Daily Junction.mobi portalTechnology · December 16, 2024 · Amelia Hart · 6 min
A practical guide to recognising fake and scam websites before they cost you money or steal your details — the warning signs to check, the tricks to know, and what to do if you've been caught out.
A great deal that's almost too good to be true. A "delivery" text with a link to pay a small fee. A bank login page that looks exactly right. Scam websites are designed to slip past your instincts in the moment you're distracted or excited — and they're getting more convincing all the time. The good news is that most of them give themselves away if you know where to look. This guide walks through the warning signs and the simple checks that keep you safe.
A scam website is a site built to deceive you — usually to steal your money, your payment details or your personal information. Some are fake shops that take your cash and send nothing. Others are spoof sites that impersonate a real organisation — a bank, a courier, a government service — to harvest your login or card details. Either way, the design is deliberate: the more legitimate it looks, the better it works.
That's the key thing to understand. A scam site isn't a crude, obvious fake; criminals copy logos, layouts and wording from the real thing. So you can't rely on a site "looking professional." You have to check the details that are harder to fake.
The mindset that protects you: slow down. Scams rely on speed and emotion — excitement at a bargain, panic at a "problem." A calm thirty-second check defeats most of them.
The single most revealing detail is the URL — the web address in the bar at the top. Criminals can copy a site's appearance perfectly, but they can't use the real address, so they use one that's close.
![[View image]](/img/how-to-spot-fake-websites.jpg){kind=link}
amaz0n.com, paypaI.com (with a capital "i" posing as an "l"), or bank-secure-login.com. A glance reads it as right; a careful look doesn't.apple.com.verify-account.net. The real owner is whatever sits just before the final .com/.co.uk — here that's verify-account.net, not Apple.This habit overlaps heavily with spotting phishing emails, because a phishing message and a scam website are usually two halves of the same trap: the email lures you, the fake site does the stealing.
Here's a myth worth killing. Many people were taught "look for the padlock," and the padlock (which means the site uses HTTPS) does matter — but not in the way most assume.
The padlock tells you the connection is encrypted, so someone can't easily snoop on the data travelling between you and the site. It tells you nothing about whether the people running the site are honest. Encryption certificates are free and instant, so scammers get padlocks for their fake sites as a matter of routine. A padlocked phishing page is still a phishing page.
So treat it as a floor, not a seal of approval: no padlock on a page asking for payment is a serious warning, but a padlock by itself proves nothing. To understand exactly what it does and doesn't mean, see our explainer on what HTTPS is and why the padlock matters.
Beyond the address, a cluster of red flags tends to show up together on scam sites. Any one might be innocent; several at once should stop you.
| Warning sign | Why it matters |
|---|---|
| Prices far below everyone else | Bait to rush you into buying something that won't arrive |
| Poor spelling and grammar | Genuine brands proofread; many scams don't |
| Pressure and countdowns | "Only 2 left!" timers exist to stop you thinking |
| No real contact details | A missing address, phone or company info is a bad sign |
| Unusual payment methods | Requests for bank transfer, gift cards or crypto avoid buyer protection |
| Reviews only on the site itself | Glowing on-page reviews mean little; check independent sources |
Pay special attention to payment method. A legitimate shop accepts cards (which give you protection if things go wrong). A site that insists on bank transfer, gift cards or cryptocurrency is steering you toward methods where your money is gone for good once sent — a hallmark of fraud.
Scam sites aren't only about dodgy products. Some of the most damaging impersonate trusted organisations — your bank, HMRC, the DVLA, a delivery firm, or a lender — to capture your details or trick you into paying a "fee." The pattern is consistent: an urgent message, a link to a convincing but fake page, and a request for information or money before you have time to reflect.
These impersonation scams are widespread enough that legitimate companies now publish guidance on how to recognise fakes of themselves. The UK lender Credicorp, for example, sets out the tell-tale signs in its guide to spotting loan scams and impersonation — note that it flags exactly the behaviours above: pressure to pay immediately, and an upfront "fee" demanded before a loan is released. If a message claims to be from a company you deal with, don't use the link it provides. Go to the company's real website yourself, or call a number you already trust, and check.
When in doubt, a couple of minutes of independent checking settles most cases:
These same instincts protect more than your wallet — being cautious about which sites you trust with information is part of staying safe from impersonation scams generally.
If you realise too late that you entered details on a fake site, act quickly — speed limits the damage:
Being scammed is nothing to be embarrassed about — these operations are professional and target everyone. What matters is reacting fast.
Scam websites win by looking real and rushing you, so the defence is to slow down and check the things they can't fake. Read the web address carefully, remember the padlock means encryption rather than honesty, and watch for the cluster of red flags — bargain prices, pressure, missing contact details and odd payment demands. Be especially wary of sites impersonating banks, lenders and other trusted bodies. A calm thirty-second check before you type your details is, by some distance, the cheapest insurance you'll ever buy. And if you do get caught, contact your bank, change your passwords and report it without delay.