Have you ever landed on a shopping site with prices so low they felt unreal? Your gut was probably right. Fake storefronts, phishing clones, and bogus investment portals look remarkably polished because scammers copy legitimate merchant code and deploy modern templates in minutes.
They still leave technical fingerprints behind.
Don't enter a credit card number until you've checked the domain, the payment method, and a couple of public records. Thing is, that polish won't ship anything.
The 60-Second Sanity Check
Don't type personal data or card numbers on an unfamiliar store until this list is done:
- [ ] Inspect the address bar for extra words, misspelled brand names, or unusual extensions.
- [ ] Check domain registration age; new domains warrant caution.
- [ ] Look for a verifiable street address and direct customer phone number.
- [ ] Confirm the site accepts standard credit card payments.
- [ ] Run the web address through a reputable malware scanner.
Domain Age and the HTTPS Misconception
Shoppers often treat the lock icon as proof the store is real. It isn't.
HTTPS simply means the connection between your computer and the hosting server is encrypted. Anyone can obtain a free SSL certificate in minutes, and online criminals install them on fraudulent portals every single day. Encryption protects your transmission from outside eavesdroppers. It doesn't protect you from the merchant on the other end.
Check the domain's birthday on ICANN Lookup, which still publishes the creation date even though privacy rules now redact individual owner names on most registrations. The registration date still matters a lot.
If a retailer claims to be an established American business but registered its domain three weeks ago, close the tab.
| Security Signal | What It Actually Proves | What It Does Not Prove |
|---|---|---|
| Padlock icon / HTTPS | Traffic between you and the host is encrypted | The business is legitimate or will ship orders |
| Domain registered 5+ years ago | The web address has existed for years | The current owner has not bought an expired domain |
| Professional product photos | Someone uploaded clear digital images | The seller actually possesses or ships the inventory |
| On-site customer reviews | The page displays star ratings and praise | Real consumers wrote those comments |
Payment Methods and Federal Shopping Rights
Payment methods tell you more about an unfamiliar merchant than the homepage copy does.
Federal credit billing laws protect card transactions in ways other payment methods never match. Under the Fair Credit Billing Act, you have explicit rights to dispute unauthorized charges or orders that never arrive. That protection is the vital part.
Scam stores actively steer shoppers toward payment rails that offer zero chargeback rights.
Turns out, once money leaves your bank account through wire transfers, cryptocurrency, gift cards, or peer-to-peer services like Zelle and Venmo, getting it back is nearly impossible, because those transactions function just like handing over paper cash, which is why rogue operators push shoppers onto those rails. Never pay an online store with gift cards or crypto.
Walk away immediately if a website claims credit card processing is down and asks for a direct bank transfer.
Legitimate online merchants must follow the FTC online shopping guide. The Federal Trade Commission requires sellers to ship merchandise within advertised deadlines, or within 30 days if they state no timeframe.
How to Spot Deceptive URLs
Hover your cursor over links before you click and check the destination preview at the bottom of your browser window. If the anchor text promises one destination but the preview points somewhere else, don't click it.
Attackers rely on hurried clicking and use typosquatting, subdomains, and character substitution to build addresses that mimic legitimate retail platforms you already trust. Look at that first slash carefully. A domain like paypal.com.account-verification-notice.net isn't PayPal; it belongs entirely to account-verification-notice.net.
Scammers use brand names as subdomains to fool inattentive buyers.
Take a second to inspect the root domain right before the final suffix, the actual owner of the address, not the brand name parked out front as a subdomain. The root is what counts here.
Automated Scanner Tools
To be honest, automated scanners are not completely foolproof. An attacker can spin up a fresh landing page just minutes before launching a phishing campaign. A clean scanner result should confirm your other checks rather than replace them entirely.
You don't have to inspect website code manually to check for malicious activity. Several free diagnostic tools scan addresses against global threat registries and crawler feeds.
Google Safe Browsing scans pages to identify compromised hosts, deceptive social engineering schemes, and malware distribution sites across the web. VirusTotal analyzes suspicious web addresses and file downloads. It uses dozens of antivirus engines and domain blocklists simultaneously.
ICANN Registration Data Directory shows the authoritative registrar, domain status codes, and initial registration date for active internet domains.
What to Do If You Sent Money to a Fraudulent Site
Act quickly when you suspect fraud. Follow these steps to limit financial damage and report the incident:
- Contact your bank or card issuer immediately. Request a chargeback on your credit card or cancel any debit card entered on the rogue website.
- Change credentials on shared accounts. If you used your standard email and password during checkout, update those logins on other services and turn on two-factor authentication.
- File a report with federal consumer agencies. Submit transaction records and screenshots to FTC Fraud Reporting and the FBI Internet Crime Complaint Center.
- Escalate investment fraud to regulators. If you transferred funds to a bogus trading platform, check registrations using the CFTC BASIC database or FINRA BrokerCheck before filing formal regulatory complaints.
- Escalate unresolved bank disputes. If your financial institution mishandles a valid credit card dispute under federal law, submit a complaint with the Consumer Financial Protection Bureau.
Bookmark your bank's direct fraud department number and keep an ICANN search tab handy.