Five checks in five minutes

Check	What to look for	Source
1. The real domain	A shop name bolted onto someone else's domain, like the NCSC's example "tescos-sales.com" posing as tesco.com	NCSC
2. Complaints	Search the shop or product name with "complaint" or "scam"	FTC
3. Who recommends it	Reviews from people or organisations you already trust, not only the site's own	NCSC
4. The price	Promotions that seem too good to be true, especially from an email or text	NCSC
5. How it wants paying	Gift cards, wire transfer, payment apps, crypto or direct bank transfer are red flags	FTC, NCSC

For check 1, paste the address into our link checker. It pulls out the real domain and flags look-alike spellings and well-known brand names used outside their own site.

The padlock does not mean "safe"

A padlock or "https" only means the connection is encrypted. The FTC states that https does not mean a site is legitimate, because scammers can encrypt sites too (FTC).

Arrived from an ad, email or text?

Do not use the link. Type the shop's official address yourself, or search for it and read the results carefully rather than clicking the first one (NCSC).

Pay in the way that can be undone

Payment	Protection
Credit card	Best protection if it is a scam; you can dispute charges for items never received (FTC). In the UK many purchases are covered by the Consumer Credit Act (NCSC)
Debit card	Less protection; a chargeback may be possible (NCSC)
PayPal, Apple Pay, Google Pay	Check each one's terms (NCSC)
Bank transfer, gift card, crypto	Avoid: hard or impossible to recover (FTC)

At checkout

The NCSC suggests checking out as a guest, filling in only the required fields, and not letting the shop or your browser store your card details (NCSC).

Already paid a shop that vanished?

Call your card issuer or bank straight away and ask for the payment to be reversed. The full table by payment type is on gave a scammer your details or money. Report it: ReportFraud.ftc.gov in the US (FTC), Report Fraud or Police Scotland in the UK (NCSC).

What our checker cannot tell you

It reads the address, not the shop. It cannot see how old a domain is, whether goods ever arrive, or whether reviews are real. A clean result means "no known tricks in the link", not "trustworthy shop".

Left out of this page: marketplace sellers on large platforms, which have their own buyer protection rules.