Is This Online Store Legit? A 5-Minute Check Before You Buy

Key Takeaway:
Fake shops do best in the weeks around Black Friday, when everyone is hunting for deals from stores they’ve never used before. Before you pay a shop you don’t know, take five minutes to check five things: whose address the site is really on, how old that domain is, what other buyers say when you search its name with “scam”, whether security blocklists already know it, and how it wants to be paid. A padlock in the address bar proves none of this. If anything fails, buy elsewhere, and pay by credit card wherever you can, because that gives you a way to get your money back.

Black Friday falls on 27 November this year and Cyber Monday on 30 November, and the deals have already started. So have the fake ones. A scam shop doesn’t need to be clever. It needs a believable website, a price that’s a little too good, and a few weeks when people are buying quickly from places they’ve never heard of.

The FBI’s Internet Crime Complaint Center received 56,478 complaints about non-payment and non-delivery in 2025, the category that covers paying for something that never arrives, with $503 million reported lost. That counts only the people who reported it. The Federal Trade Commission told Congress this year that text messages are now the most common way scammers make first contact, and that social media is where people lose the most money. Both are exactly where holiday “deals” turn up.

Here’s a check you can run before buying from any shop you don’t know. It takes about five minutes, it’s free, and every step uses a tool you can open in another tab right now.

🛒 The 5-Minute Check

1. Read whose address it really is

Look at the web address, not the logo. The part just before the first single slash is the domain, and the domain is the only part a scammer can’t fake. An address like nike.com.something-else.shop belongs to something-else.shop, not to Nike. A store that uses a big brand’s name inside someone else’s domain is not that brand.

Watch for lookalikes too: a swapped letter, an extra word such as “official” or “sale”, or a letter borrowed from another alphabet that looks identical on screen. Paste the address into our Lookalike Domain Checker to catch the ones your eyes can’t. If you’ve never read a link this way, our free lesson Read a Link Before You Tap It takes two minutes.

2. Check how old the domain is

Scam shops are cheap to set up and get shut down quickly, so most of them run on domains registered only weeks before the sale starts. A shop selling discounted big-name goods on a domain that’s three weeks old should make you stop.

Type the domain into our free WHOIS Lookup. It reads the registration record and tells you in plain words when the domain was registered, for example “Registered 12 days ago”. Compare that with what the site claims. A store that says “serving customers since 2009” on a domain registered this month is lying about something.

Age is a signal, not proof. Real small businesses start on new domains too. But a new domain plus prices far below everywhere else plus a famous brand’s products is the classic pattern.

3. Search the shop’s name with “scam”

The FTC’s advice is simple: search the company or product name together with words like “complaint”, “scam” or “review”. Other buyers usually find a fake shop before you do, and they say so.

Be careful with the reviews themselves. The FTC warns that star ratings can be faked. Reviews shown on the shop’s own pages are the easiest to invent, so look for what people say somewhere the shop doesn’t control. No results at all for a shop with “thousands of happy customers” is a warning too.

4. Ask the blocklists

Security companies keep lists of domains caught sending spam, phishing or malware. Our Domain Blacklist Checker asks four of them at once (SURBL, NordSpam, Quad9 and Cloudflare’s malware filter) and tells you if any has flagged the domain.

A listing is a strong reason to leave. A clean result is weaker than it sounds: a shop set up last week may simply not have been caught yet. That’s why this check comes after the domain age, not instead of it.

5. Look at how it wants your money

This is the check that matters most, because it decides whether you can get your money back if everything else fooled you. The FTC says to pay by credit card when you can, and to walk away from any seller who insists on gift cards, wire transfers, payment apps or cryptocurrency. Scammers prefer those because the money is hard to recover once it’s sent.

A checkout that suddenly “can’t take cards today” and offers a bigger discount for a bank transfer or crypto is one of the clearest warning signs there is. Real shops want your card payment.

The Padlock Doesn’t Mean the Shop Is Honest

Many people still treat the padlock, or “https”, as a sign that a site is safe. It isn’t, and the FTC says so directly: https doesn’t mean a site is legitimate. The padlock means the connection between your browser and the site is encrypted, so nobody on the network can read what you type. It says nothing about who is on the other end. Certificates are free and issued automatically, and scam shops use them like everyone else.

Our SSL Checker shows what a certificate actually covers: which names, who issued it and when it expires. It’s a useful look behind the padlock, but treat it as a check on the connection, not on the shop. For what HTTPS does and doesn’t protect, see What Is SSL/TLS?

📦 Deal Texts and “Delivery Problem” Messages

The busiest shopping weeks are also the busiest for fake delivery texts: “Your parcel couldn’t be delivered, update your address”, with a link and a small fee. They work because almost everyone is expecting a package.

The US Postal Inspection Service is clear about its own messages. USPS only sends tracking texts or emails if you asked for them with a tracking number, and those messages won’t contain a link. An unexpected USPS text with a link is a scam. Other carriers are copied the same way, so the safe habit is the same for all of them: don’t use the link, and track the parcel on the carrier’s website or app yourself, using the tracking number from your order confirmation.

If you want to see where a link in a text or an ad really goes without opening it, paste it into our Link Expander. It follows every redirect on our server, shows you the final address, and warns you if that final domain was registered within the last month. If the deal arrives as a QR code, on a flyer or a social post, our QR Code Decoder shows the address inside the code as plain text.

Red Flags at a Glance

What you see	Why it matters	How to check
A brand’s name inside an unfamiliar domain	Anyone can put a brand name in their own address	Read the domain; Lookalike Domain Checker
Domain registered days or weeks ago	Most scam shops are brand new	WHOIS Lookup
Prices far below every other seller	The “deal” is the bait	Compare the price at two stores you already trust
No complaints, no reviews, or reviews only on the shop’s own site	On-site reviews are easy to invent	Search the name with “scam” and “complaint”
Domain flagged for spam or phishing	Someone has already caught it misbehaving	Domain Blacklist Checker
Gift cards, wire transfer, payment apps or crypto only	That money is very hard to get back	No check needed: pay by card or don’t buy
A delivery text with a link you didn’t ask for	USPS tracking texts never contain links	Track on the carrier’s own site; Link Expander

If You’ve Already Paid

Paid by credit card? Call the card company using the number on the back of your card and dispute the charge. In the US, the Fair Credit Billing Act covers goods that weren’t delivered as agreed. Your written dispute must reach the card issuer within 60 days of the first bill that showed the charge, and you can hold back the disputed amount while it investigates. Don’t wait for the 60 days to run down.
Paid by debit card, bank transfer or a payment app? Call your bank or the app’s support today, through the number in the app or on your card, and report it as fraud. Speed matters more here, because these payments have weaker protection.
Still waiting and not sure yet? The FTC says that if a seller doesn’t state a shipping time, it must ship within 30 days of getting your order and payment. Contact the seller first and keep a record of it.
Keep everything: the shop’s name and web address, your order confirmation, payment details, screenshots of the product page and the shipping promise, and every message.
Report it to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov. Forward scam texts to 7726, and fake USPS texts to spam@uspis.gov.
Ignore anyone who offers to get your money back for a fee. That’s a second scam aimed at people who’ve just lost money. Our guide to recovery scams explains how they find you.

If you typed card details into the fake shop, ask your card company to cancel the card and send a new one, even if no money has gone yet. Our free lesson Been Scammed? What to Do in the First Hour walks through the rest step by step.

Frequently Asked Questions

The site has a padlock. Doesn’t that mean it’s safe?

No. The padlock only means your connection to the site is encrypted. Scam shops get certificates for free like any other site, and the FTC specifically warns that https doesn’t make a site legitimate.

Is every new online store a scam?

No. Real businesses start on new domains too. A new domain is a reason to look harder, not proof. It becomes a strong warning when it comes together with big-brand products at prices nobody else matches, no outside reviews, and a push to pay by anything other than a card.

I found the shop through an ad on social media. Is that a bad sign?

Not by itself, since real shops advertise there too. But the FTC reports that social media is where people report losing the most money to scams, so run the same five checks on any shop you meet through an ad before you buy.

I got a text saying my parcel is held and I need to pay a small fee. What do I do?

Don’t tap the link. Look up the parcel on the carrier’s own website or app using the tracking number from your order. USPS says it doesn’t send texts with links unless you signed up with a tracking number, and even then the texts contain no links. Forward the message to 7726 and delete it.

The blocklist check came back clean. Can I trust the shop?

Not on that alone. Blocklists catch domains that have already been reported, and a scam shop set up days ago may not be on any of them yet. Treat a clean result as one check passed, and look at the domain’s age and the payment options too.

Is This Online Store Real? A 5-Minute Check Before You Buy