How to Tell If a Website Is Fake Before Entering Your Card Details

A convincing fake shop can have professional product photographs, a working checkout, five-star reviews, and an HTTPS address. None of those features proves that the seller is genuine. The safer approach is to verify who operates the site, where your payment goes, and what independent evidence exists before entering card details.

This guide provides a repeatable ten-minute verification process, realistic URL examples, and separate actions for people who only visited a suspicious page versus those who submitted payment information. Examples below are fictional and are not claims about real merchants.

The ten-minute fake website check: follow the evidence, not the design

1. Start with the exact domain

Read the hostname in your browser address bar, not the logo on the page. In https://shop.example.com/checkout, the hostname is shop.example.com; in https://example.com.shop-offers.test/checkout, it is example.com.shop-offers.test. The familiar brand words at the beginning of the second address do not make it the brand’s domain. The .test examples are reserved demonstration names.

2. Reach the business independently

Instead of following a sponsored ad, SMS, or social-media link, type the known retailer address yourself or find the company’s official website through an independent source. If a promotion appears only on a separate unfamiliar domain, ask the retailer through its verified contact channel.

3. Check the seller’s identity

Look for a real business name, usable customer-service contact, delivery region, and consistent return terms. A street address, phone number, or registration number can be copied, so cross-check it with independent records rather than accepting it at face value.

4. Search for external complaints

Search the seller name and exact domain together with “scam”, “complaint”, “refund”, and “reviews”. Compare multiple independent sources, dates, and the substance of complaints. An absence of complaints is not proof of safety, especially for new domains.

5. Compare the offer

Check the same model or SKU on established retailers. A dramatically lower price, forced countdown, or claim that stock will disappear within minutes warrants extra verification. A discount alone does not prove fraud.

6. Read the payment and refund conditions

Before checkout, confirm the final price, delivery date, returns window, refund process, and who handles disputes. Be especially cautious if a seller demands gift cards, wire transfers, cryptocurrency, or off-platform payment.

7. Check the checkout destination

A checkout that suddenly redirects to an unrelated hostname is a reason to stop and verify. Legitimate processors sometimes use a different domain, so independently confirm the processor or ask the merchant rather than assuming every redirect is fraudulent.

8. Decide based on combined evidence

One red flag can have an innocent explanation. Multiple inconsistencies—brand impersonation, unverified identity, implausible discounts, and irreversible payment requests—are a strong reason not to purchase.

What HTTPS, the padlock, and security scanners actually tell you

HTTPS encrypts the connection between your browser and the site, but does not verify that the seller will ship an order or refund your money. The US Federal Trade Commission and FBI both warn that fraudulent sites can use HTTPS. A padlock is not a trust badge. FTC online shopping guidance; FBI HTTPS phishing warning.

Browser warnings and reputation services can be useful signals. A clean result is not a guarantee: recently created malicious pages may not have been classified yet. Never enter payment details just to “test” a questionable checkout.

Compare these signs before deciding

Three realistic scenarios

Scenario A: the social-media flash sale

A promoted ad offers premium headphones at 80% off and links to an unfamiliar shop. The page looks polished and has a countdown. Check the exact hostname, independently find the manufacturer’s authorized retailers, and compare the full product model. If the only payment option is a bank transfer, stop. The point is not that all sponsored promotions are fake; it is that ads are not independent proof of legitimacy.

Scenario B: the lookalike delivery payment page

A text claims a parcel cannot be delivered until a small redelivery fee is paid. The linked page copies a courier logo. Do not use the message link. Open the courier’s app or independently typed website and enter the tracking number there. A tiny charge may be an attempt to capture reusable card information.

Scenario C: a new but legitimate small business

A new independent shop has few reviews and a recently registered domain. That alone does not make it a scam. Check whether the business identity and contact methods can be verified, ask a specific product question, review the refund policy, and choose a payment method with dispute protections. If the evidence remains thin, postpone the purchase.

If you already entered card details: what to do now

• Only opened the page: close it; do not download files or grant notifications. Update your browser if prompted by its normal update mechanism, not by the site.
• Entered a password: change it using the legitimate website or app, change reused passwords, enable multi-factor authentication, and inspect account activity.
• Entered card details: contact the card issuer immediately through the number on your card or official banking app; explain that the card data may have been exposed, and ask about blocking or replacing it and monitoring transactions.
• Paid the seller: preserve the URL, order confirmation, messages, screenshots, and transaction details; contact the bank or payment provider promptly about available dispute options.
• Installed a file: disconnect if you suspect active compromise, run reputable security checks, and seek qualified assistance if unusual behavior continues.

Where to report a suspected scam

In the United States, use ReportFraud.ftc.gov for consumer fraud and FBI IC3 for internet crime. In the UK, consult Report Fraud and NCSC phishing guidance. If money is at risk, contact your bank first; reporting does not itself reverse a payment.

A decision rule you can actually use

Proceed only when you can independently establish the seller’s identity, verify that the domain belongs to that seller, understand delivery and refund terms, and use a payment method with meaningful recourse. If any of those checks fails, leave the page and buy through a verified channel. No checklist can guarantee safety, but this approach reduces dependence on superficial signs.

Primary sources and further reading

• US FTC: Online Shopping
• US FTC: Buying From an Online Marketplace
• FBI: Criminals exploit HTTPS websites
• UK NCSC: Phishing and scams