You can tell if a website is legit in about five minutes: look up when its domain was registered, confirm it has real contact details, read reviews about it on other sites, and check which payment methods it accepts. A store that is only weeks old, hides who runs it, has no independent reviews and pushes you toward gift cards, wire transfers, payment apps or crypto should not get your money.
None of these checks is proof on its own. Together they catch most copycat shops, and if one slips through, paying by credit card leaves you a legal route to get your money back. Below is the exact routine, a worked example, and what to do if you already paid.
Key takeaways
- Check the domain's creation date with ICANN Lookup. A shop registered last month that claims years in business is a major red flag.
- The padlock only means the connection is encrypted. The FBI warns not to trust a site because it shows a lock or "https".
- Search the store name plus "scam", "complaint" or "review" on other sites, not the store's own review widget.
- Pay by credit card. US law gives you 60 days from the statement to dispute a charge for goods that were never delivered.
- Already paid? Contact your card issuer first, then report to ReportFraud.ftc.gov and the FBI's IC3.
Why fake online stores are worth five minutes of your time
The FBI's Internet Crime Complaint Center (IC3) tracks a category called non-payment/non-delivery: you pay and the goods never arrive, arrive as something else, or a buyer never pays a seller. It is the closest public measure of online shopping fraud in the US. Reported losses in that category went from about $197 million in 2019 to a peak of about $785 million in 2024, then $503 million in 2025, across 56,478 complaints, according to IC3's annual reports.
Those are only the cases people reported to the FBI, so the real figure is higher. The pattern is familiar from FTC and CISA holiday warnings: an ad on social media, a price far below what everyone else charges, a polished site, and a checkout that takes your money and delivers nothing, or a cheap knockoff.
How to tell if a website is legit: the five-minute check
Run these steps before you enter any card details on a shop you have never used. Do them in order; the first two catch the most fakes.
- Look at the address bar, not the logo. Read the full domain. Copycat stores often add words like "outlet", "sale" or "official" to a real brand name, or use a different ending such as .shop or .store instead of the brand's usual .com. If you reached the site from an ad or text, close it and type the brand's address yourself.
- Check the domain's age. Go to lookup.icann.org, type the domain (for example storename.com) and look for the "Created" or "Registration" date. Since January 28, 2025, ICANN Lookup pulls this from RDAP, the system that replaced WHOIS for generic domains. Owner names are often hidden for privacy, which is normal; a creation date a few weeks old on a store that says it has served customers since 2012 is not.
- Run a reputation check. Paste the domain into Google's Safe Browsing site status tool at transparencyreport.google.com/safe-browsing/search, then search the store name plus "scam", "complaint" and "review", as the FTC suggests. Also search BBB Scam Tracker for the business or website name.
- Verify the contact details. Look for a street address, a phone number and a business name on the Contact or About page. Put the address into a map: a residential apartment, an empty lot or a different country than the site implies is a warning. A store with only a web form or a free email address gives you nowhere to go when an order goes wrong.
- Read the policies. The FTC advises checking the total price, fees, refund policy, who pays return shipping and any restocking fee. Vague, copied or missing policies, or returns that must be shipped overseas at your cost, are common on fake shops.
- Look at the payment page before you type anything. Credit card or a well-known checkout service is a good sign. A store that steers you to gift cards, wire transfers, payment apps or crypto, or offers a big discount for paying that way, is one the FTC says to avoid.
- Decide. If two or more checks fail, walk away. If you still want the product, buy it from the brand's own site or a retailer you already know.
Domain registration data is a privacy topic of its own; our explainer on WHOIS redaction under GDPR covers why owner details are hidden and what is still visible.
Legit-store checklist: green flags and red flags
| Signal | How to check | Red flag | Green flag |
|---|---|---|---|
| Domain | Read the full address bar | Brand name plus "outlet", "sale" or an odd ending; misspellings | The brand's known domain, typed by you |
| Domain age | ICANN Lookup (RDAP) creation date | Weeks or a few months old | Several years, consistent with the store's story |
| Reputation | Safe Browsing status; search name + "scam" or "complaint"; BBB Scam Tracker | Warnings, complaints about non-delivery, or no trace at all | Long history of independent reviews, including how problems were handled |
| Contact details | Contact/About page; map the address; call the number | Web form only, free email address, address that doesn't match | Real business name, address and a phone that is answered |
| Prices | Compare with two or three known retailers | Big-ticket items at a fraction of the usual price; countdown timers | Sale prices in line with other stores |
| Payment | Look at checkout options before entering data | Gift cards, wire transfer, payment apps, crypto only | Credit card and established checkout services |
| Policies | Read refund, shipping and returns pages | Missing, vague or copied text; overseas returns at your cost | Clear, specific terms with a named company |
| Padlock / https | Click the icon next to the address | Treated as proof of legitimacy | Expected, but only shows the connection is encrypted |
Based on FTC, CISA and FBI IC3 consumer guidance (accessed October 2026). No single signal is proof; look for patterns.
Worked example: what a copycat store looks like
Here is an illustrative composite of a common pattern, not a specific site. You see a social media ad for a well-known outdoor brand's winter jacket at 70 percent off. The link opens a store whose name combines the brand with "outlet" and ends in .shop. The design looks right because the photos and descriptions are copied from the real brand.
Now run the check. ICANN Lookup shows the domain was created five weeks ago, while the About page says the store has been in business for a decade. A search for the store name plus "scam" turns up several recent complaints about orders that never shipped, and the site has no presence on independent review sites. The Contact page has a form and a free email address but no phone number. The returns policy says items must be mailed to an overseas address at your expense. At checkout, card payment "fails," and the page offers an extra discount if you pay by a payment app instead.
That is at least five red flags. The sensible move is to close the tab, go to the brand's own site by typing its address, and see whether the sale exists there. Usually it does not.
Is a site safe just because it has a padlock?
No. The padlock and "https" mean the connection between your browser and the site is encrypted, so others on the network cannot read what you send. They say nothing about who runs the site or whether it will ship your order. Certificates are cheap or free and easy for anyone to get, and in a 2019 public service announcement the FBI told people plainly not to trust a website just because it shows a lock icon or "https".
Google Chrome stopped showing the lock icon in its address bar in 2023, replacing it with a neutral "tune" icon, partly because so many people misread the lock as a sign a site was trustworthy. Whatever browser you use, treat encryption as the minimum, not a seal of approval. For the rest of your browser setup, see our complete guide to cleaner, safer devices.
Which payment methods protect you best?
A credit card is the strongest everyday option in the US. Under the Fair Credit Billing Act, charges for goods that were not delivered as agreed count as billing errors, and you can dispute them in writing within 60 days of the date the first statement showing the charge was sent to you, according to the FTC. Send the dispute to the issuer's billing-disputes address, not the payment address. Most issuers also let you start a dispute online or by phone; follow up in writing to keep your legal rights.
Debit cards are weaker. The FTC notes you may not get a refund from your bank for non-delivery or for receiving the wrong item, although some banks voluntarily offer more protection. Gift cards, wire transfers, payment apps and crypto are the hardest to reverse, which is why scammers ask for them. Some card issuers offer virtual card numbers you can lock to a single merchant, which limits the damage if a shop turns out to be fake.
What to do if you already paid a fake store
- Call your card issuer or bank now. Explain that you paid a site that appears to be fraudulent, ask them to dispute the charge, and ask whether the card should be replaced. Follow up in writing within the 60-day window for credit cards.
- If you paid by payment app, wire or gift card, contact that company immediately and ask whether the payment can be stopped or reversed. Speed matters most here.
- Save the evidence: the order confirmation, emails, the site address, screenshots of the product page and policies, and the ad that brought you there.
- Report it. In the US, report to the FTC at ReportFraud.ftc.gov and the FBI at ic3.gov. You can also add it to BBB Scam Tracker to warn others. In Canada, report to the Canadian Anti-Fraud Centre. In England, Wales and Northern Ireland, Report Fraud replaced Action Fraud in December 2025; in Scotland, contact Police Scotland on 101.
- Secure your accounts. If you created an account on the store with a password you use elsewhere, change it everywhere. Our guide to passwords, 2FA and passkeys walks through it. Watch your statements for new charges for the next few months.
- Expect follow-up scams. Fake "refund" or "recovery" offers often target people who just lost money. A legitimate bank or agency will not ask you to pay a fee to get your money back.
When this check isn't enough: limits and trade-offs
- Real stores can fail a check. A new small business has a young domain by definition, and many legitimate sellers hide owner details for privacy. Weigh signals together, and for a new shop, a phone call or a small first order is reasonable.
- Fake stores can pass some checks. Scammers buy aged domains, copy real addresses and seed fake reviews. Off-site complaints and payment options are harder to fake than looks, which is why they carry more weight here.
- Marketplaces are a different problem. On a big marketplace the domain is legitimate, but the individual seller may not be. Check the seller's rating and history, keep payment and messages inside the platform, and use its purchase protection.
- Tools can be wrong. Safe Browsing and similar lists catch known bad sites; a store that launched yesterday may not be listed yet. A clean result is not a green light.
- Outside the US the rules differ. Card dispute rights and deadlines in Canada, the UK and the EU are set by local law and your card network, so ask your issuer what applies.
Frequently asked questions
How can you tell if a website is a scam?
Look for a combination of warning signs: a very new domain, prices far below other retailers, no real contact details, complaints or no trace on other sites, and requests to pay by gift card, wire transfer, payment app or crypto. If two or more show up, do not buy. When in doubt, go to the brand's own site by typing its address.
What should you do if you bought from a fake website?
Contact your card issuer or payment provider right away to dispute the charge and, if needed, replace the card. Save your order details and screenshots, then report the site to ReportFraud.ftc.gov and ic3.gov. Change any password you reused on the store.
Is a site safe just because it has a padlock?
No. The padlock means the connection is encrypted, not that the business is real or honest. The FBI specifically warns against trusting a site because it shows a lock or "https".
How do you check how old a website is?
Enter the domain at ICANN Lookup (lookup.icann.org) and look for the creation or registration date. Owner names are often redacted for privacy, but the creation date is usually shown.
Are deals in social media ads safe to click?
Treat them with extra caution. The FTC warns that ads for pricey items at bargain prices can lead to fake sites. Instead of clicking, search for the product on the brand's official site or a retailer you already use.
Sources
- FBI IC3: 2025 Internet Crime Report (accessed October 2026)
- FBI IC3: 2024 Internet Crime Report (accessed October 2026)
- FBI IC3: 2021 Internet Crime Report (2019–2021 figures) (accessed October 2026)
- FBI IC3: Cyber Actors Exploit "Secure" Websites in Phishing Campaigns (PSA, June 2019) (accessed October 2026)
- FTC: Don't let scammers get in the way of your holiday shopping (accessed October 2026)
- FTC: What to do if you're billed for things you never got (accessed October 2026)
- CISA: Shop Safely Online This Holiday Season with Tips from Secure Our World (accessed October 2026)
- ICANN: Launching RDAP; Sunsetting WHOIS (accessed October 2026)
- Chromium Blog: An Update on the Lock Icon (accessed October 2026)
- Google Transparency Report: Safe Browsing site status (accessed October 2026)
- Better Business Bureau: Scam Tracker (accessed October 2026)
- City of London Police: Report Fraud service goes live (accessed October 2026)
Top image: "Bank card on laptop closeup" by Shixart1985, CC BY 2.0, via Wikimedia Commons (resized). Charts and tables by Thank You Robot.
0 Comments