Fraud Cleanup

Is This Website a Scam? How to Check Before You Pay

You are on a page asking for a card number or a password. Here is how to check it, and what to do if you already typed.

You are on a checkout page or a login screen, and something feels off. Maybe the price is too good. Maybe the email that brought you here came out of nowhere. You are asking yourself, is this a scam website, and you do not want to type a card number until you know.

Slow down for two minutes. No single sign proves a site is real or fake. A padlock can be faked. A logo can be copied. A top search result can be bought. So stack several checks before you enter anything.

What the site is after

Fake websites exist to take things they can turn into money. The FBI says phishing sites are made solely to steal your information. That usually means passwords, card numbers, or personal details like your Social Security number. The FBI says phishing emails are designed to get exactly that: personally identifiable information or financial credentials.

So when a page wants your password, your card number, or personal details, treat that as the point to pause and check it out.

Read the web address closely

Start with the address bar. The FBI says scammers use slight differences in email addresses, URLs, and spelling to trick your eye and gain your trust. One wrong letter is not a typo. It is a deliberate trick.

Look for:

  • Extra words stuffed in, like a real brand name plus something odd.
  • A letter swapped, such as an rn where an m should be.
  • A hyphen or number added to a name you know.
  • A real company name in the middle of the address, with junk before or after it.

If the address is close but not exact, treat the site as fake until you can prove otherwise.

The padlock and https prove nothing

Many people were taught that a padlock means safe. It does not. PayPal's security page says the s in https is no guarantee a site is real, since hackers can create encrypted sites as well. It also says lots of fake sites display a padlock icon in the address bar, so do not count on that symbol.

A padlock tells you the link to the site is encrypted. It tells you nothing about the people behind the site. A scam site can have both the padlock and https. Keep checking.

How you got there matters

Now think about the path that brought you here.

If you clicked a link in an email or text you did not ask for, that is a red flag. The FBI says not to click on anything in an unsolicited email or text message. The FTC says scammers send phishing emails and texts to trick you into giving personal information.

If you found the site through a search engine, do not assume the top result is the honest one. The FTC says scammers and dishonest businesses sometimes pay to show up at the top of online search results. It also says social media platforms do not always carefully check the ads you see or the advertisers behind them. A paid spot is not an endorsement.

There is one more route worth knowing. The FBI says pharming scams happen when malicious code is installed on your computer to redirect you to fake websites.

What the page itself can tell you

Read the page like a stranger wrote it.

  • Spelling and grammar. PayPal's page says typos, misspellings, and incorrect grammar are common in phishing messages. A polished company can still slip, but a page full of errors is a bad sign.
  • The logo. Anyone can copy a logo. It proves nothing on its own.
  • What it asks for. The FBI says companies generally do not contact you to ask for your username or password. If a message that reached you out of the blue wants your login, treat that request as a warning.

The strongest check: look up the number yourself

Here is the check that beats the rest. The FBI says to look up a company's phone number on your own and call the company to ask if a request is legitimate. Do not use any number printed on the suspicious page. Find it yourself, on a bill, a card, or the official site you reach by typing the address by hand.

If the person who answers has never heard of the page you are on, you have your answer. The same trick works for phone calls and texts, not just websites. If a number reached out to you, check it first with an is this phone number a scam lookup before you call back.

If you already typed something in

It happens. You entered a password or a card number, and now the site looks fake. Here is the next hour.

If you entered a password you use anywhere else, change it on the real site first, then on any other account that shares it. If you entered a card number, contact your card company using a phone number you look up on your own, as the FBI advises. PayPal's page says you should never give personal, credit card, or account info through email, text, or phone. That rule holds for anyone who contacts you claiming to fix the problem.

Report the fake site

The FBI says to report spoofing and phishing to its Internet Crime Complaint Center at ic3.gov. For a broader picture of where a report belongs, USAGov's where to report a scam tool helps you find the best agency or organization to report the scam. For a full walkthrough, see how can I report a scam.

One caution before you file. USAGov says an issue with a legitimate business that has wronged you may not be an actual scam. A merchant with slow shipping is a complaint. A store that took your card and vanished is a report.

Learn the pattern, not just this one site

The FTC says learning the common signs of a scam can help you avoid one. USAGov says scams happen online, by mail, phone, text, social media, in person, and through new technologies. The website in front of you is one shape of it. For the wider picture of how these tricks work, start with this is a scam. If the approach came by phone instead, is this a scam number covers that side of it.

Sources