The ad found Claire at 9.40pm, somewhere between a cousin’s holiday photos and a dog video. A £599 rattan garden set for £59, “ending tonight”. Her thumb hovered over Buy. That pause is where this guide lives, because learning to check if a website is legit takes about a minute and can save you hundreds of pounds. UK shoppers lost £118.1 million to purchase scams in 2025 alone. Here are the exact checks, free tools and payment tricks that keep you off next year’s list.
Checking a Website at a Glance
| Free scam checker | Check a Website at getsafeonline.org — a trust score in seconds |
| Domain age lookup | who.is — a “shop since 2015” on a 3-week-old domain is lying |
| Company lookup | Companies House via GOV.UK — free address, directors and filings |
| The padlock | Proves the connection is encrypted, not that the seller is honest |
| Safest way to pay | Credit card — Section 75 covers single items over £100 up to £30,000 |
| Never do this | Pay an unfamiliar shop by bank transfer |
| Already scammed? | Your bank first, then Report Fraud on 0300 123 2040 |
A Deal Too Shiny to Scroll Past
Claire nearly tapped. Then she remembered her neighbour Sue, who paid £90 for patio chairs that never existed. Price is the first check and the simplest: when a £599 set costs £59, somebody is lying. Fake shops use silly discounts and countdown timers because urgency switches off the careful part of your brain. The adverts themselves are the delivery van: Lloyds says 68% of the fraud reports it receives begin on a Meta-owned platform such as Facebook or Instagram, and its customers lose an estimated £66 million a year to scam ads there. Purchase scams made up 71% of all authorised fraud cases in 2025, according to UK Finance. We’ll pick apart every fake online shops warning sign separately; the checks below catch most in a minute.
Read the Web Address Like a Detective
Look at the address bar before anything else. Scammers register lookalike domains, and the National Cyber Security Centre’s own example says it all: “www.tescos-sales.com” is not Tesco. The safest habit is typing a shop’s address into the browser yourself rather than tapping an ad or a link, the same trick that defeats the fake Royal Mail delivery fee text. Next, age-check the domain at who.is: a boutique claiming “trusted since 2015” on a domain registered 3 weeks ago is finished as far as you’re concerned. A .co.uk ending proves nothing about where the business sits, either. For a second opinion, paste the address into Check a Website, the free Get Safe Online checker that scores sites using more than 40 data sources.
The Padlock Isn’t a Promise
Here’s the myth that catches careful people: the little padlock next to the address. Claire’s £59 garden site had one, and it meant almost nothing. A padlock, or https at the start of the address, shows the connection between you and the site is encrypted, so nobody can eavesdrop on what you type. It says nothing about who is reading at the other end. Certificates are cheap or free, and criminals fit them to fake shops because shoppers treat the symbol as approval. Which? warns the padlock isn’t foolproof, and Citizens Advice says the same. Use it one way only: no padlock means leave immediately, while a padlock means keep checking. If you’ve already typed details into a dodgy page, follow our steps for what to do if you clicked a scam link.
Look Up the Company Behind the Shop
Real UK shops leave a paper trail, and you can read it free in about a minute. Scroll to the site’s footer, find the company name or number, then search it on the official GOV.UK company information service, which shows the registered address, date of incorporation, directors and even insolvency records at no cost. No company details anywhere? Walk away. While you’re down in the footer, check for a real street address rather than a PO box, a contact page that offers more than a web form, and proper returns and complaints policies that explain how to send back a faulty item. Claire’s bargain site listed no company, no address and a Gmail contact. Sites like that deserve one thing, and later in this series we’ll show how to report a scam website to the NCSC.
Read Reviews Like a Sceptic
Reviews still matter, but read them the way a detective reads alibis. Search the shop’s name on Trustpilot, Google and Feefo rather than trusting the glowing quotes pasted on its own pages, and sort by most recent, because a business can change hands or change character. Be suspicious of a wall of 5-star praise with no complaints at all: Trustpilot itself says a total absence of critical reviews is a warning, and its research found people spot fakes from text alone with only 57% accuracy. Sudden spikes of gushing reviews in one month and accounts that have reviewed exactly one thing are the fake review red flags to memorise. Since 6 April 2025, writing or hosting fake reviews has been illegal under the DMCC Act, and the CMA can fine firms up to 10% of global turnover, yet plenty still slip through.
Pay Like You Expect Trouble
How you pay decides what happens if the parcel never comes. A credit card is the strongest option: under Section 75 of the Consumer Credit Act, the card company is equally responsible for any single item costing over £100 and up to £30,000, even if you only put the deposit on the card. Debit cards rely on chargeback instead, a scheme rule rather than a law, with 120 days from spotting the problem and no minimum spend. PayPal gives you 180 days to open a dispute and refunds the full price plus original postage when a claim succeeds. One rule sits above all, straight from the NCSC: never pay an unfamiliar shop by direct bank transfer. Transfers have far weaker cover, though you should still know your refund rights after a bank transfer scam.
Two Minutes That Can Kill a Scam Site
Suppose the site fails your checks. Close the tab, obviously, but don’t stop there, because reporting is how fake shops die. Paste the address into the scam website form on ncsc.gov.uk and the National Cyber Security Centre will investigate and push to have it taken down; the NCSC had removed 454,800 scam URLs by July 2026, most flagged by ordinary people. Dodgy emails and screenshots go to report@phishing.gov.uk, and if the “offer” arrived by text you can forward it free to 7726, exactly as we explain in how to report a scam text with 7726. Claire reported her garden furniture site on the train to work. Two weeks later the page was gone, which means somebody else’s £59 stayed in their account.
Already Paid? Move Fast
Maybe you’re reading this a day too late, with money gone and a tracking number that leads nowhere. Speed matters now. Phone your bank first, using 159 or the number on the back of your card, tell them exactly what you bought and how, and ask about reversing the payment through chargeback or Section 75. Then report the shop to Report Fraud, the national service that replaced Action Fraud in January 2026: online at reportfraud.police.uk any time, or on 0300 123 2040 between 8am and 8pm on weekdays. Scotland reports to Police Scotland on 101 instead. You’ll get a crime reference number your bank may ask for, and our guide to reporting a scam to Report Fraud walks through what happens next. Keep every email, ad and receipt as evidence.
The Sixty-Second Habit
Claire never bought the £59 rattan set, and the real winner was the minute she spent checking. That’s the honest secret of how to check if a website is legit: address, domain age, company record, reviews, then a payment method with a safety net. None of it needs technical skill, just the habit of pausing before you tap Buy. Run the checks on the next unfamiliar shop that tempts you this week, and the bargain that vanishes will be someone else’s story.
Frequently Asked Questions
How can I check if a website is legit before buying?
Check the domain’s age on who.is, look the company up free on GOV.UK, read recent Trustpilot reviews, and run the address through Get Safe Online’s Check a Website tool.
Is a padlock enough to trust a website?
No. It only shows the connection is encrypted. Scammers add certificates to fake shops easily, so a padlock proves nothing about who runs the site.
How do I find out how old a website is?
Type the address into a WHOIS lookup such as who.is. It shows the registration date; a brand-new domain behind a “long-established” shop is a classic scam sign.
Can I get my money back if I bought from a fake website?
Often, yes. Credit card purchases over £100 have Section 75 protection, debit cards offer chargeback within 120 days, and PayPal disputes stay open for 180 days. Contact your bank quickly.
Is it safe to buy from shops advertised on social media?
Be careful. Lloyds says 68% of its customers’ fraud reports start on Meta platforms. Research any advertised shop first and pay by credit card, never bank transfer.
Disclaimer: This article is general information, not financial or legal advice. If you have been scammed, contact your bank and the official services named above. Figures and contact details were correct as of September 2026.
2 thoughts on “How to Check If a Website Is Legit Before Buying”
Comments are closed.