Short answer: A fake website usually shows several of ten repeatable warning signs at once: a mismatched or freshly registered domain, no reachable business address, no HTTPS or a broken certificate, pushy urgency messages, prices that are wildly below market, only irreversible payment methods, an empty or copied About page, stolen product photos, fake reviews with copy-pasted wording, and zero real footprint outside the site itself. If you see three or more of these on one page, treat it as fake until proven otherwise.
This guide gives you a fast, opinionated checklist you can run in under two minutes. It is written for shoppers, not for security researchers, and every sign comes with a concrete step you can actually take from a phone or a laptop. For the deeper how-to on running each check, see our companion posts on 12 warning signs a site is a scam and how to check if a website is safe before you click.
Why fake websites are a growing risk in 2026
Three data points frame the size of the problem. First, the FBI Internet Crime Complaint Center recorded more than 850,000 complaints in its most recent annual report, with reported losses above 16 billion US dollars, and non-payment or non-delivery from suspect shopping sites remains one of the top categories. Second, Google Safe Browsing continues to flag millions of unsafe sites at any given time, most of them phishing pages rather than classic malware. Third, independent researchers regularly find that a majority of scam shopping domains are less than 90 days old at the moment a victim lands on them. Fake sites are cheap to spin up and cheap to abandon, which is exactly why a fast checklist is worth more than any single tool.
The 10 signs, with a fast check for each
1. The domain does not match the brand
Legitimate brands almost always own their exact name at a common top-level domain such as .com or their country domain. Scam clones use small variations: extra hyphens, added words like -outlet or -official, swapped letters (rn instead of m, 0 instead of o), or a totally different top-level domain such as .shop or .top. Fast check: type the brand name directly into a trusted directory like webwiki.com or into a major search engine and compare the result with the URL you are on. If they do not match character for character, close the tab.
2. The domain is brand new
Most real shops have been online for years. A domain registered a few weeks ago that already claims to be a “trusted global brand” is a strong signal. Fast check: open a free WHOIS lookup and read the creation date. If it is younger than the offer it is running (for example a Black Friday page on a domain born in October), that is a red flag.
3. There is no reachable business behind the site
A real shop lists a company name, a physical address, a phone number and a customer service email that actually answer. Fake sites either leave the About page blank, fill it with generic filler text, or paste a random address that resolves to a residential home or a P.O. box in another country. Fast check: copy the address into a map service and see whether a company sign is actually there. Copy a phone number into a search engine and see whether it appears on other unrelated sites.
4. HTTPS is missing, misconfigured, or the certificate looks off
HTTPS is now the baseline. Any checkout page without the padlock is disqualifying. But the padlock alone is not proof of trust: click it and check that the certificate is issued to the correct company or domain, not to a random Cloudflare or hosting default. Fast check: click the padlock, view the certificate details, and confirm the issued-to field matches the brand you expect.
5. The site pushes urgency in an aggressive way
Countdown timers that reset when you refresh, “only 2 left in stock” banners that stay on every product, or pop-ups shouting that your cart expires in 90 seconds are classic conversion pressure on scam pages. Real brands use urgency too, but sparingly and without contradiction. Fast check: refresh the page twice and watch the timer. If it resets to the same number, the scarcity is fake.
6. Prices are too good to be true
A designer bag at 80 percent off, a next-gen console at half retail, or premium electronics at 20 dollars are not deals, they are bait. Fast check: pick the exact model number and look it up on the manufacturer site or on a well-known marketplace. If the site you are on is more than 40 percent below every legitimate seller for the same SKU, you are almost certainly looking at a fake shop.
7. The only payment methods offered are irreversible
If a checkout only accepts bank transfer, cryptocurrency, gift cards, or “wire to this person by name”, the site is telling you it does not want to face a chargeback. Real shops accept major credit cards, PayPal, or established buy-now-pay-later providers, all of which offer buyer protection. Fast check: open the payment step without entering card details and read what is actually accepted.
8. Product photos are stolen and low resolution
Fake shops rarely photograph their own products. They copy images from the manufacturer, from Amazon, or from stock libraries, and they often re-compress them so the quality drops. Fast check: right-click a product image, save it, and drop it into a reverse image search. If the same photo appears on ten unrelated shops under different brand names, the site is a dropshipping clone or a fake.
9. The reviews look copied, generic, or dated in bursts
Trust signals on scam sites often look wrong: five-star reviews with no product-specific detail, dozens of reviews posted within the same 48-hour window, avatars that are AI-generated portraits, or a Trustpilot widget that is actually just a picture. Fast check: click the review widget. If it does not open Trustpilot or another real review platform in a new tab, it is a static image, not a real rating.
10. The site has no real footprint anywhere else
A legitimate business leaves traces: press mentions, social profiles with real followers, an entry in a public web directory, customer discussions on Reddit or forums, an app store listing that predates the current campaign. A scam site is usually invisible outside its own domain. Fast check: search the exact brand name plus the word review or scam and read the first two pages of results before you buy.
A two-minute workflow that combines all ten signs
You do not need to run every check on every purchase. This is the fastest sensible workflow. Start with the URL bar: confirm the domain matches the brand and the padlock certificate names the right company. Open a new tab and search the brand name plus review; scan the first five results for warnings. Open the About or Imprint page and confirm a real address, a real company name, and a real phone number. Look at the checkout: confirm at least one buyer-protected payment method (card or PayPal). Only then enter any data. If any single step feels off, stop. For a more structured version of this same workflow, see our full guide on how to tell if a website is trustworthy and the broader overview of the most common online scams in 2026.
What to do if you already used a fake site
If you paid by credit card, contact your bank the same day and request a chargeback under fraudulent-merchant grounds. If you paid by PayPal, open a dispute inside the resolution center within 180 days of payment. If you used a debit card, ask the bank about its own dispute rules, which are usually less generous but still exist. Report the site to your national consumer authority, to Google Safe Browsing, and to a public directory like webwiki.com so future shoppers see the warning. For a worked example of applying every one of these signs to a specific well-known brand, see our detailed 2026 review of whether Shein is legit. Change any password you reused between the fake shop and your other accounts, and monitor your card statement daily for the next 30 days.
Frequently asked questions
Does the padlock mean a site is safe?
No. The padlock only means the connection between your browser and the server is encrypted. Any site can obtain a free SSL certificate. It says nothing about who owns the business or whether they intend to deliver your order.
Is a site with a .shop or .top domain always fake?
No, but the base rate of scam use on those extensions is much higher than on .com or major country domains. Treat them as needing extra checks, not as automatic rejections.
Can I trust the reviews inside the shop itself?
Only if the widget links out to an independent platform such as Trustpilot, Trusted Shops, or Google Reviews and you can verify the rating there. On-site testimonials with no external source are worth zero.
Is it safer to shop only on big marketplaces?
Big marketplaces reduce many risks because they hold the payment and offer their own dispute process, but they are not immune to counterfeit sellers or listing hijacks. The ten signs above still apply to individual seller profiles inside a marketplace.
What is the single fastest test I can run right now?
Copy the domain and paste it into a public web directory like webwiki.com. If the site has no meaningful profile, no reviews, no traffic estimate, and no age, that combination alone is enough to walk away for anything above a very small purchase.
Sources and further reading
- FBI Internet Crime Complaint Center, Annual Internet Crime Report, most recent edition
- Google Transparency Report, Safe Browsing site-status dashboard
- Anti-Phishing Working Group, quarterly phishing activity trends report
- Federal Trade Commission consumer advisories on fake online stores
- Related on this site: How to Tell If a Website Is Trustworthy, The Most Common Online Scams in 2026, How to Check If a Website Is Safe Before You Click, How to Check If a Website Is a Scam: 12 Warning Signs, Is Shein Legit? Full Review, Ratings and Safety Check (2026)
Read next: Is Shein Legit? Full Review, Ratings and Safety Check (2026). A closer look at is shein legit.