hover over links to see where they go
Move your mouse over a link without clicking it. At the bottom left of your browser window, you will see the actual web address that link points to. If the link says "Click here to log in to your bank" but the address shown at the bottom is something like fakebank-login.com, do not click it. This trick catches many phishing scams — sites designed to look like real companies but actually steal your login information.
The same goes for email links. If you receive an email that looks like it is from your bank or a company you use, do not click any links in that email. Instead, go directly to the company's website by typing the address yourself or searching for it, then log in and check your account from there.
Look at the design and writing
Scam sites are often put together quickly and show it. Look for spelling mistakes, broken images, or buttons that do not work. Real companies hire people to check their websites before launch. That said, a polished design alone does not mean a site is real — scammers have gotten better at copying the look of legitimate sites.
Read the writing on the page. Does it sound like a real company, or does it use strange phrasing, odd capitalization, or grammar that seems off? Many scam sites are run from outside the country and translated poorly. If the site is supposed to be from a major company but the writing quality is noticeably bad, that is a red flag.
Use your browser's security tools
Most modern browsers — Chrome, Firefox, Safari, Edge — have built-in protection against known scam sites. If you land on a page that your browser thinks is dangerous, it will usually show you a warning page before the site loads. Do not ignore these warnings. They are not perfect, but they catch many known scams.
You can also check a website's reputation using free tools like Google Safe Browsing or Norton Safe Web. Type the web address into these tools and they will tell you if the site has been reported as dangerous. These are not foolproof, but they are a quick second opinion.
Frequently Asked Questions
Is http:// always unsafe and https:// always safe?
https:// means the connection is encrypted, but it does not mean the site is legitimate. A scammer can get an https certificate too. Use https as one check among several, not the only one. If a site has https but asks for your Social Security number to buy a shirt, that is still wrong.
What if a site looks exactly like a real company's website?
Check the address bar carefully for misspellings. Search for the company name plus "official website" to find the real one. Call the company directly using a phone number from your bill or a search result, and ask them for their correct web address. Never use a phone number from the suspicious website itself.
Can I trust a site just because it has good reviews?
Fake reviews exist. Look for reviews on independent sites like Trustpilot or Google Reviews rather than only reviews posted on the company's own website. Real companies have a mix of positive and negative reviews. If every single review is five stars, that is suspicious.
What should I do if I think I visited a scam site?
If you entered a password, change it when ready on the real website using a different device if possible. If you entered credit card information, contact your bank or credit card company right away. If you entered your Social Security number, you may want to place a fraud alert with the credit bureaus. Report the scam site to the Federal Trade Commission at reportfraud.ftc.gov.
Are smaller or newer websites automatically less trustworthy?
No. A small business or new website can be completely legitimate. Use the same checks: look for contact information, read reviews from independent sources, check the https connection, and see if the site asks for information it should not need. Size and age are not the deciding factors — behavior is.