How to Check If a Website Is Legit

While even the most careful web user can fall victim to a fraudulent website, there are some things that you can look for that may be able to help you spot a problematic website; one that could be amateur (at best), fraudulent (at worst), or otherwise less-than-reputable. While this list is intended to raise awareness, it isn’t comprehensive. You’ll want to conduct your own due diligence when assessing a website’s legitimacy.

1. Professional Content and Design
   A professional-looking design and error-free content could indicate a legitimate website. Poorly written content or a design that makes navigation difficult could indicate an illegitimate site. Similarly, look for potential signs of spammy practices in the content. For example, content that sounds unnatural and overuses certain keywords may not always be legitimate.
2. Contact Information
   Legitimate companies provide several contact methods, such as phone, email, live chat, and a physical address. You can find this information on a “Contact Us” page and in the footer of other pages. However, some scam sites will provide contact information. For example, an illegitimate site could provide just one piece of contact information or a physical address that does not exist.
3. Domain Name
   Scam websites may use URLs nearly identical to a real site’s, with a slight difference, such as a “0” in place of an “o” or a misspelling. Others may use the exact domain name but the wrong top-level domain. For example, a site imitating American Express might try americanexpress.net, when the actual site is americanexpress.com. Scrutinize the domain name to see if there are any signs it is not the real website’s URL.
4. Secure Connection
   Another aspect of the URL to check is whether it’s secure. There are a few things to look for:
   • Https: Https indicates that the site uses a protocol that secures communication and data transfer between the web browser and a website. However, illegitimate sites can also imitate this, so look for other signs.
   • Secure Sockets Layer Certificate: SSL is a way sites can encrypt data sent between web browsers and servers. Look for the site’s SSL certificate by clicking the padlock icon in the URL.
   • Cookies and Site Data: See how many cookies the site uses. A high number of cookies may be a sign but is not always a concern.
   
   Keep in mind that scam sites can spoof these elements. Use them only with other methods of verification.
5. Privacy Policy
   All websites that collect or use personal data must have a privacy policy.¹ Legitimate sites will provide a link to this policy at the bottom of every page, and some will have a link in the top menu. Skim over the policy to ensure it is real. Look for sections that describe how your data is collected, used, and protected. Check for any suspicious words or phrasing. Some scam sites may attempt to create a privacy policy page that does not contain this information yet looks like it does.
6. User Ratings/Reviews
   Look for user reviews, ratings, testimonials, and complaints across several websites. If the site primarily has poor reviews or has none, it may be fraudulent. You’ll also want to look for fake reviews. Multiple positive reviews in a short time, generic reviews, misspellings, and reviews from the same IP address could be signs of fake reviews.
7. Suspicious Pop-Up Ads
   Many websites use pop-up forms as a legitimate way to collect your name, email address, and phone number for marketing purposes. A legitimate site should have a privacy policy and data usage policy explaining how this data is used. However, the website may be problematic if the pop-ups are aggressive, numerous, and ask for sensitive information, such as a credit card number. Sometimes, fraudulent pop-ups falsely warn about viruses or tell you to download software to “fix” a problem on your computer.
8. Social Media Presence
   Look for the website’s social media accounts. Scan their list of followers and look at some follower profiles to see if the site uses fake followers. Examine the posts, too. Posts without much text, or that contains many emojis and stock photos could indicate a fake company.

Millions of people become victims of identity theft each year.² If your identity is stolen, it can lead to financial losses or even potential credit damage.³

Here are some tips for protecting your information against identity theft and fraud:

• Use Strong Passwords and Two-Factor Authentication
  Use different passwords for every website with whom you have an account. Each password should be a mix of letters, numbers, and special characters. Whenever possible, enable two-factor authentication, such as email or text verification. This adds another layer of security in case your password is stolen and can help you report potential cyber threats.
• Be Aware of Online Scams
  Even the strongest security measures may fail if a website can trick you into giving it your information. Staying updated on online scams and their signs can help you realize when you might be targeted by a fraudulent website or email.
• Avoid Accessing Sensitive Websites Using Public Wi-Fi
  Cybercriminals can access sensitive information, such as bank logins or account numbers if you attempt to log in on public Wi-Fi networks. Therefore, it’s advisable to only access this information on private networks, such as your home network.