How to check if a website is a scam: a 10-point checklist.
Fake websites are the front door of most online fraud: fake shops, fake bank login pages, fake crypto exchanges, fake parcel-tracking pages. The good news is that almost all of them fail the same simple checks. Run through this list before you type a password or a card number anywhere you do not already know and trust.
1. Read the address bar, slowly
Scam domains imitate real ones with tiny changes: a swapped letter, an extra word, a different ending. Read the domain right to left. The part that matters is the last two segments before the first slash. In paypal.com.secure-login.example, the site is secure-login.example, not PayPal. If the brand name is anywhere except those final segments, treat it as fake.
2. Do not trust the padlock
The padlock icon only means the connection is encrypted. It says nothing about who is on the other end. Most phishing sites today have a valid padlock. Its absence is a red flag; its presence proves nothing.
3. Check how old the domain is
Real shops and banks have history. Scam sites are typically days or weeks old, because they get taken down and respawned. A public WHOIS lookup shows the registration date. A site claiming years of reviews on a domain registered last month is lying about one of the two.
4. Look for a real company behind the site
In the EU, a legitimate shop must identify the business behind it: a legal name, a registration number, a physical address, a working contact. A contact page with only a web form and no legal identity is a bad sign. If a company name is given, search the register of the country it claims to be in.
5. Check the prices against reality
The most reliable scam signal has not changed in twenty years: a price that is dramatically better than everywhere else. Scam shops price at 30 to 70 percent below market on exactly the products people search for. Nobody sells the latest phone at half price. That discount is the bait.
6. Watch the payment methods
Legitimate shops offer payment methods that protect the buyer: cards, PayPal, established local options. Be suspicious when a site nudges you toward bank transfer, crypto, gift cards, or a payment app meant for friends. Those methods have one thing in common: the money is very hard to get back.
7. Distrust countdown timers and pressure
Urgency is a manufactured emotion. Countdown clocks, "only 2 left", "your account will be closed today": pressure exists to stop you doing exactly the checks on this list. Real organisations do not mind you taking ten minutes.
8. Inspect the reviews, not the stars
Scam sites ship with their own testimonials, and increasingly with AI-generated review profiles elsewhere. Ignore the reviews a site hosts about itself. Search the domain name plus the word "scam" and look for the shape of complaints: many recent reviews with similar wording is as suspicious as many angry ones.
9. Check the language under the surface
Front pages are polished; scammers rarely finish the rest. Open the terms, the returns policy, the about page. Placeholder text, another shop's name left in the template, or policies that contradict each other reveal a site assembled in an afternoon.
10. Ask how you got there
The route to a site is a signal about the site. An ad on social media, a link in an unexpected text message, a search ad above the real brand: these are the main distribution channels of fake sites. When in doubt, close the tab and type the real address yourself.
If you already paid on a site you now believe is fake: contact your bank or card issuer immediately and ask for a chargeback or transfer recall, change any password you used there, and report the site to your local police and consumer protection authority. Speed matters far more than embarrassment. Nobody who handles fraud for a living will judge you.
Or let something check for you
Every point on this list can be checked by a machine faster than by a person, which is exactly what Vilkax does: domain age, impersonation patterns, payment red flags, pressure language, and hundreds of signals more, before you commit to anything. Vilkax is in early access; joining the waitlist takes one email address.