A website check can uncover warning signs, but it rarely proves fraud by itself. For a U.S. shopper, stronger evidence ties the exact URL to a seller, a specific promise, a payment, and what happened afterward.
A new domain, awkward writing, or private registration can justify caution. None establishes fraud alone. A missed delivery may be a fulfillment dispute, not a scam. Start by collecting records.
What you can prove from a website check
Treat a website check as a collection of clues. Keep technical signals separate from evidence about the seller or transaction.
| Finding | What it can support | What it cannot prove |
|---|---|---|
| A lookalike URL or mismatched domain | The page may be impersonating another business | Who runs the page or whether criminal fraud occurred |
| HTTPS and a valid certificate | The connection is encrypted | That the seller is honest, authorized, or likely to issue a refund |
| An unusually low price or guaranteed result | A possible deceptive sales tactic | That the price alone proves a scam |
| Missing business details or conflicting policies | The seller may be hard to verify or contact | That a small business is fraudulent |
| A payment request sent to another name | A mismatch worth recording | That the recipient is necessarily the scammer |
| A browser or Safe Browsing warning | A strong reason to leave the site | That a site without a warning is safe |
| Copied photos, text, or endorsements | Possible misrepresentation | Who operated the site |
The FTC's online shopping guidance tells shoppers to use encrypted websites when entering payment information. Encryption protects the connection, not the seller's identity or conduct.
Turns out, the padlock answers one narrow question: is the connection encrypted? It does not authenticate the business.
Red flags that deserve evidence
Patterns carry more weight than a magic number. A lookalike domain is more concerning when copied product photos, conflicting policies, and a payment request to another name appear with it. Keep those comparisons in screenshots.
Pressure also needs documentation. Save a countdown timer, an account-closure threat, or a demand for immediate payment. A checkout total that changes after shipping or payment details are entered deserves a screenshot.
To be honest, grammar is weak evidence. Polished copy can appear on a fake storefront, while a legitimate small seller can write poorly. Check whether the seller identity, promises, price, and payment recipient match.
A young domain or private registration adds context, not a pass-fail result. Verify the business name, address, and phone number through a source you found independently. Don't rely on a contact link supplied by the page for that check.
Check safely before you investigate
Don't create an account just to test a suspicious site. Leave identification uploads, software downloads, and test payments alone.
If the page is open, copy the details you need and close it. If you entered a reused password, change it from a trusted device, starting with your email account.
Step-by-step: document a suspicious website
- Copy the complete URL. Take it from the browser bar, including unusual spelling, subdomains, and the full path. Record the date and time.
- Capture the offer. Save the product description, price, shipping promise, fees, return policy, refund terms, seller name, and contact details. Take screenshots and save downloaded copies without changing the originals.
- Check the seller independently. Search for the business name, address, and phone number outside the website. If the page claims to represent a known company, type that company's official address yourself and compare the details.
- Record safety warnings. Note any browser, antivirus, or Google Safe Browsing warning. A clean result is not a clearance certificate.
- Keep communications intact. Save emails, text messages, chat logs, order numbers, receipts, and tracking details. Export chats when possible, and don't edit the originals.
- Trace the payment. Record the payment method, transaction ID, recipient name, account or wallet information, and amount charged. Don't send more money to gather extra proof.
- Build a timeline. Note when you found the site, what it promised, when you paid, each contact attempt, and the seller's response. Describe observable facts instead of guessing at intent.
A bank, regulator, or investigator can use a neutral timeline more easily. Keep it plain, even a little repetitive. State what the page promised, what you paid, what you asked for, and what happened next.
Write, "The site accepted payment and did not provide tracking," instead of claiming an intent you can't prove.
Use shipping and refund promises as evidence
Delivery promises give you transaction evidence. Visual polish doesn't.
The FTC says sellers must ship items as promised in their ads. If no shipping time is given, the seller has to ship within 30 days after receiving your name, address, and payment, or permission to charge your account.
Save the advertised delivery date and the checkout page. A late shipment documents a failure to meet a promise, but it isn't automatic proof of fraud.
Work out the real total, including shipping, handling, taxes, and other fees. Read the return, refund, subscription, and promotional terms before deciding what happened. Keep the receipt and order confirmation.
This FTC online shopping guidance is U.S. consumer guidance. It doesn't turn every late order into a fraud case, and it doesn't replace the seller's stated policy or your payment provider's dispute process.
Evidence checklist
Use this list before reporting the site or contacting your payment provider:
- [ ] Exact website address, including the full path
- [ ] Screenshots showing the date, offer, price, and seller details
- [ ] Shipping, return, refund, and promotional terms
- [ ] Checkout total, including added fees
- [ ] Seller emails, texts, chats, and contact attempts
- [ ] Order number, receipt, tracking information, and payment confirmation
- [ ] Payment recipient, transaction ID, or wallet details
- [ ] Browser or Safe Browsing warning, if any
- [ ] Independent checks of the business name, address, and phone number
- [ ] A dated timeline of promises, payment, and missed obligations
- [ ] Copies of every report or complaint confirmation
One screenshot rarely tells the whole story. Keep original emails, receipts, and downloaded pages when possible.
If you already paid or shared information
If money or personal information has already left your control, act quickly. The FTC's guidance for people who were scammed says to contact the payment company promptly because recovery may become harder with time.
Credit or debit card: Call the issuer using the number on the card or an official statement. If a debit payment was unauthorized or you were tricked into making it, report it to your bank or credit union immediately. Ask which dispute process applies and what deadline you must meet.
Gift card: Contact the gift card company right away. Keep the card, receipt, and any message that told you to buy or share it.
Cryptocurrency: Contact the exchange or service you used as soon as possible. Provide the wallet address, transaction ID, amount, and date. A blockchain record documents a transfer, but it doesn't mean the money can be recovered.
Wire transfer or payment app: Contact the bank or provider immediately. Ask about reversal, freeze, or fraud-reporting options, and provide the transaction details.
If you reused a password, change it everywhere it appears. Watch the related account for unfamiliar activity. Never pay a second fee to unlock a refund or release supposed winnings.
Report the website
Use the FTC's consumer reporting guidance to report suspected fraud. Include the exact URL, seller identity, dates, amount, payment method, promises, and supporting records.
For an internet-facilitated crime, you can file with the Internet Crime Complaint Center. The IC3 FAQ says anyone affected by a cyber-enabled crime may file, including a citizen of another country or someone reporting a subject in another country.
Trained IC3 analysts review complaints and may share information with law enforcement and partner agencies as appropriate. IC3 doesn't conduct investigations or provide the status of a submitted complaint.
A submission confirmation shows that you reported the matter. It is not an official finding that the website is fraudulent.
Thing is, automated tools don't settle this question. AI scanners and reputation databases can add clues, while a blockchain explorer can show a crypto transfer. Neither proves who controlled the site or what the operator intended.
Common questions
Does HTTPS prove that a website is safe?
No. HTTPS encrypts information sent between your browser and the site. It doesn't verify the business, products, advertising, or payment recipient.
Does a new domain prove a site is fraudulent?
No. New businesses exist. Treat domain age, registration privacy, missing reviews, and unusual design as context. Then look for independent evidence about the seller and its promises.
Can a blacklist check prove a website is legitimate?
No. A warning is a serious reason to leave the site. A clean result only means the service hasn't identified a current warning; it isn't a guarantee.
Is a missing package enough to prove a scam?
Usually not on its own. Compare the order with the promised delivery date, save every contact attempt, and check the FTC shipping guidance. Your payment provider and the reporting agency will need specific facts.
Can reporting the site get my money back?
Not by itself. Reporting and recovery are separate tracks. Contact the payment provider first, keep your records, and ask which dispute or reversal process applies. The FTC warns that money may already be gone, so don't delay.
If the site still looks suspicious, close the page. Save the exact URL and transaction records, contact the payment provider today, and file the report that fits the facts.