Quick answer: Before entering card details, check that the URL starts with HTTPS and shows a padlock, look for a real physical address and contact details, search the site’s name alongside “reviews” or “scam,” and run the URL through Google’s Safe Browsing checker if you are still unsure. This takes under two minutes and catches the vast majority of unsafe sites.
Handing over your card details to a website you have never used before always carries a small pause of doubt, and that instinct is worth trusting. In 2026, AI-generated phishing sites and convincing fake storefronts have made unsafe sites harder to spot by eye alone, so a quick, repeatable checklist matters more than it used to.
Check for HTTPS and the Padlock, But Know What It Actually Proves
Look at your browser’s address bar. A safe connection starts with https:// rather than http://, and most browsers show a small padlock icon next to it. This confirms the connection between your browser and the site is encrypted, meaning your data cannot be easily intercepted while it travels.
Here is the important nuance most guides skip: HTTPS confirms the connection is encrypted, not that the website itself is trustworthy. Scam sites can and do use HTTPS, since free encryption certificates are widely available to anyone. Treat the padlock as a minimum requirement, not proof of legitimacy on its own.
Check the Domain Name Carefully
Scammers frequently register domains that closely resemble a well-known brand, using a slight misspelling, an added hyphen, or a different ending, such as .shop or .xyz instead of .com. Read the full domain slowly before trusting it, particularly if you arrived at the site through a link in an email, an advert, or a social media post rather than typing it in yourself or using a bookmark.
Run a Free Safety Check on the URL
If you are still unsure after a visual check, paste the URL into Google’s Safe Browsing site status checker at Google’s Transparency Report. This cross-references the site against a database of known phishing and malware pages and takes about ten seconds. It will not catch a brand-new scam site that has not been reported yet, but it catches a significant share of known threats instantly.
Look for Real Contact Information
Scroll to the footer of the website and look for an “About Us,” “Contact,” or “Customer Service” section. Legitimate businesses generally provide a real physical address, a working phone number, and clear return or refund policies. Scam sites frequently skip this entirely, or provide a contact form with no other verifiable detail behind it.
Search the Site’s Name Alongside “Reviews” or “Scam”
Before entering payment details on an unfamiliar site, search the company name together with “reviews,” “scam,” or “Reddit.” Genuine scam sites are frequently called out publicly by people who have already lost money, and this single search often surfaces warnings faster than any technical check. Read both the negative and the overly positive reviews with a critical eye, since some scam sites pad their own review sections with fake five-star ratings that repeat the same vague phrases.
Check Domain Registration for Red Flags
For a deeper check, tools like a WHOIS lookup show when a domain was registered and, when available, who registered it. A domain registered only a few weeks or months ago, paired with an online store claiming to be an established business, is a meaningful warning sign. Established, legitimate retailers rarely operate from a domain that is brand new.
Trust Your Browser’s Own Warnings
If your browser itself shows a security warning before you even reach the checkout page, take it seriously. Do not click through the warning out of curiosity or convenience. Close the tab and find the product or service elsewhere. Built-in browser protections catch a large share of dangerous sites automatically, and overriding that warning removes a layer of protection that exists specifically for this situation.
A Quick Two-Minute Checklist
- Check the URL for HTTPS and a padlock icon.
- Read the domain name carefully for misspellings or unusual endings.
- Search “[site name] reviews” or “scam” before entering payment details.
- Scroll to the footer for a real contact address and clear policies.
- Run the URL through Google’s Safe Browsing checker if anything still feels uncertain.
If You Already Entered Your Card Details on a Suspicious Site
Act quickly, in this order:
- Contact your card issuer immediately to flag the transaction and, if needed, request a replacement card.
- Set up real-time transaction alerts through your card issuer’s app if you have not already, so any further unauthorised charges reach you instantly.
- Change any passwords you entered on the site, particularly if you reused that password anywhere else.
- Check whether your email has been compromised using a service like Have I Been Pwned if you also entered login credentials.
- Report the site to Google’s Safe Browsing report tool, so it gets flagged for other visitors before they make the same mistake.
Common Questions
Does HTTPS mean a website is definitely safe?
No. HTTPS confirms the connection between you and the site is encrypted, but scam sites can and do use HTTPS too. Treat it as one signal among several, not proof of legitimacy on its own.
What should I do if I think I entered my card details on a fake website?
Contact your card issuer immediately to flag the transaction, change any passwords used on the site, and report the URL to Google’s Safe Browsing tool so others are warned.
Is a brand-new website automatically unsafe?
Not automatically, but a very recently registered domain combined with claims of being an established business is a genuine warning sign worth checking further before entering payment details.
What is the fastest single check I can do?
Searching the site’s name alongside “reviews” or “scam” often surfaces real warnings from other people faster than any technical check, and takes only a few seconds.
Are fake reviews on a website’s own site a reliable way to judge trust?
No. Some scam sites include fake five-star reviews on their own pages. Check independent review sources and forums rather than relying on testimonials shown on the site itself.
The Bottom Line
No single check guarantees a website is safe, but combining a handful of quick habits, checking HTTPS, reading the domain carefully, searching for independent reviews, and trusting your browser’s own warnings, catches the vast majority of unsafe sites before you ever reach checkout. The whole process takes under two minutes and is worth doing every time you are about to enter card details on a site you have not used before.