Security tips / Scams & Fraud

How to Tell If a Website Is Fake or a Scam: 12 Warning Signs (2026)

PPosted by PeregrinoTech · October 23, 2026

Building a convincing fake website used to take skill. Now it takes a template, a stolen logo and about twenty dollars. Scam shops, fake bank login pages and “your package is waiting” sites appear by the thousand every day, and most look perfectly professional.

The good news is that the fakes almost always get the same details wrong. Here are twelve checks, in the order I run them, and then the tools that automate the work.

Before you start

The single most important habit: look at the address bar before you look at the page. Everything on the page can be copied from the real site. The address cannot.

1. The domain is slightly wrong

Read the address slowly. Scammers register names that look right at a glance: paypa1.com, amazon-support-center.com, microsoft.com.login-verify.net.

The rule: the real domain is the part just before the first single slash, reading from the right. In microsoft.com.login-verify.net, the site is login-verify.net. Microsoft has nothing to do with it.

2. The domain was registered last week

Established businesses have established domains. Look the domain up at lookup.icann.org or who.is and check the creation date. A “store” with 10,000 five-star reviews whose domain is three weeks old is a scam.

3. The padlock means nothing

A padlock in the address bar means the connection is encrypted. It does not mean the site is legitimate. Certificates are free and automated. Most scam sites have one. Treat the padlock as the minimum, not as proof.

4. Prices are too good

A new iPhone at 60% off, designer goods at a tenth of retail, “closing down sale, everything 90% off”. Real businesses cannot sell below cost. If the price would make no sense for a real shop, the shop is not real.

5. There is no real way to contact them

Look for a physical address, a phone number and a company registration number. Then test them: search the address on a map, call the number. A contact form and a Gmail address are not a business.

6. Payment options are odd

Legitimate shops take cards and usually PayPal, both of which let you dispute a charge. Scam sites push bank transfer, cryptocurrency, gift cards, or payment apps like Zelle and Venmo, because those cannot be reversed. If a card is “not accepted” today, walk away.

7. The pressure is on

“Only 2 left!”, a countdown timer, a pop-up saying 47 people are looking at this item. Urgency is a tool to stop you thinking. Real retailers use it too, but combined with any other sign on this list it is a red flag.

8. The writing is off

Mixed fonts, odd capitalization, phrases no native speaker would use, and product descriptions that are clearly machine-translated or copied from another site. Professional companies proofread.

9. The images belong to someone else

Right-click a product or team photo and choose Search image with Google (or use TinEye). If the “founder” is a stock photo and the products appear on twelve other sites, you have your answer.

10. The reviews are all perfect and all recent

Five stars across the board, posted within the same week, with generic text like “Great product, fast shipping!” Real reviews are messy. Check the company name on Trustpilot and the Better Business Bureau as well, not just the site’s own page.

11. The policy pages are missing or copied

Click Privacy Policy, Terms and Returns. Missing pages, pages that name a different company, or a returns policy that says “all sales final” are signs the site was built in an afternoon.

12. You got there from a message

How did you arrive? A link in a text message, an unexpected email, a social media ad, a pop-up? The most dangerous fake sites are the ones you are sent to. If a message about your bank, parcel or account asks you to log in, close it and type the real address yourself.

Tools that check for you

Tool	What it does
Google Safe Browsing	Tells you if Google has flagged the site for phishing or malware
VirusTotal	Scans a URL against 70+ security vendors
urlscan.io	Visits the site for you and shows a screenshot, so you never load it yourself
ScamAdviser	Trust score built from domain age, hosting, reviews and reports
lookup.icann.org	Domain registration date and registrar

Paste the address into two of these before you buy from an unfamiliar site. Thirty seconds.

If you already paid

1. Card or PayPal: contact them immediately and open a dispute. Say the word “fraud”.
2. Bank transfer: call your bank’s fraud line now. Reversal is sometimes possible if you are fast.
3. Gift cards or crypto: report it, but expect the money to be gone.
4. You typed a password on the site: change that password everywhere you used it, and turn on 2FA. See How to check if your password has leaked.
5. Report the site to Google Safe Browsing, your national fraud reporting service (in the US, ReportFraud.ftc.gov) and the registrar from the lookup above. It helps the next person.

Common mistakes

• Trusting the design. Design is copied. Addresses, domain age and payment methods are not.
• Trusting the ad platform. Scam ads run on Google, Facebook and Instagram every day. Being advertised is not being vetted.
• Checking only once. A site that was fine last year may have expired and been bought by someone else.
• Being embarrassed. Scam victims are not stupid. The sites are good. Report it and move on.

FAQ

What if the site has a padlock and a long history?

Then check the rest of the list. Established scam operations exist. Payment methods and contact details are the strongest signals.

Are .shop, .xyz or .top domains always scams?

No, but they are cheap and popular with scammers. A new domain on one of these with no contact details is a strong pattern.

Is a site safe because it appeared first in search results?

No. The top results are often paid ads, and scammers buy them.

Final thoughts

Scammers are counting on you being in a hurry. Two minutes of checking, in the order above, beats almost every fake site on the internet. Address bar first, domain age second, payment methods third. Make it a habit.

Useful resources

• FTC: How to recognize and avoid phishing scams
• Our guide: How to spot a phishing email
• Have I Been Pwned

Know the attack. Own the defense.

Tagged:PhishingScamsOnline shoppingOSINT