If a site reached you through a text, email, ad, or QR code, verify its full address and the seller independently before buying or signing in. A familiar logo isn't enough.
HTTPS encrypts information in transit. It doesn't prove the business exists or will keep its promises.
This advice is for U.S. consumers. If you've already paid or shared a password, go straight to the recovery section.
The warning signs worth stopping for
One warning can have an innocent explanation. Several unrelated warnings are enough to pause.
| Warning sign | What it can look like |
|---|---|
| Web address | Misspelled brand name, extra words, or a domain that does not match the seller |
| Price | Luxury goods or investments offered far below normal value |
| Pressure | Countdown timers, threats, or claims that you must act immediately |
| Seller identity | No clear business name, physical address, or working contact method |
| Payment request | A demand for gift cards, cryptocurrency, a wire transfer, or a person-to-person payment |
| Policies | Missing, copied, or vague shipping, refund, privacy, or cancellation terms |
| Reviews | Identical wording, suspiciously recent praise, or reviews found only on the site |
| Downloads | An unsolicited browser extension, app, or "security update" |
A small business may have an awkward site, and a genuine shop may run a deep sale. Fraudulent sites can be polished or messy, so use these clues as reasons to check, not as proof by themselves.
Read the web address like a skeptic
Read the address bar before you inspect the logo. Branding is easy to copy.
Turns out, the controlling part of the hostname and the way you reached the page matter more than how long the address looks.
- Take a separate route. Close the text, email, advertisement, or QR-code page that brought you there. Type the known address yourself or use a saved bookmark. The FTC warns that a scam QR code can send you to a fake site designed to steal money, personal information, or both; see the FTC's scam guidance.
- Read the whole hostname. In simple
.comexamples,login.example.comis controlled byexample.com, whileexample.com.badsite.comis controlled bybadsite.com. A brand name in the wrong part is still wrong; check for swapped letters and extra hyphens. - Treat shortened links as unknown. Don't use one to log in or pay until you know where it leads.
- Use domain age as a clue, not a verdict. A new domain that copies a known brand deserves extra scrutiny. Private registration alone says little.
- Heed browser warnings. Don't click through just to continue. CISA advises consumers to verify the URL and certificate and use HTTPS before sharing information in its website security guidance.
A long address isn't automatically suspicious. The domain it leads to and the reason the link reached you matter more than its length.
HTTPS is not a trust badge
HTTPS protects the connection between your browser and the site. It doesn't authenticate the business. A fraudulent page can still have a valid certificate.
| HTTPS may help confirm | HTTPS cannot establish |
|---|---|
| The connection is encrypted in transit | The business is legitimate |
| Your browser is using HTTPS | Your order will arrive |
| Certificate information is available | The recipient will handle your data properly |
Use the browser's security indicator to inspect the certificate details, then compare the address with one you obtained from a trusted source.
Check the seller before checkout
A homepage can show plenty of polish without identifying the business behind it. Look for the unglamorous details: the name receiving your money, a working way to contact the seller, and terms that explain what happens if the order goes wrong.
- Identity: Find the legal or trading name and check whether it matches the payment recipient.
- Contact: Test the listed email address or phone number without sharing sensitive information.
- Policies: Read the shipping, returns, refunds, privacy, and cancellation terms before ordering.
- Reputation: Search the business name with words such as "scam," "complaint," or "review" outside the site.
- Consistency: Compare names, currencies, email domains, prices, and addresses across the site's pages.
A logo, privacy policy, and five-star rating can all appear on a fake site. They still don't tell you who gets the money.
Search results are clues, not proof. Scammers can buy ads, copy a real company's address, and post convincing reviews.
Make the checkout boring
Slow down once you reach payment. A convincing product page can still send you somewhere else.
| Check before paying | What deserves a pause |
|---|---|
| Hostname | Recheck it after a redirect. An unrelated payment domain requires verification; legitimate processors sometimes use separate domains, so confirm that processor through the seller's independently confirmed policy. |
| Final amount | Read taxes, shipping, recurring charges, subscriptions, delivery promises, and cancellation terms before approving the payment. |
| Requested information | A normal shop should not ask for another site's password. Be wary of remote-access requests, a Social Security number, or account credentials. |
| Payment method | A demand for gift cards, cryptocurrency, a wire transfer, or a person-to-person payment for an ordinary retail order is a major warning. These transfers may be difficult to reverse. |
Keep the order page, confirmation email, receipt, seller details, and transaction record. Save it all. Really.
Don't enter fake card details to test a suspicious site. Close it instead.
The bait changes by category
The product changes, but the pressure tactics often stay familiar.
Investment and crypto pages may promise guaranteed returns, display a countdown, hide their operators, or tell you to send money to a personal wallet. Before dealing with a broker, adviser, or trading platform, check its registration and disciplinary history with the appropriate regulator. The CFTC's six-step fraud guidance describes that check.
Job websites may advertise unusually high pay, no experience requirements, and instant hiring. Upfront fees for training, equipment, a background check, or access to a paycheck are serious warnings. An employer doesn't need the password for your existing bank account.
QR codes and urgent account alerts use a different setup. Handle a bank, delivery, or account notice through the official app or an address you type yourself.
AI-generated images, copied branding, and polished writing can make a fake page look convincing. Visual polish is no substitute for checking the business independently.
If you already paid or entered information
Move quickly, but start with the institution that moved the money rather than the site's support chat. The payment method determines which recovery process applies.
Stop contact. Leave the site. Don't click follow-up links, install support software, or pay a second fee to unlock a refund.
Call the payment provider. Explain accurately whether you authorized the payment but were tricked, or whether someone made an unauthorized transaction.
For a debit card, call your bank or credit union. For a credit card, call the issuer. If you used a gift card, contact the issuer immediately. For cryptocurrency, contact the exchange or company you used. For a wire transfer or payment app, call the sending institution or service and ask whether it can stop or recall the transaction. The FTC's recovery guidance covers these payment-specific steps.
Secure your accounts. Use a trusted device to change any reused password, starting with email. Turn on multifactor authentication where available. Tell your bank if you shared account credentials.
Preserve records. Save screenshots, the full web address, receipts, messages, phone numbers, dates, transaction IDs, and any cryptocurrency wallet address.
Recovery isn't guaranteed. The provider's process, the payment method, and how quickly you report the loss can all affect what happens.
Report the site separately from seeking recovery
Reporting the site and trying to recover your money are separate tasks. A report may help agencies and platforms connect complaints, but it doesn't replace a call to your bank, card issuer, or payment service.
FTC. Report the consumer fraud through the FTC's scam resources.
IC3. Submit a cybercrime report through the FBI's IC3 complaint form. IC3 analysts review complaints and may forward them to law enforcement or partner agencies. Its FAQ says it doesn't conduct investigations or provide individual case status.
Where you found it. Report the listing to the marketplace, social platform, registrar, or browser where you encountered it. Keep the confirmation number.
Anyone who promises guaranteed recovery for an upfront fee may be running a second scam.
A safe stopping rule
Leave when you can't verify who owns the site, why it contacted you, and what payment-dispute process applies.
To be honest, that is enough reason not to enter a card number or password. Close the tab, open a fresh one, and reach the business through a trusted source.