How to check if a website is safe before you pay

To check if a website is safe before you pay, spend two minutes on five things: the exact domain name, the age of the domain, a Google Safe Browsing lookup, reviews on other sites, and the payment options it offers. If the shop is brand new, offers unbelievable discounts and wants UPI only, do not pay. A padlock in the address bar does not prove the seller is genuine.

This guide is for shoppers and families in India. If you own a website and want to check its security, jump to the last section.

Quick website trust check (2 minutes)

1. Read the domain letter by letter. Is it the real brand, or a look-alike?
2. Check the domain age with a WHOIS / ICANN lookup.
3. Search the address in Google Safe Browsing and our free link checker.
4. Search for reviews outside the website: "sitename fraud", "sitename review".
5. Look at how it wants you to pay. UPI-only, no cash on delivery and "pay within 10 minutes" are red flags.
6. Check contact details: a real address, phone number and, for Indian businesses, a GSTIN you can verify.

1. How to check the domain name

Most fake shopping and offer sites copy a famous brand's look but cannot use its real domain. Look at the part just before .com, .in or other ending. Watch for:

• Extra words: brand-sale-offer.shop, brandindia-diwali.top instead of the brand's real site.
• Swapped letters: arnazon (r + n looks like m), flipkarrt, a zero instead of the letter o.
• The brand name in the wrong place: in brand.com.offer-deal.xyz the real website is offer-deal.xyz, not the brand.
• Unusual endings for a big brand, such as .top, .xyz or .shop. These endings are also used by honest sites, but CERT-In has warned that fake festive gift campaigns mostly used .cn, .top and .xyz domains.

If you reached the site from an ad, SMS or WhatsApp message, close it and type the brand's address yourself, or open the brand's official app.

2. Why HTTPS and the padlock are not enough

HTTPS means the connection is encrypted, so nobody on the network can read what you type. It does not mean the person receiving your money is honest. Anyone can get a free certificate for any domain they own. Rajasthan Police, in a festive-season advisory in October 2026, specifically reminded shoppers that a padlock or HTTPS does not mean a website is genuine.

3. Check Google Safe Browsing (transparency report)

Google keeps a list of websites known for phishing and malware. You can look up any address in the Google Safe Browsing site status tool. Paste the domain and read the result.

• "Unsafe" or "partially dangerous": do not use the site.
• "No unsafe content found": this only means Google has not flagged it yet. New scam sites often run for days before they are listed.

You can also paste the link into the Secuvexa link checker, which looks for look-alike bank, UPI and brand domains, link shorteners, APK downloads and other scam patterns as well as threat-database matches.

4. Check the domain age (WHOIS / ICANN lookup)

Fake shops are usually set up quickly, run a "sale" for a few weeks and disappear. A domain registered very recently is one of the strongest warning signs.

1. Open the ICANN Lookup tool (free, run by the body that coordinates domain names).
2. Type only the domain, for example example.in, and search.
3. Find the creation or registration date.

A shop that claims "India's trusted store since 2015" but whose domain was created last month is lying. Owner details are usually hidden for privacy, which is normal, so focus on the date.

5. Read reviews outside the website

Reviews and "customer photos" on the shop's own pages can be invented. Search Google for the domain name with words like fraud, scam, review or complaint. Check Reddit, consumer complaint forums and the brand's official social media pages. No reviews at all for a shop with "lakhs of happy customers" is itself a warning.

Be careful with social media ads: anyone can run them, and a sponsored post is not proof of a real business.

6. Payment red flags before you pay

7. Check contact details and GST

A genuine Indian business usually shows a full postal address, a working phone number, a customer-care email on its own domain, and return and refund policies that make sense. Gmail addresses only, WhatsApp-only support, or a copied "About us" page are warning signs.

If the site shows a GSTIN (15-character GST number), check it on the official GST portal "Search Taxpayer" page. The legal or trade name and state should match the business on the website. A GSTIN that belongs to a completely different business or state is a serious red flag. A valid GSTIN proves a business is registered, not that it will deliver, so use it together with the other checks.

Already paid on a suspicious website?

1. Call 1930 or report at cybercrime.gov.in as fast as possible. Quick reporting gives the best chance of freezing the money. See our step-by-step 1930 complaint guide.
2. Call your bank or card issuer and block the card if you entered card details.
3. Save the website address, screenshots, order confirmation and UTR / transaction ID.
4. For a genuine seller who simply refuses a refund (not fraud), you can complain to the National Consumer Helpline on toll-free 1915 or the INGRAM portal.

Own a website? Check its security

If you run an online shop or business website, customers will judge you with these same checks, and a hacked or poorly configured site can be flagged by Google or used for scams in your name. Our free website security scanner checks your SSL certificate, security headers, email spoofing records (SPF, DMARC), outdated software and exposed files, and explains each fix in plain English. Only scan websites you own or are authorised to test. If you think something is already wrong, read how to tell if your website is hacked.

Frequently asked questions

This guide is general information, not legal advice. If you have lost money to fraud, call 1930 immediately or report at cybercrime.gov.in.