A website is not safe just because it has a padlock: phishing sites use HTTPS too. Before you log in or pay, check the exact address, the age of the domain with a WHOIS lookup, its status in Google Safe Browsing, and independent reviews. A brand-new domain, a misspelled brand name, pressure to pay quickly and unusual payment methods such as bank transfer or crypto are the strongest warning signs.
9 quick checks
- Read the address carefully. Look at the part right before the domain extension:
paypal.com.secure-login.netbelongs to secure-login.net. Watch for swapped letters and look-alike characters; see typosquatting. - Check the domain age. WHOIS shows the creation date. A shop or “bank” whose domain is a few days or weeks old is a major red flag.
- Check HTTPS and the certificate. No HTTPS on a login or payment page means stop. With HTTPS, our SSL checker shows who the certificate was issued to; a padlock alone only means the connection is encrypted.
- Check Google Safe Browsing. Google’s Transparency Report shows whether the site is currently flagged for phishing or malware.
- Scan the URL. Services such as VirusTotal check an address against dozens of security vendors without you opening it.
- Search for reviews. Search the site name with “scam” or “reviews”. No reviews at all for a site offering big discounts is also a warning.
- Look for real contact details. A legitimate business shows a company name, address and working contact methods, not only a form or a messaging app.
- Check the payment options. Credit cards and well-known payment services offer buyer protection; requests for bank transfer, gift cards or crypto do not.
- Do not download unexpected files. A site that pushes you to install a “player”, “update” or browser extension is very likely malicious.
Red flags at a glance
| Sign | Why it matters |
|---|---|
| Domain registered recently | Scam sites are short-lived and use new domains |
| Prices far below the market | The most common bait for fake shops |
| Countdown timers and pressure | Designed to stop you from checking |
| Login page reached from an e-mail or SMS link | Typical phishing path; type the address yourself instead |
| Spelling mistakes and copied content | Fake sites are often made quickly from templates |
| Only bank transfer or crypto accepted | No way to get your money back |
If you already entered data
- Change the password at the real site immediately, and anywhere else you used it.
- Call your bank if you entered card details and ask them to block the card.
- Turn on two-factor authentication in your account’s security settings, preferably with an authenticator app or a passkey.
- Report the site to Google Safe Browsing and to the domain’s registrar (Abuse Contact Lookup).
E-mail-based lures are covered in how to spot a phishing email.
Common Questions
Does the padlock mean a website is safe?
No. It only means the connection is encrypted. Phishing and scam sites routinely use free certificates, so check the domain name, age and reputation as well.
How can I check a link without opening it?
Hover over it to see the real address, or paste it into a URL scanner such as VirusTotal or into Google's Safe Browsing site status page.
Is a new domain always dangerous?
No; every legitimate site was new once. A new domain is a warning sign when it combines with a well-known brand name, unusually low prices or requests for login or payment details.
What should I do if a safe-looking site asks me to install something?
Close the page. Legitimate sites rarely require extra software, and fake updates and players are a common way to spread malware.