You can recognize fake websites by checking the exact web address, being sceptical of deals that look too good to be true, and confirming that the site has real contact details and a clear business behind it. A padlock icon on its own does not make a site trustworthy, because scammers can get one too.
Why fake websites work so well
Copying a website is easy. Criminals can lift the logos, colours and layout of a bank, a delivery company or an online shop in minutes. They then register an address that looks close enough and send people to it through emails, text messages, social media adverts or search results. Once you are on the page, the goal is to collect your login, your card number or both.
The good news is that the address and a handful of other clues are very hard to fake perfectly. You just need to know where to look.
Start with the web address
The address bar is the most reliable thing on the page, because the page itself cannot change it. Read it slowly.
Find the real domain
The part that matters is the domain name, which sits just before the first single slash. In login.yourbank.example.com/secure, the real domain is example.com. Everything to the left is a subdomain chosen by whoever owns it. Scammers often put a trusted name on the left to look convincing, such as yourbank.login-check.example, which belongs to login-check.example, not to your bank.
Watch for look-alikes
- Swapped or doubled letters, for example a lowercase L replaced by the number one.
- Extra words like secure, support or verify added to a familiar name.
- Unusual endings when you expected a familiar one.
- Hyphens that split a brand name in odd places.
When in doubt, do not follow the link. Type the address you know yourself, or use a bookmark you saved earlier.
What the padlock does and does not tell you
The padlock means your connection to the site is encrypted using HTTPS, which stops others on the network reading or altering the data in transit. It does not mean the site is honest. A fake shop can use HTTPS as easily as a real one. For the technical background, see what HTTPS is and why it matters. Treat the padlock as the minimum, and its absence on a page asking for a password or card number as a clear reason to leave.
Other clues that a site is fake
No single item below is proof, but several together should make you stop.
| Clue | What to look for |
|---|---|
| Prices | Famous items at a fraction of their normal price, often with a countdown timer |
| Payment options | Only bank transfer, gift cards or cryptocurrency, with no card option |
| Contact details | No physical address, no phone number, or only a free webmail address |
| Policies | Missing or copied returns, privacy and terms pages |
| Language | Odd wording, inconsistent branding, broken links |
| Reviews | Only perfect testimonials on the site itself, with nothing independent |
| Pressure | Warnings that you must act now or lose your account |
How to recognize fake websites in practice
Here is a simple routine you can run in under a minute.
- Read the address. Identify the real domain and compare it with the one you expected.
- Think about how you got there. A link from an unexpected message is riskier than one you typed. Our guide on how to spot phishing emails explains the common tricks.
- Search for the shop or service by name and look for independent mentions, such as complaints, news coverage or a long-established presence.
- Check the extras. Look for working contact options, clear returns terms and a company name you can verify.
- Pay safely. Credit cards and well-known payment services often have dispute processes. The protections vary by country and provider, so check what yours offers.
- Trust your instincts. If something feels off, close the tab.
Using tools to help
Modern browsers warn about many known dangerous sites, so keep yours updated and take those warnings seriously. A password manager is another quiet defender: it only fills your login on the address you saved, so if it stays silent on a page that looks familiar, that is a hint something is wrong. We cover this in password manager basics. Turning on two-step verification also reduces the damage if a password is captured, although a fake page can sometimes capture one-time codes too.
If you already entered details
- Change the password on the genuine site and anywhere you reused it.
- Contact your bank or card provider if you entered payment details.
- Watch your accounts and statements for unfamiliar activity.
- Report the site through your browser or to the real company so others are warned.
More practical guides are collected in our cybersecurity category.
Where to start
Build one habit first: before you type anything sensitive, read the domain in the address bar. Add the second habit of reaching important sites through bookmarks rather than links in messages. Those two steps remove most of the risk from fake websites.
Frequently asked questions
Does the padlock mean a website is safe?
No. It only shows that the connection is encrypted. Fake sites can use HTTPS too, so check the domain and other signs as well.
How can I check if an online shop is real?
Read the address carefully, search for independent mentions, look for real contact details and policies, and be wary of prices that seem too good to be true.
What should I do if I entered my details on a fake site?
Change the password on the real site and anywhere it was reused, contact your bank if you shared card details, and monitor your accounts.
Can my browser warn me about fake sites?
Many browsers flag known dangerous sites, so keep yours updated and heed the warnings. New fake sites may not be flagged yet, so still check manually.
