How to Check a Website Before You Trust It

Fake websites are commonly used for phishing, credential theft, payment fraud, malware delivery, investment scams, fake online stores, identity theft, OAuth consent abuse, session theft, and account takeover.

A website should be assessed by looking at the source of the visit, the actual domain, the requested action, the authentication or payment flow, and the consequences of being wrong.

The source of the visit matters.

A user who arrives through an unsolicited email, SMS, QR code, pop-up, sponsored ad, social media ad, marketplace message, or compromised account is following a path that may have been controlled by an attacker.

Search results also deserve caution. A malicious or misleading website may appear through an advertisement, search-engine optimisation, or a cloned page that targets a specific brand, product, government service, or support query.

The domain matters more than the page design.

Attackers may use:

• Typosquatting: small spelling changes in a domain.
• Combosquatting: adding extra words to a trusted brand name.
• Misleading subdomains: placing a trusted-looking word before the real domain.
• Different top-level domains: using a different ending from the legitimate site.
• Shortened links: hiding the final destination.
• Redirect chains: sending the user through one or more intermediate pages.
• Compromised legitimate websites: hosting malicious content on a real site that has been abused.
• Lookalike characters: using characters that visually resemble normal letters.

A common mistake is looking at the wrong part of the address.

In a URL, the important ownership boundary is usually the registrable domain, not every word shown in the address. For example, in a long address with many dots and slashes, a trusted-looking word may appear in a subdomain, path, query string, or page title without meaning the site is controlled by that organisation.

Lookalike characters can make this harder.

Some fake domains use Unicode characters from other alphabets that visually resemble normal ASCII letters, such as characters that look like a, e, o, p, or c. This is often discussed as an IDN homograph or lookalike domain technique. The address may look familiar to a human reader, but it is technically a different domain.

Some browsers display certain internationalised domains as punycode, beginning with xn--, when they detect potential risk or mixed-script usage. This can help, but it is not something users should rely on as their only protection.

HTTPS is necessary, but not sufficient.

A padlock or HTTPS means the connection between the browser and the website is encrypted. It does not prove that the website is legitimate, trustworthy, or controlled by the organisation it appears to represent.

Attackers can obtain certificates for malicious domains. A fake website can have HTTPS, a polished design, and a realistic-looking login or payment form.

The requested action matters.

Higher-risk actions require stronger verification. These include:

• Entering usernames and passwords.
• Providing multi-factor authentication codes.
• Approving sign-in prompts.
• Entering card or bank details.
• Uploading identity documents.
• Downloading software.
• Paying invoices, fees, deposits, or investments.
• Updating saved payment details.
• Changing account recovery settings.
• Granting access through an OAuth consent screen.
• Installing browser extensions, mobile profiles, or remote access tools.

Login flows deserve extra care.

Some phishing sites simply collect usernames and passwords. More advanced attacks may proxy the real login page, capture multi-factor authentication codes, trick the user into approving a sign-in, or attempt to steal session tokens.

A password manager can help because it usually only offers to autofill credentials on the matching domain. If the password manager does not recognise the site, that can be a useful warning sign.

Payment flows deserve extra care too.

A fake website may use:

• A fake checkout page.
• A real payment processor connected to a scammer.
• Bank transfer instructions.
• Cryptocurrency wallet details.
• Gift card requests.
• A fake investment dashboard.
• A fake invoice or deposit page.
• A payment page reached from a QR code or message link.

Some payment methods are much harder to reverse than others. Bank transfers, cryptocurrency, gift cards, and some marketplace payments can be difficult or impossible to recover once sent.

QR codes are website links in image form.

A QR code can hide the destination until it is scanned. Attackers can place QR codes in emails, letters, posters, parking meters, restaurant menus, fake notices, or stickers placed over legitimate codes.

QR codes should be treated like links. If scanning a code leads to a page asking for payment, login details, identity documents, card details, or security codes, verify the destination before continuing.

Useful technical controls include:

• Password managers that only autofill on matching domains.
• Browser safe-browsing warnings.
• DNS filtering or protective DNS.
• Email and link scanning.
• Endpoint protection.
• Multi-factor authentication.
• Security keys for important accounts.
• App-based access instead of message links.
• Bookmarks for high-value services.
• Domain monitoring for businesses.
• DMARC, SPF, and DKIM for reducing email impersonation of owned domains.

These controls help, but none of them are perfect.

A useful model is to separate four things:

• Appearance: how professional the website looks.
• Address: where the browser actually is.
• Action: what the website wants the user to do.
• Verification: how the user confirms the site or request independently.

Appearance is the weakest signal. Verification is the strongest.

For important accounts and payments, use a known-good path: the official app, a typed website address, a saved bookmark, a trusted contact, or a verified phone number from a previous reliable source.

The safest habit is to pause, check the address, consider the requested action, and verify separately before entering sensitive information or sending money.