Is This Website Legit? A 10-Point Checklist

Short answer: To check whether a website, link or app is legit, read the full web address, check how old the domain is, look for contact and company details, and be wary of unusual payment requests or offers that seem too good. A padlock does not prove safety. If you have already paid, call 1930 immediately.

Fake shops, copied bank pages, fraudulent job portals and cloned apps look more convincing every year. You do not need special tools to spot most of them. Work through the checks below before you log in, pay or install anything, and trust your doubts when two or more checks fail.

1. Read the full web address carefully

The part that matters is the registered domain, which is the text directly before the first single slash and the final dot-extension. In login.yourbank.example.com the real domain is example.com, not yourbank. Attackers add familiar names to the front, swap letters (rn for m, 0 for o), or use long addresses so the telling part is hidden on a small phone screen.

Do not trust links in messages, even from contacts. Type the address yourself, use a bookmark you created earlier, or open the official app.

2. Remember that HTTPS is not proof

The padlock only means the connection to that site is encrypted. Scam sites can get the same padlock easily, so it says nothing about who runs the site or whether it is honest. Treat a missing padlock as a warning and a present padlock as neutral.

3. Check domain age, spelling and language

A web search for the site name plus the word "scam" or "complaint" is a quick first test. You can also use a public domain lookup service (search for "domain registration lookup") to see when the domain was created. A shop claiming ten years of trading on a domain registered last month is a red flag.

Poor spelling, mismatched prices, stolen product photos and awkward language are common on fake sites. Their absence does not make a site safe, though.

4. Look for the business behind the site

A genuine seller shows a registered company name, a postal address, working contact details and clear refund, cancellation and delivery policies. Check that the phone number and email belong to the same business, and that the address exists. For Indian businesses, a GST number or company registration number can be checked on official government portals. Missing or inconsistent details are a reason to stop.

5. Treat reviews with caution

Read reviews on independent platforms, not only the testimonials printed on the site. Look for specific, varied comments spread over time. A crowd of identical five-star reviews posted in a few days suggests purchased feedback. Search the seller's name on social media and consumer forums, and see how complaints were handled.

6. Watch for payment red flags

• You are asked to pay to a personal UPI ID or bank account instead of through a recognisable checkout.
• A collect request or QR code is used to "receive" money. Entering your UPI PIN or approving a request only ever sends money out.
• Payment is demanded by gift card, cryptocurrency or wire transfer.
• You must pay a fee first to receive a prize, loan, job, refund or parcel.
• Cash-on-delivery is unavailable and a large advance is demanded.

Our phishing and UPI scam safety guide explains these tricks in more detail.

7. Be sceptical of offers that are too good

Brand-new phones at half price, guaranteed returns, free recharge for sharing a link, and "work from home, earn daily" tasks are common bait. A countdown timer or "only 2 left" banner is designed to hurry you before you think. Pause, then compare the price on the brand's official site.

8. Check apps before installing

Install apps only from your phone's official app store or the company's official website. Check the developer name, the number of downloads, recent reviews and the date of the last update. Look at the permissions requested: a torch app asking for contacts, SMS or accessibility access is suspicious. Never install an app from a link, a messaging group or a file sent to you, and never install a remote-access app because a caller asked you to.

9. Ask before you act

Show the link or offer to a family member or a friend who knows technology. Scammers rely on isolating you and on urgency. A five-minute pause breaks both.

10. Scan your device if you clicked or installed

If you opened a suspicious file, installed an unknown app or entered a password, change that password from a clean device, then scan your PC. See our guide on checking whether your PC has a virus and the malware removal guide.

What to do if you have already paid or shared details

1. Call 1930, the National Cyber Crime Helpline, as soon as possible. Quick reporting improves the chance that a transfer can be held.
2. Report online at cybercrime.gov.in with transaction IDs, screenshots, phone numbers and the website address.
3. Contact your bank or wallet provider immediately through its official number, tell them the payment was fraudulent and ask about blocking cards or the UPI handle.
4. Change passwords and PINs for any account you used on the site, starting with email, and enable two-step verification.
5. Keep evidence. Do not delete chats, emails or receipts.

Frequently asked questions

How can I check if a website is legit?

Read the full web address, check the age of the domain, look for real company and contact details, read independent reviews and examine the payment method. If several checks fail or the offer seems too good, do not pay or log in.

Does the padlock mean a website is safe?

No. The padlock only shows that the connection is encrypted. Fraudulent websites can use it too, so you still need to check the address, the seller and the payment method.

How can I check a link without opening it?

Read the full address, search for the brand's official website yourself and compare, and avoid shortened links from unknown senders. If you are unsure, type the official address in your browser instead of clicking.

What should I do if I paid a fake website?

Call the National Cyber Crime Helpline 1930 straight away, report on cybercrime.gov.in, tell your bank through its official number, keep all evidence and change passwords for accounts you used on the site.

Is it safe to install an app from a link someone sent me?

No. Install apps only from your official app store or the company's own website, and check the developer, reviews and requested permissions. Apps sent through links or messaging groups are a common way to spread malware.

Protect your Windows PC

Scan your PC on demand with PremiumAV Total Security: Quick, Full and custom scans, USB drive scans, real-time file monitoring and a quarantine vault are listed as included on the features page. See pricing or download the installer to try it on your Windows PC.