How to spot a fake website and check if a store is legit

A fake website usually gives itself away in three places: the address, the age of the domain, and the page itself. Check that the address is exactly the one you expect, be wary of domains registered a few weeks ago, and don't trust the padlock on its own, because anyone can get one for free. If a shop only takes bank transfers and has no company you can verify behind it, don't buy.

Start with the address: lookalike domains

The domain is the name of the site, the part after https:// and before the next slash, such as tienda-ejemplo.co. Scammers can't use the real one, so they pick names that look the same at a glance:

• Swapped or extra letters. tienda-ejenplo.co, tiendaa-ejemplo.co or tienda-ejernplo.co, where "rn" passes for "m". The digits 0 and 1 can also stand in for o and l.
• Extra words. tienda-ejemplo-outlet.com or yourbank-secure-login.com. Adding "official" to a name costs nothing and proves nothing.
• A different ending. The last part (.com, .co, .shop) is called the top-level domain. A real shop at tienda-ejemplo.co has nothing to do with tienda-ejemplo.shop.
• The real name in the wrong place. In yourbank.com.account-check.net, the site you land on is account-check.net. Read the domain from the end.
• Letters from other alphabets. The Cyrillic "а" looks identical to the Latin "a", so yourbаnk.com written with it is a different domain. Browsers convert such names to an ASCII form called punycode, which starts with xn--: that one is really xn--yourbnk-6fg.com. Browsers often show the xn-- form when they notice mixed alphabets, but not always.

Brand-new domains are a warning sign

Every domain has a registration date. Real shops, banks and government sites usually have domains that are years old. Fake stores and phishing pages (pages built to steal passwords or card numbers) tend to use domains registered days or weeks earlier. They get blocked quickly, so scammers just register new ones.

A young domain does not prove fraud: new businesses exist. But a "store" claiming ten years in business on a domain registered last month is lying. The site can't fake that date: it comes from the registry.

Why the padlock doesn't mean the site is honest

HTTPS means the connection between your device and the site is encrypted, so nobody on the same Wi-Fi can read what you send. The padlock (recent versions of Chrome show a settings icon instead) tells you only that, not who is on the other end.

To use HTTPS, a site needs a certificate, a small file that proves it controls the domain. Certificates are free: Let's Encrypt and similar services issue them automatically to anyone who controls a domain, scammers included. So nearly every fake shop has a padlock. No padlock is a reason to leave; a padlock is not a reason to trust.

Red flags on the page itself

• Prices too good to be true. Phones or sneakers at half price or less, when every other shop charges the normal price.
• Bank transfer only. Card payment "fails" and you are asked to transfer to a personal account. Transfers are hard to reverse.
• No real contact details or company ID. Only a WhatsApp number, no street address, no company name. In Colombia a legitimate business has a NIT (Número de Identificación Tributaria, its tax ID) and is registered with a chamber of commerce. Elsewhere, look for the local registration number.
• Copied reviews. Dozens of five-star reviews from the same week in the same style, or photos copied from other shops.
• Pressure. Countdown timers that restart when you reload, "only 2 left" on every product, a sale that "ends tonight" every night.

How to check a website, step by step

1. Copy the exact address from the address bar rather than retyping it. If it came in a message, Is this link safe? covers short links and redirects.
2. Look for lookalike characters. Paste it into the Lookalike domain detector. It shows the real punycode address and flags letters from other alphabets, mixed digits and tricks like "rn". It runs on your device; nothing is sent anywhere. A clean result only means there are no hidden characters, so still compare the name letter by letter.
3. Check the domain's age. Type the main domain (example.com, not shop.example.com) into the Domain age checker. The domain goes to our server (api.ethorns.com), which asks the official registry through RDAP, the modern replacement for WHOIS, and keeps only the result for one hour. Some country registries, including the one for .co, don't offer RDAP yet. If you get no dates, rely more on the other checks.
4. Look at the certificate. The SSL certificate checker shows who issued it, when, and which names it covers. Our server connects to the site on port 443 and keeps only the result for ten minutes. A free certificate is normal. But a certificate and a domain both created this week, for a shop that claims to be old, don't add up.
5. Run a quick scan. The Website security scan reads the homepage like a browser and grades its security settings. The domain goes to our server, which keeps only the result for one hour. The grade is a hint about care, not a verdict on honesty: a scam site can score an A, and a small honest shop a D.
6. Search for the company elsewhere. Search the shop's name with words like "scam" or "reviews". Look up the address on a map and call the phone number. In Colombia, search the NIT or company name in the RUES, the public register of the chambers of commerce.
7. Pay with a protected method. A credit card is usually safest, because your bank can dispute the charge (a chargeback) if the goods never arrive. So is cash on delivery. Don't transfer money to a personal account for a shop you don't know.

If you already paid or typed your data

1. Call your bank right away, using the number on the back of your card or in its official app, never one from the site. Block the card if you typed its details and ask about disputing the charge. In Colombia, the Consumer Statute (Ley 1480 of 2011, article 51) allows a payment reversal for online purchases paid by card or another electronic method when there was fraud or the product never arrived. You have five business days to file the claim.
2. Change your password if you typed it on the fake site: first on the real site, then anywhere you reuse it, and turn on two-step verification. Our guide on checking if your password has leaked explains the rest.
3. Save evidence: the address, screenshots, the receipt and any chat messages.
4. Report it. In Colombia you can report online fraud to the National Police through the CAI Virtual. You can also report the site to Google Safe Browsing so browsers warn other people.
5. Watch for a second scam. Fake "bank agents" or "recovery services" may call offering to get your money back. Never give them passwords or codes.

Quick checklist

• The domain is exactly the one you expect, read from the end, with no xn--.
• The domain is not just a few weeks old.
• You don't rely on the padlock alone.
• The price is in line with other shops.
• The address, phone and company ID (the NIT in Colombia) check out elsewhere.
• You can pay by credit card or cash on delivery, not only by transfer.

Frequently asked questions

Is a site safe if it has a padlock?

No. The padlock only means the connection is encrypted. Certificates are free and automatic, so fake shops have them too.

Can a new domain belong to a real business?

Yes. A young domain is a reason to look harder at the other signals, not proof of fraud. It's a strong warning when it contradicts what the site claims, or when the name imitates a known brand.

The shop has lots of followers on social media. Is that enough?

No. Followers and comments can be bought, and scam shops often run paid ads. Run the same checks.

What if the shop only sells through WhatsApp?

Many honest small businesses do. Ask for the company name or NIT and check it, prefer cash on delivery or a card, and don't send an advance transfer to an account you can't verify.

Try it

• 1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
• 1.8Domain age checkerSee when a domain was registered, when it expires, its registrar and nameservers.
• 1.6SSL certificate checkerCheck any site's SSL/TLS certificate: whether it's valid, when it expires, who issued it, which names it covers and the TLS version in use.
• 1.5Website security scanPassive check of a website's homepage: HTTPS redirect, TLS certificate, HSTS, CSP, clickjacking, cookie flags and security.txt, with a grade and fixes.

For your team

• US$19Phishing awareness kit for small businessesA 30-minute session on fake messages, ready to give to your team: a facilitator guide, 12 example messages, a poster, a policy and a quiz.