How to Spot a Fake Website — 9 Warning Signs (2026)

Fake websites use domains that look like the real thing but contain subtle differences: extra words (amazon-secure.com), number substitutions (paypa1.com), hyphens (pay-pal.com), or different TLDs (amazon.net instead of amazon.com). Always check the full domain name in your browser's address bar.

Fraudulent sites are typically set up days or weeks before their scam campaign. A legitimate established business will have a domain registered years ago. Use a WHOIS lookup to check the creation date — anything under 6 months old warrants significant caution.

Check the padlock in your browser's address bar. Any legitimate site handling logins or payments should have HTTPS. Click the padlock to see the certificate details — the certificate should be issued for the same domain you're visiting. A certificate issued to a different domain is a major red flag.

Legitimate businesses display a verifiable physical address, phone number, and company registration number (especially in the UK and EU). Fake sites often omit contact details entirely, provide only a contact form, or list addresses that don't exist when searched on a map.

Fake online stores attract victims by listing popular items (electronics, designer goods) at dramatically below-market prices. If a site is selling a £1,200 laptop for £280, or an iPhone for £150, the goods either don't exist or are counterfeit — and your payment card details will be stolen.

While AI has improved fake sites' writing quality, many still contain broken English, odd phrasing, or identical text to other suspicious sites. Use a search engine to search unusual phrases from the site — if the same text appears on multiple sites, it may be a template-built scam site.

Fake sites often only accept bank transfers, cryptocurrency, or gift card payments — methods where you have no fraud protection. Legitimate retailers accept major credit cards (which give you chargeback rights) and established payment processors. A site that only takes wire transfers is almost certainly a scam.

Search for the company on Facebook, Instagram, Twitter/X, and LinkedIn. Fake sites rarely maintain real social media profiles. Genuine companies have profiles with historical posts, real followers, and engagement. An account created in the past few weeks with no posts or followers is a red flag.

Use a URL scanner to check any site before you enter personal information. Services that aggregate threat intelligence data can identify sites listed in phishing databases, known malware distribution sites, and recently registered domains with suspicious patterns — all before you visit.