Scam websites often look ordinary. Before you pay, sign in, scan a QR code, or upload identification, stop and check the address.
Verify the seller through a route you found yourself. Use a payment method with a dispute process you understand.
If you've already paid, contact the relevant provider now.
What a scam website is trying to get from you
A fake website may be after your money, passwords, bank details, identity documents, or permission to install software. It might pretend to be a store, bank, delivery company, government service, investment platform, job board, charity, or account-support page.
The FTC warns that a scam QR code can open a fake website designed to steal money or personal information. You might find those codes in emails, texts, parking notices, flyers, or messages that appear to come from a familiar company.
Turns out, a late delivery or poor support experience isn't proof of fraud. Look for several clues, save what happened, and verify who operates the page before you send anything else.
Warning signs to check before you trust a page
| Signal | Why it deserves scrutiny | Safer move |
|---|---|---|
| Lookalike or unfamiliar web address | The page may be impersonating a brand or service | Type the known address yourself or use the official app |
| Extreme discount or guaranteed return | The offer may be built to rush your decision | Compare the price and claim with independent sources |
| Countdown timer or repeated urgent warnings | Pressure leaves less time to check the offer | Close the page and reassess later |
| Payment by gift card, crypto, wire, or unusual transfer | Recovery and dispute options may be limited | Ask whether a normal card or established wallet is available |
| Missing business details or vague return terms | You may not be able to identify or verify the seller | Find the company through an independent source |
| Identical, generic, or unusually perfect reviews | Testimonials can be copied or manipulated | Look for discussion outside the site |
| Unexpected login, QR code, or download request | The page may be phishing or delivering malicious software | Open the official app or site separately |
| Padlock or HTTPS alone | Encryption doesn't prove who operates the website | Check the address and business independently |
One clue can have an innocent explanation. Several together are a good reason to leave.
Why HTTPS, domain age, and reviews are not proof
HTTPS usually encrypts the connection between your browser and the site. It doesn't certify the business, guarantee delivery, or prove that the page belongs to the brand it names.
Thing is, the padlock only tells you about the connection.
A domain lookup may show when an address was registered and whether its registration details are private. A new domain isn't automatically fraudulent, while an older one could be compromised or used for something unrelated.
To be honest, reviews need some distance too. On-site testimonials are easy to copy, and a polished design has earned only a closer check, not your payment details.
How to check a suspicious website safely
Run these checks before you create an account, upload identification, or place an order.
- Stop typing. If an unexpected email, text, advertisement, or QR code brought you to the page, don't sign in or enter payment details. Leave if the browser shows a warning or the page pushes you to download something.
- Read the full address. Check for misspellings, extra words, strange endings, and misleading subdomains. In
brand.example.com, the registered name is usuallyexample.com, not the word at the far left. - Use a known route. Type the company's address yourself, open a saved official app, or find contact details on a statement or card. Don't use the link or phone number in the suspicious message.
- Check the seller's identity. Look for the company name, physical address, customer-service details, return terms, and privacy information. Confirm those details through a source you found independently.
- Treat complaint searches as leads. Search for the company name and complaints, but remember that search results and review sites can contain mistakes, paid content, or fabricated praise.
- Look at domain history if it helps. A reputable domain-registration lookup can show when the address was created. Neither the date nor private registration details proves that the site is safe or fraudulent.
- Inspect the payment request. For an ordinary consumer purchase, stop if the seller insists on gift cards, cryptocurrency, a wire transfer, or payment outside the normal checkout process, especially with urgency or an unusually large promise.
- Don't bypass browser warnings. Phishing, malware, and invalid-certificate warnings are reasons to leave. Clicking through won't make the page trustworthy.
How the warning signs appear in different scams
The same warning sign can point to different kinds of fraud. Scammers reuse familiar designs, but they change the story.
Fake online stores
Fraudulent shops often combine unusually low prices with copied product photos, vague shipping information, and weak return policies. A countdown clock or a claim that only one item remains can push you to buy before you check the seller.
Compare the store's address with the brand's known website. Check whether the company has a consistent identity outside the store. A familiar logo doesn't show who operates the page.
Phishing and fake account pages
A phishing page may say your account was suspended, a payment failed, or a delivery needs confirmation. It may be trying to capture a password, card number, verification code, or identity document.
Open the bank, retailer, or delivery app yourself. Never give a one-time code to someone who contacted you unexpectedly. An urgent request to install a security update is another strong reason to stop.
Investment, job, romance, giveaway, and donation scams
Investment sites may promise guaranteed returns or show an endorsement that seems to come from a celebrity or public official. Job offers may ask for an upfront fee or sensitive information before a real interview. Romance, giveaway, and donation scams often use emotional urgency to make payment feel like the only way to help.
AI-generated images, voices, and videos can make a false person or endorsement look convincing. The FTC has also warned about scammers manipulating pet images and using deepfakes. To be honest, a polished video proves nothing by itself.
If you already paid or shared information
Move quickly. Use contact details from your card, bank statement, or the provider's known website, not from the suspicious page.
The right response depends on how the money or information moved.
| What happened | First action |
|---|---|
| A credit card was charged | Call the issuer using the number on the card. Ask about securing the account and disputing the transaction |
| A debit card or bank account was used | Contact the bank immediately. Ask what account-protection, stop-payment, or investigation options apply |
| You used a payment app, wire, or remittance service | Report the transaction to the provider and your bank. Ask whether cancellation or recall is still possible |
| You sent cryptocurrency or used a gift card | Contact the exchange or card issuer promptly and provide the transaction details. Don't pay a separate recovery service |
| You entered a reused password | Change it through the official service, change it anywhere else it was reused, and turn on multi-factor authentication |
| You uploaded identity information | Contact the affected institution, monitor your accounts, and ask what protective steps it recommends |
| You downloaded a suspicious file | Stop using the device for sensitive logins and use trusted security support or software to check it |
Keep every record you can. Save the website address, screenshots, emails, order records, receipts, payment confirmations, phone numbers, and transaction identifiers. Keep the original messages if possible.
Payment protections and notice deadlines vary by payment rail and account type. Ask the provider for its exact process instead of relying on a general deadline.
How to report a scam website without falling for a second scam
The reporting options below are U.S. routes. Type official addresses into your browser rather than following a report link sent by the suspected scammer.
The FBI has warned that criminals have created fake pages and AI-generated videos impersonating the Internet Crime Complaint Center, or IC3.
- Report the fraud to the FTC. Use the FTC's ReportFraud portal and include the website address, dates, payment method, contact details, and evidence.
- Report cyber-enabled crime to IC3. File through the Internet Crime Complaint Center. Its FAQ says anyone affected by cyber-enabled crime can file a report, including people in another country or people reporting crime connected to another country. IC3 reviews complaints and shares information with law-enforcement and partner agencies, but it doesn't conduct investigations or provide an investigation status.
- Use the CFPB complaint portal when a financial company is involved. The Consumer Financial Protection Bureau complaint page accepts complaints about areas including credit cards, money transfers, virtual currency, and money services.
- Report the page to the platform or marketplace. If the scam appeared on a social network, marketplace, payment app, or advertising service, use that service's reporting tools. Contact your bank or payment provider separately; reporting the website doesn't replace a payment dispute.
Reports can help agencies and platforms identify patterns, but filing one doesn't guarantee that money will be recovered. Keep your evidence and deal with the payment provider directly.
If you're viewing a suspicious page now, close it without signing in. Open a new tab, find the company's known address, and use that route instead. If you entered payment or login information, call the relevant provider today and keep every record of what happened.