To spot a fake online shopping website, verify the web address, the seller’s real-world contact details, the price, and the payment options before you enter any information. A padlock icon does not prove a store is legitimate, and a deal that looks far below normal retail pricing deserves extra checking.
Fake storefronts can appear in social media ads, text messages, emails, and search results. The safest response is simple: pause, verify the seller outside its own website, and use a credit card only when you decide to buy.
According to the Federal Trade Commission Consumer Sentinel Network Data Book 2024, consumers reported more than $12.5 billion in fraud losses in 2024. That figure covers many fraud types, but it is a useful reminder that a quick checkout decision can have financial consequences.
Quick Answer
Check the domain name, search the retailer’s name outside its own website, confirm that its contact details work, and read the return policy before paying. Leave if the site combines an unusual domain, prices far below normal retail, pressure to buy immediately, and payment by gift card, wire transfer, or cryptocurrency. HTTPS encrypts your connection, but it does not confirm that the business is legitimate.
Key Takeaway
Do not rely on one signal. A strange web address, no verifiable contact information, copied product images, unrealistic discounts, and hard-to-reverse payment methods are stronger together than any one warning sign alone.
Check the web address before you trust the storefront
The domain name is often the fastest clue. Look for misspellings, added words or numbers, an unrelated business name, or a domain that does not match the brand displayed on the page.
A site using a familiar logo is not necessarily connected to that company. Type the retailer’s known web address into your browser yourself, or search for the company independently, instead of following an unexpected ad, text, or email link.
HTTPS and the padlock icon mean the connection between your browser and the website is encrypted. As the Cybersecurity and Infrastructure Security Agency explains in its phishing guidance, lookalike links and misleading messages can still direct people to harmful sites, even when a page appears polished.
Before you buy: verify the store
- Confirm that the domain matches the retailer’s brand exactly, without misspellings, extra words, or odd characters.
- Search the store name with “reviews,” “complaints,” or “scam” and read results outside the store’s own site.
- Check for a street address and phone number, then verify them independently if the purchase is expensive.
- Read the return, refund, shipping, and contact policies before entering payment details.
- Use a reverse image search on a product photo when the listing seems unfamiliar or unusually cheap.
- Close the tab if countdown timers or low-stock messages are pushing you to skip verification.
Compare the price, reviews, and return policy with normal retail expectations
Deep discounts can be legitimate, especially during clearance events. But a new or unknown store offering brand-name electronics, designer goods, or high-demand products for 70-90% below typical prices should be treated as a reason to investigate, not as proof of a bargain.
Reviews on the seller’s own product page are only one data point. Look for independent mentions over time, mixed feedback, and a business presence that is consistent across search results, social accounts, and contact details.
A missing, vague, or unusually restrictive return policy can create a practical problem even if an order arrives. Check who pays return shipping, where returns go, how long refunds take, and whether the policy identifies the business responsible for the sale.
Important
The FTC warns that scammers commonly demand payment by gift card, wire transfer, payment app transfer, or cryptocurrency because recovery can be difficult. A normal online retailer should not require one of these methods for an ordinary purchase.
Use a credit card and avoid payment methods that are hard to reverse
Payment method is one of the clearest signals of risk. Credit cards generally offer a dispute process if an item never arrives or is materially different from what was advertised, although cardholder protections and deadlines vary by issuer.
Debit cards draw directly from your bank account, so report suspicious charges promptly. Gift cards, wire transfers, and cryptocurrency transactions are often much harder to reverse once sent.
Do not enter login credentials on a shopping site that asks you to reuse an email or retail password. Review our password security guidance if you need help moving important accounts to unique passwords, and learn how a suspicious text link can start the problem in our guide to spotting smishing text message scams.
What to do if you already paid or shared information
If you paid by card, contact the card issuer or bank promptly, explain what happened, and ask about disputing the charge and replacing the card if appropriate. Keep screenshots of the product listing, receipt, messages, and any attempted contact with the seller.
If you used a password that appears anywhere else, change it immediately on every account where it was reused. Start with your email account, financial accounts, and shopping accounts, because email access can be used to reset other passwords.
If you shared identity information such as your Social Security number, date of birth, or a photo of an identity document, consider a credit freeze and monitor your accounts for unfamiliar activity. For account-takeover risks that begin with a phone number, see our SIM swap protection guide.
Report suspected fraud at ReportFraud.ftc.gov. Reporting does not guarantee recovery, but it gives the FTC information it can use to identify patterns and warn consumers.
Your next steps after a suspicious purchase
Tap each step as you finish it. Your progress is saved on this device.
0 of 5 done
Make verification a routine part of online shopping
The best defense is a brief pre-checkout routine. Verify the domain, seller identity, return policy, and payment method before every purchase from a retailer you do not already know.
This is especially useful when a family member finds a deal through a social ad or a text message. Share these checks with relatives who may be targeted by convincing storefront ads, and review our guide to helping elderly parents avoid online scams and identity theft for additional family-focused safeguards.
Get Your Free Personal Security Review
Talk through suspicious purchases, account-protection steps, and practical ways to reduce identity and account-takeover risk.
Frequently Asked Questions
No. HTTPS encrypts the connection between your browser and the website, but it does not verify that the seller is legitimate. Check the domain, contact details, independent reviews, policies, and payment options as well.
Search the exact store name outside its website, verify its address and phone number, compare the price with known retailers, read the return policy, and inspect the domain for misspellings or unusual additions.
Contact your bank as soon as possible, explain the transaction, and ask about disputing it and replacing the card. Save evidence from the listing and monitor your account for additional unfamiliar transactions.
No. A small business may use an unfamiliar domain, so the domain alone is not proof. Treat it as a warning when it appears alongside unrealistic prices, missing contact details, copied-looking content, or hard-to-reverse payment demands.
Yes. An ad or search listing is not a verification of the seller. Open the retailer through an independently verified address and complete the same checks before you pay.
Start with the concern that matters most
Make your accounts, devices, or family safer one clear step at a time
You do not need to change everything today. Choose the account, device, scam, or family concern that brought you here and fix the highest-impact opening first.
People also look for
Keep exploring Phishing & email security
Recognize manipulation, protect email accounts, and give people a clear way to report suspicious messages.
- Common question: what is phishingUnderstand how phishing worksLearn the common phishing types, why they work, and what attackers want.
- Common question: how to spot phishing emailsLearn the warning signs in an emailCheck sender details, urgency, links, attachments, and requests before taking action.
- Common question: email security best practicesUse the email security guideCombine account protection, filtering, safer habits, and reporting procedures.
- Common question: social engineering examplesRecognize social engineering tacticsSee how pretexting, impersonation, urgency, and authority are used to manipulate people.
- Common question: security awareness trainingBuild practical security awarenessHelp employees recognize threats and respond without creating a blame culture.
