Online Shopping Safety: How to Check If a Website Is Legitimate

The Internet Has a Counterfeit Problem

You're scrolling Facebook and see an ad for a beautiful garden tool set at 70% off. You search for a specific brand of walking shoes and find a website selling them for half what Amazon charges. An email arrives with an incredible deal on the exact coffee maker your daughter mentioned wanting for Christmas.

These deals are tempting because they're designed to be. Scam websites — sometimes called fake storefronts or phishing sites (pronounced "fishing," because they're casting a line and hoping you'll bite) — are built to look identical to legitimate online stores. They use the same product photos, the same logos, even convincing customer reviews. The only difference is that when you enter your credit card number, you're not buying a product. You're handing your financial information directly to a criminal.

The good news is that fake stores almost always leave clues. Once you know what to look for, you can spot them in half a minute.

Check 1: The Web Address (URL)

The URL (short for Uniform Resource Locator) is the web address that appears in the long white bar at the top of your browser. It's the internet equivalent of a street address — it tells your computer exactly where to go. Scammers create URLs that look right at a glance but aren't. Here's how to read one critically:

Look at the end of the main part. The main part of a web address is everything between the "https://" and the first single slash. For example, in https://www.amazon.com/deals, the main part is amazon.com. A legitimate business uses its actual name followed by .com, .org, .net, or a country code like .ca (Canada) or .co.uk (United Kingdom). Scammers add extra words or use misspellings:

• Real: nike.com
• Fake: nike-outlet-store.com, nike-deals2026.com, nikeshoes.shop
• Real: wayfair.com
• Fake: wayfairclearance.com, wayfair-discounts.shop

The key insight: anything added BEFORE the brand name but AFTER the www. is still controlled by whoever owns the main address. So deals.nike.com is real (it's a sub-section of nike.com), but nike.deals-shop.com is fake (the real address is deals-shop.com, and they just put "nike" in front).

Watch for odd endings. Most real stores end in .com or .org. Scammers often use cheap or unusual endings like .shop, .store, .biz, .top, .xyz, .online, or .club. While some legitimate small businesses do use these endings, they're a yellow flag that warrants extra caution.

Check for misspellings and substitutions. A zero instead of the letter O (amaz0n.com), a lowercase L that looks like a 1, an extra letter (walmartt.com), or a missing letter (bestbuy.com missing the second 'y' — actually, that one is real; the point is to look carefully).

Check 2: The Padlock and HTTPS

Look at the far left of the address bar. Do you see a small padlock icon? Does the address start with https:// rather than http://?

The "s" in "https" stands for "secure." It means that any information you type into that website — your name, your address, your credit card number — is encrypted (scrambled into unreadable code) while it travels from your computer to the store's server. Someone intercepting that information in transit would see only gibberish.

This is essential for any website that asks for payment information. If a store's address starts with http:// (no "s"), or if your browser shows a warning that "Your connection is not private," do not enter any personal information — period.

However — and this is crucial — the padlock only tells you that your connection is private. It does NOT tell you that the store is honest. Scammers can get padlocks too. They're free and automatic with many website-building services. A padlock means your data is safe from eavesdroppers, not that the person receiving it is trustworthy. Think of it like a sealed envelope: it keeps the postman from reading your letter, but it doesn't stop the recipient from being a con artist.

Check 3: Search the Store's Reputation

Open a new browser tab and go to Google (or whatever search engine you use). Type the store's name followed by the word "scam" or "review" or "complaints." For example: "GardenGlowTools scam" or "PremierFootwear reviews."

Look at the results. If you find:

• Multiple people reporting they never received their items
• Complaints about unauthorized charges
• The Better Business Bureau showing a pattern of complaints
• Reddit threads or forum posts warning about the store
• No results at all (meaning the store has no history, no reputation, no reviews anywhere)

...then do not shop there.

Be aware that scammers sometimes post fake positive reviews. If every review on Trustpilot or SiteJabber is five stars, uses similar language, and was posted around the same time, those reviews may have been purchased or written by the scammers themselves. Real stores almost always have a mix of positive and negative reviews. Perfection is suspicious.

Check 4: The Contact and About Pages

A legitimate business wants you to be able to reach them. Scroll to the bottom of the website and look for links labeled "Contact Us," "About Us," or "Customer Service."

A real store shows:

• A physical street address (not a P.O. box, though some legitimate small businesses do use P.O. boxes)
• A phone number you can call during business hours
• An email address at the company's domain (e.g., support@realstore.com, not realstoresupport@gmail.com)
• A return policy that tells you how to send items back
• A privacy policy that explains how your data is used (though most people never read these, their presence is a good sign)

A fake store often shows:

• No physical address at all, or an address that turns out to be a random house or empty lot when you look it up on Google Maps
• No phone number, or a number that goes to a generic voicemail
• A contact form with no other way to reach the company
• No return policy, or one filled with misspellings and vague language
• An "About Us" page with stock photos and marketing buzzwords but no real history or names

Take 30 seconds to test the phone number. If someone answers with "Hello?" rather than the business name, or if the number is disconnected, that's a red flag. A real business answers the phone with the company name.

Check 5: The Prices

Here's a rule that will serve you well for the rest of your life: if a price is dramatically lower than every other store selling the same item, the website is almost certainly a scam.

Scammers bait their traps with impossibly low prices because they know bargain-hunting overrides caution. A $400 coffee maker listed for $89. A $1,200 smartphone for $299. Designer handbags for $40. These deals don't exist in legitimate retail. The products either don't exist at all, or they're counterfeit (fake copies made to look like the real thing).

Before you buy, open a second tab and search for the same product on Amazon, Walmart, Target, or the manufacturer's own website. If the price on the unfamiliar site is more than about 30% lower than everywhere else, something is wrong.

One exception: legitimate stores do run genuine sales, and clearance items can be deeply discounted. The difference is that those sales happen on websites you already know and trust — not on a store that appeared in a Facebook ad yesterday with a name you've never heard.

Check 6: How You Found the Site

Ask yourself: how did I get here? The answer matters.

You searched for it on Google. This is generally safe, though scammers can buy ads that appear at the top of search results. Look for the small "Sponsored" or "Ad" label next to search results, and consider scrolling past ads to the regular (organic) results below.

You clicked a link in an email. Be very cautious. Scammers send emails that look exactly like real order confirmations, shipping notifications, and special offers. If you didn't expect the email, don't click the links. Instead, open your browser and go directly to the store's website by typing the address yourself.

You saw it in a social media ad (Facebook, Instagram, TikTok). This is the highest-risk category. Scammers pour money into social media ads because they're cheap and effective. The ad shows a compelling product at an irresistible price, and the website looks polished and professional. Many people have been burned this way. If the store is unfamiliar, do all the other checks before buying.

A friend recommended it. This is generally safe, but confirm that the recommendation actually came from your friend. Scammers sometimes hack social media accounts and send messages to the victim's friends promoting fake stores.

Putting It All Together: The 30-Second Scan

When you're on an unfamiliar store, run through this checklist mentally:

1. Address bar: Does the URL look right? No misspellings, no weird endings?
2. Padlock: Is the padlock present, and does the address start with "https"?
3. Search: Have you Googled the store name plus "scam"?
4. Contact: Is there a real address and phone number?
5. Price: Is the price plausible compared to other stores?
6. Source: How did you find this store — search, email, or social media ad?

If a store passes all six checks, it's probably safe. If it fails even one, think twice. If it fails two or more, close the tab and shop somewhere else.

What to Do If You've Already Ordered from a Suspicious Site

Don't panic, but act quickly:

1. Contact your credit card company or bank immediately. Tell them you believe you made a purchase from a fraudulent website. They can freeze your card, reverse the charge (called a chargeback), and issue you a new card number. Credit cards have stronger fraud protection than debit cards, which is one reason to use a credit card for online shopping.

2. Monitor your account. Check your credit card or bank statement regularly for the next few months. Look for small, unfamiliar charges — scammers often test a stolen card with a tiny purchase (sometimes just a dollar or two) before making larger ones.

3. Change your password on that site. If you created an account with a password, and you use that same password on any other websites, change those passwords too. Use unique passwords for every important account. (A password manager — a secure app that remembers passwords for you — makes this manageable. It's covered in another article on this site.)

4. Report it. File a complaint with the Federal Trade Commission at ReportFraud.ftc.gov. Also report the scam to the Better Business Bureau's Scam Tracker at BBB.org/ScamTracker. These reports help authorities shut down fake stores and warn other consumers.

A Final Word of Encouragement

Scam websites are designed to look trustworthy, and falling for one does not mean you're careless or gullible. These sites are built by professionals who understand exactly how to exploit human psychology — our desire for a good deal, our trust in familiar-looking logos, our tendency to skim rather than scrutinize.

The six checks above are your armor. They take 30 seconds and cost nothing. Make them a habit, the same way you look both ways before crossing a street. Over time, you'll find that your scam-spotting instincts sharpen, and you'll browse with greater confidence because you know exactly what to look for.

The internet is full of wonderful, legitimate businesses run by honest people. Don't let the existence of scammers scare you away from the convenience and selection that online shopping offers. Just shop with your eyes open.