"Is this website legit?" It's one of the most-searched shopping questions of 2026 — and for good reason. The pattern repeats every year: as Black Friday, Singles Day and the Christmas season approach, fake online stores pop up by the thousands, dressed up with stolen product photos, too-good-to-be-true prices and countdown timers designed to rush you past your own instincts. Consumer agencies on both sides of the Atlantic issue fresh warnings every autumn, yet the stores keep working — because most shoppers never spend the five minutes it takes to check.
Those five minutes are the whole difference. Before you type in your card details on any store you don't already know, run these eight checks. They cost nothing, need no special tools, and they're the same checks investigators use when a new "bargain" site lands on their radar.
1. Read the address bar like a detective
Start with the domain itself — the single fastest legitimacy test you have.
Check the domain age. A store claiming "10,000 happy customers" whose domain was registered three weeks ago is telling on itself. Free WHOIS lookups (whois.com, whois.domaintools.com) show registration dates in seconds. Anything under six months old deserves serious caution.
Watch for deceptive lookalikes. The UK's National Cyber Security Centre specifically warns about domains engineered to resemble genuine retailers. Classic Black Friday fakes look like amazn-deals.shop, amazon-black-friday.online or prime-clearance-event.com — on a phone, the URL bar often truncates, so tap it and read the full address. Real Amazon pages live at amazon.com (or amazon.co.uk, amazon.de, amazon.fr) — not ".shop" or ".top".
Mind the extension. Legitimate stores overwhelmingly use familiar endings: .com, .co.uk, .de, .fr, .nl. Cheap, loosely regulated extensions like .xyz, .top or .shop are favorite territory for disposable scam storefronts. An unusual extension isn't proof of fraud — but it's a reason to keep checking.
Don't trust the padlock. The FTC is explicit: HTTPS (the padlock icon) only means the connection is encrypted. Scammers can encrypt their websites too. A padlock proves nothing about who's behind the site.
2. Follow the money: how they want you to pay
Payment methods are where scam stores reveal themselves most honestly — because their survival depends on getting money you can't take back.
Green flags: credit cards and PayPal. Credit cards offer the strongest fraud protection — you can dispute a charge for goods that never arrived. PayPal's Goods & Services payments come with buyer protection and a straightforward dispute process. In Europe, normal local methods are equally fine: SEPA bank transfer within the EU, iDEAL in the Netherlands, Klarna or other regulated buy-now-pay-later options.
Red flags — walk away if a store: pushes wire transfers, Zelle, Venmo, Cash App, cryptocurrency, or gift cards as the only payment options; refuses mainstream credit cards entirely; offers an extra discount if you pay through a "special" link or outside the normal checkout.
Scammers steer you away from protected payments for a reason: wire transfers and crypto are effectively irreversible. If a European store asks you to pay in Bitcoin or via an untraceable money transfer for a €200 jacket, that alone is your answer.
3. Verify the business behind the storefront
A real business leaves a paper trail. A fake one hides behind a contact form.
Check for the basics first: a physical street address (not just a city name), a working phone number, and a customer-service email on a real domain — not a generic Gmail address. Then verify them:
United States: search the business name plus "reviews" or "complaints". The FTC recommends checking multiple independent sources rather than trusting one set of ratings.
United Kingdom: check Companies House — but remember it's only one data point, because fraudsters can register companies too. Cross-check the address on Google Maps and Street View.
Germany: look for an Impressum (legally required) and verify it in the Handelsregister.
Netherlands: check the KVK (Chamber of Commerce) register.
France: look up the SIREN/SIRET number in the national company register.
Anywhere in the EU: if the store shows a VAT number, validate it through the EU's VIES database.
No address, no phone, no registration number, no way to find a human — a store with none of these is asking you to trust it blindly. Don't.
4. Hunt for independent reviews — then read them skeptically
Type the store's name into Google alongside "reviews", "complaints" or "scam" and see what the wider web says. Look beyond the store's own website: Trustpilot, Google reviews, Sitejabber, and in Europe platforms like Trusted Shops carry independent customer history that a scam site can't control.
But read what you find with the same critical eye you'd use on a product page:
A wall of five-star praise with no specifics is a red flag, not reassurance — it may be bought or AI-generated.
Identical wording posted on the same day signals a manufactured campaign, not real customers.
One complaint about a late parcel is very different from page after page of "never received my order", "fake tracking number", or "refund never arrived". Patterns beat anecdotes.
No reviews at all on a store claiming years of happy customers is itself evidence.
And if the store's own site shows product reviews, sort from worst to best. The one- and two-star reviews are where real problems surface — and where fakes are hardest to hide.
5. Do the price reality check
Impossible prices are the bait. If a popular item — a Dyson vacuum, an iPad, a Lego set — is 40–70% cheaper than everywhere else and only on this one site, assume it's fake, refurbished, or never arriving.
Real Black Friday deals are aggressive, but they aren't 50% below every other seller. Before you buy:
Compare the price across the big marketplaces: amazon.com in the US; amazon.co.uk, amazon.de, amazon.fr in Europe; plus the brand's own official store.
Check whether the "discount" exists on the brand's official website or social media. Major brands announce real sales publicly — a flash sale visible nowhere else is almost certainly invented.
Be extra suspicious of prices in the wrong currency for the store's claimed location, or of totals that shift mysteriously at checkout.
A €49 "80% off" price tag on a €300 product isn't a deal. It's the hook.
6. Watch for pressure tactics and fake urgency
Countdown timers screaming "sale ends in 10 minutes!", "Only 2 left in stock!" banners, pop-ups offering a mystery discount if you don't leave — these are designed to do one thing: stop you thinking.
Legitimate stores don't rely on fabricated urgency to make a sale. When you feel rushed, slow down deliberately and ask: would this offer still make sense tomorrow? If the store needs you to decide in 90 seconds, it doesn't want you to decide at all — it wants you to not check.
Also be wary of how you arrived. If you reached the store through an unsolicited email, text message, or social media ad, don't use their link. Navigate to the retailer yourself, or verify the promotion on the brand's official channels first. Phishing emails spoofing shipping notifications and "exclusive deals" spike every holiday season, and QR codes in unexpected messages are a growing delivery method for scam links.
7. Reality-check the social proof and contact details
Scam stores decorate themselves with trust signals that collapse on inspection. Spend two minutes testing them:
Social media icons that lead nowhere, to empty profiles, or to accounts with a handful of followers and no real engagement.
A contact page with only a form and a vague Gmail address — no phone, no address, no named humans.
Privacy policies and terms that read like copied boilerplate, or are missing entirely.
Product photos that reverse-image-search straight back to other retailers' listings.
Zero press coverage or mentions anywhere reputable — real brands leave traces across the web.
None of these alone proves a store is fraudulent. Together, they paint the picture: a storefront assembled for speed, not for service.
8. Already ordered from a suspicious store? Act fast
If the order is already placed, move quickly — recovery depends on speed and on how you paid:
Screenshot everything: the product page, your order confirmation, the payment receipt, and all correspondence.
Contact your bank or card issuer and report potential fraud — request a chargeback for goods not received. Credit cards give you the best odds; act within the dispute window (typically 60–120 days).
If you paid via PayPal, open a dispute in the Resolution Center immediately.
Report the site: in the US to the FTC at reportfraud.ftc.gov; in the UK to Action Fraud; in the EU to your national consumer authority or the European Consumer Centre network (ECC-Net) for cross-border purchases.
Monitor your accounts for unauthorized charges, and change any password you reused on the site.
Wire transfers and crypto payments are nearly impossible to recover — which is exactly why the payment check in section 2 matters so much.
"Is this website legit?" never has a yes-or-no answer from a single signal — but five minutes of checks usually makes the answer obvious. Read the domain, follow the money, verify the business, hunt for independent reviews, reality-check the price, ignore the pressure, test the trust signals. And when the evidence is thin or contradictory, the safest move is the simplest one: don't buy until you can verify it.
Before your next purchase, run the unfamiliar store through our website scam checker — and paste any product link into our fake review checker to see whether the reviews behind the stars actually hold up. The law is catching up with online fraud, but a careful shopper was always the best defense.
Explore the evidence behind your next question.
Start a website check