Fake websites — built to look nearly identical to a real bank, retailer, or government site — are one of the most common tools scammers use to steal personal and financial information. Because these sites get built specifically to look convincing, spotting them takes knowing exactly what to check, rather than trusting a general impression that “it looks fine.”
Check the Web Address Carefully
The website address (URL) is one of the most reliable places to look, since scammers can copy a site’s appearance far more easily than its exact domain name.
Watch for small misspellings or substitutions, like:
- “arnazon.com” instead of “amazon.com” (using “rn” to mimic “m”)
- “paypa1.com” instead of “paypal.com” (a number 1 swapped in for the letter l)
- “bankofamerica-secure.com” instead of “bankofamerica.com” (extra words tacked on after the real name)
Check what comes right before the “.com” — that’s the part that actually matters most. A legitimate Amazon page has “amazon.com” directly before the slash, not “amazon.something-else.com” or “amazon-support.net.”
Look for HTTPS and the padlock icon. Most browsers show a small padlock next to the address bar on secure sites. That confirms the connection’s encrypted, but worth noting scam sites can get this too — so a padlock alone doesn’t guarantee legitimacy, though its absence on a site asking for sensitive information is a clear red flag.
Be Skeptical of How You Arrived at the Site
Links from unexpected emails or texts. Clicked a link claiming to be from your bank, a shipping company, or a well-known retailer? Be extra cautious — this is the single most common way people end up on fake websites in the first place.
A safer move: instead of clicking a link in a message, open a new browser tab and type the company’s address yourself, or use a bookmark you saved previously from a trusted visit.
Examine the Site Itself
Look for spelling and grammar errors. Scammers have gotten more sophisticated (sometimes using AI to write more polished text), but unusual phrasing, awkward wording, or inconsistent formatting can still be a tell, especially on less sophisticated fake sites.
Check for a working “Contact Us” or “About” page. Legitimate businesses typically list real contact information, a physical address, or company details. A site with no contact info at all, or just a generic contact form and nothing else, deserves extra scrutiny.
Be wary of urgency or pressure. Fake sites impersonating your bank or a retailer’s login page sometimes throw in urgent messaging (“Your account will be suspended — verify now”) specifically to rush you past pausing and checking the details.
Notice unusual requests for information. A legitimate login page asks for your username and password. If a site suddenly wants your full Social Security number, PIN, or security question answers just to “log in,” that’s unusual and worth stopping to verify independently.
Use a Reverse Check When Uncertain
Not sure if a site’s legitimate? Search the company’s name directly in a search engine (rather than clicking any link) and compare the official result to the address you’re currently looking at. Significant differences between the two are a clear warning sign.
What to Do If You Suspect a Fake Site
Close the tab or window right away — don’t type in any information, even to “test” whether it looks suspicious.
Don’t click any links or buttons on the page, since some fake sites can trigger downloads or further redirects.
Navigate directly to the real company’s site by typing the address yourself if you want to check your account status.
Report the fake site — most browsers let you flag a suspicious site (in Chrome, through Help > Report a security issue), and you can also report phishing sites to the Anti-Phishing Working Group at reportphishing@apwg.org.
If You Already Entered Information on a Fake Site
Change the password for the real account immediately, from a device you’re confident is clean.
Contact your bank or card issuer if any financial information was entered, so they can watch for or reverse unauthorized activity.
Turn on two-factor authentication for the real account if it’s not already active.
Watch closely for follow-up phishing attempts, since scammers often target people a second time after a successful first try.
The Bottom Line
Fake websites rely on visual similarity to fool you, which is exactly why the web address itself — not just how the page looks — deserves the closest attention. Typing a company’s address yourself rather than clicking a link from an email or text remains one of the simplest, most reliable ways to avoid landing on a fake site in the first place.
Note: This article is for informational purposes only. If you believe you have entered personal information on a fake website, contact your bank and change your passwords immediately.