How can you tell if a website is legitimate?
No single signal proves it. Legitimate sites accumulate verifiable details a fraudulent one has no reason to produce - and the absence of several together is the real signal.
By Sapun Lamichhane · Arcetis
No single signal proves it, and anyone selling you one is wrong. What separates a real business from a page built last week to take card details is an accumulation of verifiable detail - and the reliable signal is several of those being absent at once.
What should be present, and usually is not?
- A contact route that reaches a human. An email address or phone number, not only a form that posts into nothing.
- A physical address, and a company registration number where the jurisdiction issues one.
- A privacy policy and terms that describe this business rather than a template with the placeholder name still in it.
- Organization markup naming the entity, which is what lets a machine tie the site to a company rather than a domain.
- A certificate that actually covers the hostname you are on - including the www form, which is separately configured and frequently missed.
What signals fraud rather than just absence?
Some patterns are not neutral. They appear on fraudulent pages far more often than legitimate ones, and several are illegal in the EU and UK under consumer protection law:
- A countdown timer that resets when you reload. A real deadline does not depend on when you arrived.
- Fabricated scarcity - '12 people are viewing this', 'only 3 left' - where the number is generated rather than measured.
- Trust badges that are flat images. A genuine seal from a payment processor or security vendor links to a live verification page; anyone can save a picture of one.
- Obfuscated or redirecting outbound links, and text hidden from humans but readable by crawlers.
- A checkout that posts over plain HTTP, or a payment form on a page whose certificate does not match.
What does none of this tell you?
Two honest limits, and any tool that omits them is overselling.
A brand-new legitimate business scores badly on almost all of it. A sole trader who launched last month has no reviews, no registration number on the page and a template privacy policy - and is entirely real. A low score is a reason to look harder, not a verdict.
And a well-funded fraud can pass every one of these. Registered companies, real addresses, valid certificates and professional copy are all purchasable. Signals raise or lower the probability; they do not settle it, and no automated check can tell you whether the company behind a page will ship your order.
How do I check a site?
The scam detector on this site checks the signals above and reports which are present and which are missing, with the evidence for each. It is deliberately framed as evidence for your judgement rather than a verdict, because the honest answer to 'is this site a scam' is almost always 'here is what is missing, decide how much that matters'.