How to Tell If a Website Is Safe to Buy From

Last updated: November 5, 2026 · Advice checked against FTC, CFPB, BBB, Google, and ICANN pages (sources at the bottom)

We may earn a commission if you buy through links here — it never changes our picks.

The usual setup goes like this. An ad shows you a product you want, at a price better than anywhere else, from a store you have never heard of. The site looks professional. There is a padlock in the address bar. Everything feels fine, right up until the package never arrives, or a cheap knockoff shows up instead, and the store's help page leads nowhere.

Fake stores are not rare, and they are not sloppy anymore. They copy real brands' photos and logos, buy ads on the platforms you already use, and look polished enough to fool careful people. The good news: they almost always fail a handful of simple checks. Together the checks below take a few minutes, and they work whether you are buying a jacket for yourself or supplies and software for your business.

Before you start

What you need

About five minutes and a second browser tab. Every check here happens in search results and free lookup tools, not on the store's own pages.
The product's normal price. Look up what known retailers charge for the same item first, including shipping. You cannot spot a too-good price until you know the real one.
A willingness to walk away. The checks only protect you if a failed check actually stops the purchase.

First, the padlock: what it does and does not prove

Most people have been taught to look for the padlock, so let us be precise about it. The padlock, and the https at the start of the address, mean the connection between your browser and the website is encrypted. Encryption scrambles what you send, like your card number, so nobody sitting between you and the site can read it in transit. That matters, and you should never type payment details into a page without it.

Here is what it does not mean. It says nothing about who runs the site or whether they intend to ship you anything. The FTC puts it bluntly: the "s" in https means the site is encrypted, but it does not mean the site is legitimate, because scammers know how to encrypt their sites too. A fake store can have a perfectly good padlock. Your card number travels safely all the way to the thief. Treat https as the floor, not the verdict.

Check 1: Read the address like a proofreader

The cheapest trick in this business is the lookalike address. Scammers register a domain that resembles a real brand's address with a small change: an extra word, a swapped or doubled letter, a different ending. This is called typosquatting, and it works because your eye reads the shape of a familiar name instead of the letters. The ad's link does the navigating for you, so you never really look.

Do not shop from the ad's link. The FTC warns that scammers impersonate real companies in ads on Facebook, TikTok, and other platforms. If an ad interests you, close it, then find the store yourself by typing the address or searching for the company's official site.
Compare the address letter by letter with the brand's real one. Extra words like "outlet," "deals," or "official" added to a brand name, or an ending the brand does not actually use, are classic tells.
Be extra careful on a phone. Small screens cut addresses off, hiding exactly the part that gives the trick away. If you cannot see the whole address, do not check out there.

Check 2: Search the name plus "scam," then read reviews off the site

A store's own pages will always say it is wonderful. Other people's experience lives elsewhere, and the FTC's core advice for unfamiliar sellers is to go find it: search online for the company or product name plus the words "complaint" or "scam," and see what comes back.

Read reviews in several places. The FTC advises reading reviews across a variety of review sites, search engines, and social platforms, and considering who wrote each one. A pattern of "paid and never received it" reports is the answer you need.
Do not trust star ratings alone. The FTC is explicit that some reviews and ratings are fake or misleading, in both directions. Five perfect stars on the store's own site, with no presence anywhere else, is a warning sign, not a comfort.
Check the BBB. Look the business up on the Better Business Bureau's site for a profile and complaint history, and search its name or web address in BBB Scam Tracker, the BBB's free database of consumer-reported scams. No results does not prove honesty, but a stack of reports settles the question the other way.
Discount the testimonials on the store itself. A scammer can type any quote and any name. Reviews only count when the store cannot control them.

Check 3: Look up how old the store's address is

Fake stores are disposable. A scammer registers a fresh domain, runs ads for a few weeks, and abandons it when complaints pile up. A domain's registration record is public, and you can read it in under a minute with the free lookup tool from ICANN, the nonprofit that coordinates the internet's address system.

Open ICANN's lookup tool

Go to lookup.icann.org, ICANN's registration data lookup, and type in the store's domain, just the name part, like example.com, without the https or www.

Find the creation date

In the results, look at the Dates section for the date the registration was created. If a store claims years of happy customers but its address was created three weeks ago, the claim and the record do not match, and the record is the one telling the truth. Age alone does not prove honesty. Plenty of real businesses are new. But a very young domain under a store presenting itself as established is a serious mismatch, and it pairs badly with any other failed check.

Check 4: Run the address through Google's safety check

Google maintains a service called Safe Browsing, which examines billions of web addresses looking for sites that carry malware or run phishing pages, and powers the red warning screens browsers show. You can ask it about a specific store at Google's Transparency Report site status tool: paste the address and it tells you whether Google currently finds unsafe content there.

Use it, but know its limit. This check answers "is this page dangerous to visit," not "will this seller ship my order." A fake store that takes money and sends nothing may come back clean, because its pages are not infected with anything. A bad result ends the shopping trip on the spot. A clean result just lets you move on.

Check 5: Find the actual business behind the site

A real store is a real business, and a real business can be reached. Look for a contact page with a physical address, a working phone number, and an email address. Then weigh what you find:

A street address you can sanity-check. Search the address. If it is a vacant lot, a mailbox rental shop, or some unrelated company's headquarters, you have learned something. No address at all, only a contact form, is worse.
A phone number that reaches a person. You do not have to call before every purchase, but a store with no number is telling you what support will look like when your order goes missing.
An About page with specifics. Real businesses say where they are and how long they have been around, in terms you could verify. Vague lines about "a passionate global team," with no names and no place, are filler, and filler is cheap to copy.

None of this proves a store is good, and plenty of honest one-person shops run lean. But a store that hides every route to a human being has removed your only remedy when something goes wrong.

Check 6: Read the shipping and returns terms before you pay

Honest sellers write their terms down, because the law expects them to. The FTC's rule: a seller must ship by the time it promised in its ads, and if it promised no time at all, within 30 days of getting your order and payment. Before you buy, find the shipping page and return policy and read them like a contract, because that is what they are.

Can you return the item for a full refund? The site should say so plainly. "All sales final" on ordinary merchandise from an unknown store is a reason to stop.
Who pays for return shipping? The FTC lists this as a question to answer before buying. Scam stores that do ship something often count on return shipping to a distant address costing more than the item, so the policy exists on paper only.
How many days do you have, and is there a restocking fee? Short windows and steep fees turn a refund into a partial one. Check whether sale items follow different rules, because sellers often carve those out.
Is there a policy at all? No shipping page, no returns page, and no delivery time frame is a failing grade on its own. A store that will not state its terms before the sale will not honor them after it.

Check 7: Interrogate the price

The bait in nearly every fake-store ad is the price, and the FTC names unusually low prices as a sign of a scam. A discount is normal. A designer item, a power tool, or a software suite at a small fraction of what every other seller charges is not a discount strategy, it is a lure.

Compare the total, not the headline. Price the same item, by model number, at sellers you already know, and include shipping and fees on both sides. Fake stores sometimes pad the difference back in with absurd shipping charges.
Read the fine print for condition words. The FTC flags words like "refurbished," "vintage," and "close-out" as signs the item may be in less-than-perfect condition, and warns that expensive brand-name items offered at bargain prices could be counterfeit or stolen.
Check the brand's own site. If a store claims a factory outlet sale or a clearance from a known brand, the brand's real website is where that sale would be announced. If the brand has never heard of this store, neither should your wallet.

Pay the safe way: the payment method is the last line of defense

Even a careful shopper gets fooled sometimes, which is why how you pay matters as much as the checks above. One word covers the difference. A chargeback is a reversal of a card payment: you dispute the charge with the company that issued your card, and the money is pulled back from the seller while the dispute is investigated. The FTC's guidance is direct. Paying by credit card best protects you and your money in case of a scam or if something else goes wrong.

Credit card: the safest way to pay online. If you are charged twice, billed for something that never arrived, or sent the wrong or a defective item, federal law gives you the right to dispute the charge. That right lives in the Fair Credit Billing Act, and it has one deadline worth memorizing: your dispute letter must reach the card company within 60 days of the day it mailed the first bill showing the error. Call right away, and put it in writing too, because the written notice is what the law's clock runs on. While the company investigates, it cannot try to collect the disputed amount or report you as delinquent on it. Federal law also caps your liability for unauthorized use of your card at $50.
Debit card: weaker ground. A debit payment takes money straight out of your bank account, so a bad purchase means your own cash is gone while you sort it out. Debit cards carry some federal error-resolution rights, but the practical position is worse than credit in exactly the situation you are trying to avoid. For a business, the same logic says to put supply and software orders on a credit card, never the card tied to the operating account.
Wire transfers, gift cards, payment apps, and cryptocurrency: treat a demand for these as the answer. The FTC's rule for online sellers is absolute. Never buy anything from a seller that insists you can only pay with gift cards, wire transfers through companies like Western Union or MoneyGram, a payment app, or cryptocurrency. Scammers insist on these methods because the money is hard or impossible to get back; the FTC compares sending money that way to sending cash. A legitimate store may offer these options alongside cards. A store that refuses cards and demands one of these instead has told you what it is.

One habit ties this to the rest of your security setup: use a unique password for every store account, stored in a password manager, so one store's leaked database cannot become a skeleton key to your email and banking. Our password manager setup guide walks through it, and safe buying is one of the habits in the 7-step small business security checklist.

If you already paid a store that turned out to be fake

Act quickly, and work this list in order. Speed matters more than perfection.

Try the seller once, in writing

Email the seller, state the problem and what you want (the item, or a refund), and keep the message and any reply. The FTC's first step for purchase problems is to try to work it out with the seller. With a fake store this usually goes nowhere, and that silence becomes part of your dispute record.

Dispute the charge with your card company

If you paid by credit card, call the number on the back of the card, explain that the merchandise never arrived (or was not what you ordered), and ask to dispute the charge. Then follow up with the written notice described above, so it reaches the company inside the 60-day window. Keep the FTC's records list ready: the company name and website, what you ordered and when, what you paid, the shipping promise and return policy, all your communications, and the statement showing the charge.

If you paid another way, contact that company immediately

For a wire transfer, gift card, payment app, or cryptocurrency payment, contact the company behind the payment right away, tell them it was a scam, and ask whether the transaction can be stopped or reversed. Keep the gift card and its receipt if that is how you paid. The FTC's honest framing: the money might be gone already, but it is always worth asking, and asking fast improves your chances.

Report it

Tell the FTC at ReportFraud.ftc.gov. Reports feed the FTC's fraud database and help build cases, and you can also add the store to BBB Scam Tracker so the next shopper's search finds your warning. For a store that took money and vanished, the FBI's Internet Crime Complaint Center at ic3.gov is the law-enforcement route. If you gave personal details beyond payment, like a Social Security number, say so in your reports and treat it as possible identity theft.

Common mistakes

Trusting the padlock. It proves the connection is encrypted. It says nothing about whether the seller is honest.
Shopping from the ad. The link takes you where the advertiser wants, which may be a copycat address. Navigate to the store yourself.
Reading only the store's own reviews. Testimonials the seller controls are advertising. The experiences that matter are on sites the seller cannot edit.
Skipping the returns page until you need it. After the purchase, the policy you did not read is the only one you get.
Paying by debit to "keep it simple." Simple is a credit card and a dispute right. Debit puts your actual cash in the middle of the fight.
Assuming a small purchase is a safe test. A test order still hands over your card number, address, and phone number.

The whole job, as a checklist

Summary

The padlock means your connection is encrypted, not that the store is real. Scammers have padlocks too.
Read the address letter by letter, and get there yourself instead of through the ad's link.
Search the store's name plus "scam" or "complaint," read reviews on sites the store does not control, and check the BBB and BBB Scam Tracker.
Look up the domain's creation date at lookup.icann.org. A store claiming history on a three-week-old address is lying about one of them.
Run the address through Google's Safe Browsing site status. A dangerous result ends it; a clean one only covers malware and phishing, not honesty.
Find a real address, a reachable phone, and written shipping and returns terms. Know who pays for returns before you pay for anything.
Compare the price against known sellers. A brand-name item at a fraction of the going price is bait.
Pay by credit card, and remember the 60-day written dispute window. Never buy from a seller that insists on gift cards, wire, a payment app, or crypto only.
Already paid? Try the seller once in writing, dispute fast, contact the payment company if you paid another way, and report it at ReportFraud.ftc.gov.

Where this advice comes from

The checks, payment guidance, and recovery steps in this guide were checked against the official consumer pages below in November 2026. Tools and policies change. If a page on your screen differs slightly, the same check usually lives in the same place under a near-identical name.