Is This Website a Scam? A Practical URL and Website Verification Checklist

Overview

A polished design does not establish that a website is legitimate. Scam sites can copy the branding, product images, support language, and checkout layouts of real companies. Conversely, a new or small business may have limited reviews without being fraudulent. The goal of a website fraud check is therefore not to find one perfect signal. It is to combine several observations and decide whether the risk is acceptable for the action you are considering.

Start with the exact URL, not a search result or a message preview. Check the spelling of the domain, the part immediately before the first single slash, and whether the address uses a misleading subdomain. For example, secure.example-login.com is controlled by example-login.com, not by a company whose name merely appears in the subdomain. Extra hyphens, unusual spellings, added words, and lookalike characters deserve closer review.

HTTPS is useful because it encrypts the connection, but it does not prove that the site is honest. A fraudulent site can also use HTTPS. Treat the padlock as a transport-security signal, not an identity or reputation guarantee. If the browser displays a certificate warning, a deceptive domain, or a browser safety alert, stop rather than overriding it.

For a broader link review before opening a page, see How to Check if a Link Is a Scam Before You Click. If you already entered information or downloaded something, use the response steps in What to Do After Clicking a Phishing Link.

Checklist by scenario

1. An online store or marketplace listing

1. Inspect the URL. Confirm that the domain matches the seller you intended to visit. Do not assume a familiar logo means the address is official.
2. Check the business identity. Look for a physical address, working contact method, return information, and terms that identify who operates the store. A contact form alone provides little verification.
3. Compare the offer elsewhere. An unusually low price, limited-time pressure, or every product being heavily discounted should increase caution. Search for the product and seller independently rather than relying only on testimonials displayed on the site.
4. Review payment options. Be cautious when a seller insists on irreversible payment, cryptocurrency, gift cards, wire transfers, or payment outside the platform. A familiar payment logo on a page does not guarantee that the transaction is protected; confirm where the payment is actually processed.
5. Test the checkout without submitting. Check whether the cart changes unexpectedly, the final total differs from the product page, or the form requests information unrelated to the purchase. Do not create an account with a password you use elsewhere.

For marketplace purchases, keep communication and payment within the platform where possible. A request to move to private messaging, use a different payment method, or pay a “verification” fee is a reason to pause.

2. A login, account recovery, or payment page

1. Do not use the link as your starting point. Open a new browser window or the official app and navigate to the service yourself. Use a saved bookmark only if you created it from a verified source.
2. Compare the domain character by character. Look for substituted letters, added terms, unfamiliar top-level domains, and domains that place the brand name before an unrelated ending.
3. Check the request. A page asking for a password, one-time code, recovery phrase, full card details, or identity document should be treated as high impact. Verify the request through a separate official channel before entering it.
4. Watch for urgency and unusual flow. Repeated redirects, pop-ups, forced downloads, or a demand to disable security controls are strong reasons to stop.

This scenario commonly overlaps with phishing, bank impersonation, fake customer support, and account takeover attempts. For claims that a bank account is under threat, use the verification process described in Bank Impersonation Scams rather than the contact details in the message.

3. A supplier, contractor, or business portal

1. Verify the organization independently. Use contact information from an established source, previous contract, or known business record. Do not rely solely on a new email signature or a link in an invoice.
2. Check domain continuity. A recently changed or lookalike domain may be legitimate, but it requires confirmation through a known contact. Domain age can provide context, not a verdict: an old domain may be compromised, and a new domain may belong to a genuine new business.
3. Separate approval from payment. Confirm bank-detail changes, invoices, and unusual requests through a second channel and with an authorized person. This is particularly important for business email compromise and fake invoices.

Use the Vendor Verification Checklist for a fuller supplier review and the Business Email Compromise and Fake Invoice Prevention Checklist for payment-change controls.

What to double-check

When a site remains uncertain, record the evidence instead of relying on intuition. Review these areas separately:

• Domain registration and age: A very recent registration can be a warning sign for a site making major claims, but age alone cannot establish legitimacy. Registration details may also be private or incomplete.
• Site content: Look for copied product descriptions, inconsistent company names, broken links, vague policies, spelling patterns, and references to another brand. Search a distinctive sentence in quotation marks to see whether it appears on unrelated sites.
• Independent reputation: Search for the domain name, company name, and complaints separately. Give more weight to specific, verifiable experiences than to a cluster of short, repetitive reviews. Be cautious of reviews that exist only on the site itself.
• Contact details: Test whether the email address uses the same domain and whether the phone number or address can be corroborated independently. A professional-looking address is not proof by itself.
• Technical behavior: Note redirects, unexpected downloads, browser warnings, excessive pop-ups, and forms that request more data than the task requires. Do not install a browser extension or application simply to complete an unfamiliar checkout.

A simple repeatable score can help prevent one reassuring detail from outweighing several concerns. Give each category zero points for a clear concern, one point when evidence is incomplete, and two points when it is independently consistent: URL identity, business identity, contact details, content quality, payment behavior, independent reputation, and technical behavior. A low or mixed result means do not submit sensitive information until you verify the business another way. This is a decision aid, not a guarantee or a substitute for a trusted security tool.

Common mistakes

• Assuming HTTPS means “safe.” Encryption protects the connection; it does not validate the operator or the offer.
• Trusting search position. Search visibility, advertisements, and familiar wording are not proof of ownership.
• Checking only one signal. A domain-age lookup, review site, scam website checker, or malware scan can miss a newly changed site or a compromised legitimate domain.
• Calling the number in the suspicious page. If the site claims to represent a bank, retailer, or platform, find the organization’s contact route independently.
• Reusing credentials to “test” the site. Never submit a familiar password to investigate a page. Use a password manager’s domain matching as an additional warning, not as your only check.
• Continuing because money or time is already invested. A deposit, verification fee, or shipping charge should not make you accept additional risk. Pause and reassess.

When to revisit

Website verification is not a one-time judgment. Recheck a site before a major purchase, a seasonal shopping period, a subscription renewal, a vendor onboarding cycle, or any workflow that has changed. Revisit it sooner if the domain redirects somewhere new, the checkout provider changes, contact details are updated, prices shift sharply, or a familiar company begins sending links from a different domain.

For teams, save the exact URL, review date, evidence checked, and decision. Repeat the review when a supplier changes payment details, when an employee receives a new login portal, or when a fraud alert concerns the brand or service. Avoid treating an old approval as permanent trust.

Before acting, apply this short stop rule: pause, copy the exact URL, verify the operator independently, confirm the payment or login path, and submit the minimum information necessary. If the site still cannot be verified, do not proceed. Close the page, report the suspicious link or listing through the relevant platform, and contact your payment provider or organization’s security team if information was exposed. For related warning signs, see Is This a Scam Website? A 12-Point Website Legitimacy Checklist.