How to tell if a website is safe before you use it
A bargain on a phone that is 70 per cent off, an email saying your bank account will be blocked, a link forwarded in a family group: all of these lead to websites that may be built to steal money or passwords. Fake sites can look surprisingly polished, but they leave clues. Learn to read these clues and you will avoid most online traps.
Read the address carefully
The web address, or URL, is the first and most reliable clue. Look at the part just before the first single slash, the domain.
- Spelling tricks: scammers register lookalike names such as "amaz0n" with a zero, "paytmm", or "sbi-online-secure.com". If it is not exactly the real name, leave.
- Extra words: a real bank's domain does not usually carry odd additions such as "login-verify" or "offer-2024". Check the spelling of the main name, not the decoration around it.
- Subdomain traps: in "hdfc.secure-login.example.com" the real domain is "example.com", not hdfc. The domain is the section right before the last dot and ending.
- Odd endings: unfamiliar endings like .xyz, .top or .click are not always bad but are common on short-lived scam sites. Indian government sites normally end in .gov.in or .nic.in.
Rather than clicking a link in a message, type the site's name into your browser yourself or use a bookmark you made earlier.
Understand what the padlock does and does not mean
A padlock icon and "https" mean the connection between you and the site is encrypted, so others cannot easily read what you send. That is useful, but it does not prove the site is honest. Scammers can easily get HTTPS certificates for free. Treat missing HTTPS as a red flag, especially on pages asking for passwords or card details, but never treat the padlock alone as proof of safety.
Check who is behind the site
Legitimate businesses make it easy to find them. Look for:
- A real About page with a company name and history.
- A physical address, a working phone number and an email on a matching domain, not only a free Gmail address.
- Clear terms, privacy policy, return and refund policy, written in coherent language.
- Business registration or GST details, for Indian shopping sites.
Search the business name along with words like "scam", "complaint" or "reviews". Look at several independent sources, such as consumer forums, app stores and social media, instead of only the testimonials printed on the site, which can be fake.
Spot the warning signs of a fake shop
| Red flag | Why it matters |
|---|---|
| Prices far below the market | Genuine branded goods are rarely 60 to 80 per cent off |
| Countdown timers and "only 2 left" pressure | Designed to rush you before you think |
| Poor grammar, stolen or blurry photos | Copied content from real stores |
| Only payment by bank transfer, UPI to a personal account or gift cards | Hard to reverse, and typical of fraud |
| No return policy or contact details | No one to hold accountable |
| Domain registered very recently | Many scam shops live only a few weeks |
You can check when a domain was registered with a free "WHOIS" or domain lookup tool. A shop claiming years of trading on a domain that is a few weeks old deserves suspicion.
Use free checking tools
- Google Safe Browsing transparency report: paste a URL to see whether it is flagged for malware or phishing.
- VirusTotal: scans a link against many security engines at once.
- Browser warnings: if Chrome, Edge or Safari shows a red warning page, believe it.
- Search results: if you reach a site through an ad, check whether the same address appears in regular results too. Fake ads often impersonate customer care numbers, so use the contact details printed on your bank card or official app instead.
Be careful with what a page asks for
Ask yourself whether the request fits the situation. A shopping site needs your delivery address and a payment, but not your Aadhaar or PAN number. A site giving you a "prize" should not ask for a fee. A government or bank site will not ask you to share an OTP, a PIN or a CVV with anyone. Pop-ups saying your phone is infected, or asking you to install an app, update software or call a number, are almost always scams.
Be wary of downloads too. Get apps only from the official stores, and be cautious with APK files sent on WhatsApp or Telegram. Free movie, cricket-stream and software sites are common carriers of malware and aggressive ads.
Pay in safer ways
- Use cash on delivery, a credit card or a trusted payment gateway for a site you are unsure about, instead of sending money straight to a personal account.
- Use cards with transaction limits, or a virtual card for online purchases, so the amount at risk is small.
- Keep screenshots of orders and receipts.
- Do not save card details on sites you rarely use.
Keep your own defences up
Keep your browser, phone and antivirus updated, use unique passwords with a password manager, and turn on two-factor authentication for important accounts. A browser extension that blocks ads can also cut down on malicious pop-ups.
If you have already been caught
Act fast. If you typed a password, change it right away on the real site and anywhere else you used it. If you shared card or bank details, call your bank immediately to block the card and report the transaction. Report cyber fraud at cybercrime.gov.in or call 1930 in India, as quick reports improve the chance of freezing money. Run a malware scan on your device if you downloaded anything.
Final thoughts
Check the address, do not trust the padlock alone, look for real company details and be suspicious of unbelievable deals or urgent demands. If a site feels off, it probably is. Closing the tab costs nothing, while a fake site can cost a great deal.







