You found the perfect deal — 70% off, free shipping, “only 3 left!” Your finger hovers over “Buy Now.” But something feels off. The site looks a little… janky. The URL is weird. Is this a steal or a scam?

Fake shopping sites are a billion-dollar criminal industry, and they’re getting frighteningly good — professional designs, fake reviews, even fake tracking numbers. Here’s how to tell if a website is safe to shop on before you hand over your card number.

The 60-Second Safety Check

Run through these before buying from any unfamiliar site:

1. Check the URL Carefully

  • HTTPS with a padlock: the bare minimum. No padlock = no purchase, ever. (Note: scammers can get HTTPS too — it’s necessary but not sufficient.)
  • Lookalike domains: amaz0n-deals.com, wal-mart.shop, applestore-official.net. Scammers register domains one letter off from real brands. Read the domain character by character.
  • Weird TLDs for US retailers: a “US store” on a .ru, .cn, or .top domain deserves extreme skepticism.
  • Hyphens and extra words: legitimate brands rarely use domains like “nike-official-clearance-store.com.”

2. Look for Real Contact Information

Legitimate businesses have a physical address, a phone number that works, and an email. Scroll to the footer and the Contact page. Red flags: no address at all, only a contact form, a Gmail address as “customer service,” or an address that Google Maps shows as an empty lot.

3. Read the Reviews — Off the Site

On-site reviews are worthless — scammers write their own. Instead:

  • Google “[sitename] reviews” and “[sitename] scam”
  • Check Trustpilot, Sitejabber, and the BBB
  • A brand-new site with zero external presence selling hot products at deep discounts is the classic pattern
  • Check the domain age at whois.domaintools.com — a “trusted retailer since 2010” on a domain registered last month is lying

4. Sanity-Check the Prices

If everyone’s selling it for $200 and this site has it for $49, it’s not a deal — it’s bait. Scammers use impossible prices because they work. The “discount” is how they get you to skip the safety checks. Real sales are 20–40% off; 70–90% off on current products is a scam indicator.

5. Check the Payment Options

  • Safe: credit cards, PayPal (goods & services), Apple Pay — all offer fraud protection and chargebacks.
  • Danger: wire transfer, gift cards, cryptocurrency, Zelle/CashApp to strangers — no recourse if it’s a scam. Any site that only accepts these is a scam. Full stop.

Red Flags That Scream “Scam”

  • Countdown timers and “only 2 left!” on every product (manufactured urgency)
  • Stolen product photos (reverse-image-search them on Google — if the same photos appear on ten sites, run)
  • No social media presence, or social accounts created last week with bot followers
  • Copy-pasted “About Us” text found on other sites (Google a distinctive sentence)
  • Checkout in a different currency with no explanation
  • The site appeared in a Facebook/Instagram/TikTok ad — social media ads are the #1 delivery method for fake stores now
  • Spelling and grammar errors throughout (less common than it used to be, but still a tell)

Protect Yourself Even on Legit Sites

  • Use a credit card, not debit. Credit cards have strong federal fraud protections ($50 max liability, usually $0 in practice); debit pulls from your bank account directly and recovery is harder.
  • Consider virtual card numbers — many banks and Privacy.com generate single-use card numbers for online shopping. Even if the site is breached, the number is useless.
  • Never save your card on a site you’ll use once.
  • Watch for phishing after purchase — fake “delivery problem” texts are rampant. Our guide to stopping spam calls and texts covers the delivery-scam variants.

If You Already Ordered From a Scam Site

  1. Call your bank/card issuer immediately — report fraud and request a chargeback. The sooner, the better.
  2. Don’t “cancel” through the site — it’s fake; you’re just confirming you’re a live target.
  3. Monitor your card for additional charges; consider a replacement card number.
  4. Report it: reportfraud.ftc.gov and the FBI’s ic3.gov. It helps shut them down.
  5. Change passwords if you reused the site’s password anywhere — then set up two-factor authentication.

The FTC tracks online shopping fraud patterns and publishes what’s currently circulating — worth checking during holiday shopping season especially.

Frequently Asked Questions

Are Facebook and Instagram ads safe to buy from?
Sometimes — legitimate businesses advertise there too. But social media ads are also the #1 delivery method for fake stores, because scammers can target precisely and vanish quickly. Treat every social ad as guilty until proven innocent: run the 60-second checklist (URL inspection, external reviews, domain age, payment methods) before buying. The slicker the ad, the more carefully you should verify — scammers invest in good creative because it works.

What if the site has the padlock/HTTPS — doesn’t that mean it’s safe?
No — HTTPS only means the connection is encrypted, not that the business is legitimate. Scammers get free SSL certificates in minutes; the padlock is now universal, including on phishing sites. It’s a necessary condition (never buy without it), not a sufficient one. The checks that actually matter: domain age, real contact info, external reviews, sane prices, and protected payment options.

I paid with a debit card on a scam site. Can I get my money back?
Possibly, but it’s harder than with credit cards. Contact your bank immediately and dispute the charge — debit disputes fall under different (weaker) regulations than credit, and time matters enormously. The sooner you report, the better your odds. Going forward, use credit cards (or virtual card numbers) for all online shopping — the fraud protection difference is the reason credit exists as a consumer tool.

How do I check how old a website is?
Use a WHOIS lookup (whois.domaintools.com or who.is) — it shows the domain registration date. A “trusted retailer since 2015” on a domain registered three months ago is lying, full stop. Also check the Wayback Machine (web.archive.org) to see what the site looked like historically — scam sites often have no history or a history as something completely different. Two minutes of checking beats weeks of chargeback hassle.

The Bottom Line

Check the URL character by character, verify contact info and external reviews, sanity-check the price, and only pay with protected methods. The 60-second check feels paranoid until it saves you $150 and a stolen card number. When a deal triggers your gut feeling, listen to it — then verify with the checklist. Real deals survive scrutiny; scams don’t.