How to Check if a Website Is Legit: 10 Checks That Actually Work

1. Look up the domain’s age with RDAP (the successor to WHOIS)

Since 28 January 2025, RDAP is the authoritative source of registration data for generic domains such as .com, .shop or .net, replacing the old WHOIS service, as ICANN announced. The free tool is ICANN Lookup.

1. 01Open ICANN Lookup and type the bare domain, for example amazon.com (no “https://” and no page path).
2. 02Read the registration date under the dates or events section. For amazon.com, the record we queried on 28 October 2026 shows registered 1 November 1994, registrar MarkMonitor Inc.
3. 03Look at the registrant. Large companies often keep their organisation visible: the registrar’s record for amazon.com names Amazon Technologies, Inc. Most small sites show “redacted for privacy”, which is normal and not a warning sign by itself.
4. 04Compare the date with the story. A shop claiming “20 years of experience” on a domain registered last month is lying about something.

Country-code domains (.fr, .co.uk, .de) are run by national registries with their own lookup pages, and their data may differ. A young domain is not proof of fraud: real businesses launch every day. It means the site has no history to vouch for it, so the other checks matter more.

2. Compare the address with the brand’s real domain

Impersonation is the most reported scam type: the FTC received more than 1 million reports of imposter scams in 2025, with more than $3.5 billion lost (FTC). On the web, it shows up as look-alike domains. Read the address letter by letter and watch for:

• An extra word around the brand: brand-outlet.com, brand-support-help.com, official-brand.shop.
• A swapped or doubled letter: rn instead of m, l instead of I, 0 instead of o.
• A real brand name followed by another domain: brand.com.account-check.net belongs to account-check.net, not to the brand.
• An unusual ending for a famous brand (.shop, .top, .online) when the brand normally uses .com or its country domain.

The safe habit is to reach a brand by typing its address or using its app, never through a link in an ad, a text or an email.

3. Find the legal notice or imprint

Look in the footer for “legal notice”, “imprint” (Impressum in Germany), “mentions légales” in France, or the terms of sale. In the EU, Article 5 of the e-Commerce Directive requires online service providers to show their name, geographic address, email and, where they are registered, their trade register number. A European shop with no legal notice is already breaking the rules.

Write down three things: the exact company name, the registration number and the country. A notice that names only a brand, gives a mailbox address or contradicts the terms page is a warning sign.

4. Look the company up in its country’s registry

Then confirm that the company exists, is active and matches the site. Each country has its own register:

There is no single national company register in the US: companies are formed in a state, so search the state named in the terms. EDGAR covers only companies that file with the SEC. A match is good news only if the details line up: same name, same address, active status, and a creation date consistent with the site’s claims.

5. Google Safe Browsing

Paste the address into Google’s Safe Browsing site status page. It tells you whether Google currently considers the site dangerous (phishing, malware or unwanted software). A flagged site should end the investigation.

6. Regulator warning lists (investment, trading and crypto sites)

Investment scams cause the largest losses: $7.9 billion reported to the FTC in 2025, and $8.6 billion in the FBI’s 2025 report. If a site offers trading, forex, crypto or “managed returns”, check the regulators:

• The FCA Warning List (UK) lists firms operating without permission. The FCA warns that a firm missing from the list may still be unauthorised, because scam firms often change names.
• The AMF blacklists (France) cover forex, binary options, crypto derivatives and impersonation; the AMF says they cannot be exhaustive.
• IOSCO’s I-SCAN gathers warnings from securities regulators worldwide in one search; members contribute them voluntarily, so it is not complete either.

Being absent from a warning list is not the same as being authorised. For the UK, confirm authorisation in the FCA register and compare the website listed there with the one you are on: clones copy the name of a real authorised firm. More on this case in checking investment platforms.

7. Reverse-search the team and product photos

Right-click a photo of the “founder” or “our team” and search it with Google Lens or TinEye. If the same face appears on a stock photo site or under another name, the team is invented. Product photos copied from a big brand’s catalogue are a sign the shop does not hold the stock. Faces with no earlier copy anywhere may be AI-generated: see how to spot a fake profile picture, or run the image through an AI image detector.

8. Search the name with “scam” and “complaint”

The FTC’s online shopping advice is to search the company or product name with “complaint” or “scam”. Read the pattern, not the stars: several people describing the same non-delivery, blocked withdrawal or impossible refund is a strong signal. Reviews on the site itself carry little weight; AI-generated reviews are cheap to produce.

Keep popularity in proportion. Any very large service attracts complaints; what matters is whether they describe a business that delivers late or one that never delivers at all.

9. Payment methods: the strongest single signal

The FTC lists the payment methods scammers insist on: cryptocurrency, wire transfers through services like Western Union or MoneyGram, payment apps, and gift cards (How to avoid a scam). Money sent that way is very hard to get back.

A real shop accepts cards. The FTC notes that a credit card gives you dispute rights for items never received, if you write to the issuer within 60 days of the first bill showing the charge. A checkout that hides the card option, or offers a “discount” for paying by bank transfer, is steering you toward money that cannot be recovered.

10. Promises and pressure

Read the offer itself. Guaranteed returns, “risk-free” trading, prices 60 to 80% below every other seller, countdown timers that reset when you reload, and a “last chance” message from an account manager are all ways to stop you from running checks 1 to 9. Pressure to act immediately is one of the FTC’s four signs of a scam.