Does that website really belong to the company it claims to represent?

A message says your parcel is waiting, your bank account needs verification or you have won a prize. The link opens a page with a familiar logo and a form asking for your details. Before you type anything, check the address and how you reached the page.

A professional design, HTTPS or a high position in a search result does not prove a website is genuine. The safer approach is to reach the organisation through an address you already know and verify any unexpected request independently.

Start with the full web address

Look at the browser’s address bar, not just the name or logo printed on the page. On a phone, tap the address bar if the browser shows only part of the address. Read the actual domain carefully before the first slash after the domain.

Scammers may use a misspelling, an extra word or a different domain ending. They can also place the name of a real company before the actual domain to make the address look convincing. In the fictional address bank.example-scam.com, the registered domain is example-scam.com, not bank. The word before it is a subdomain.

This example is for explanation, not a real bank address. If the address looks unfamiliar, close it and open the organisation’s official app or a bookmark you have already checked. If you are unsure of the official address, use a trusted source such as the number on your card to ask the organisation.

Be careful with shortened links. They hide the destination until you open them, and even a preview service cannot prove that the destination is honest. Do not enter sensitive details unless you have verified where you ended up.

Do not rely on the padlock alone

HTTPS encrypts the connection between your browser and the website, helping protect data in transit. It does not tell you whether the business behind the page is legitimate. Fraudulent sites can use HTTPS and display a padlock too.

A missing secure connection is a reason not to submit sensitive information, but its presence is only one check. The US Federal Trade Commission’s online shopping guidance makes the same distinction. Check the address, the organisation and the request itself.

If your browser warns that a site is dangerous or the connection has a certificate problem, do not ignore the warning just because the page looks familiar. Return to the organisation through a known route. A warning may need investigation, but a normal-looking page is not proof that everything is safe.

Be suspicious of pressure and unusual requests

Fake pages often arrive with a story designed to make you act before thinking: “Your account will close in ten minutes”, “Pay a small release fee” or “Confirm your PIN to receive a refund”. A real organisation may send urgent notices, but urgency is a reason to verify independently, not a reason to skip checks.

Do not enter your bank PIN, password or one-time verification code into a page reached through an unexpected message. A code used to authorise a payment or sign-in should never be read to a caller who contacted you. If the request mentions your bank, contact the bank using its official app or the number on your card.

A fake job or grant site may ask for a processing fee or identity documents before giving verifiable information. Search for the programme on the organisation’s official website, compare the requirements and contact it through a known channel. Do not assume a government logo or a Nigerian flag makes the page official.

Check who runs the site

Look for a clear business name, contact details, delivery information and return policy where relevant. Search for the name together with words like complaint or scam, and read results from several sources. If the business claims an affiliation, check the supposed partner’s official website for confirmation.

A contact page or a physical address is not proof by itself. Details can be copied from a genuine business. Likewise, positive reviews and follower counts can be fabricated, while a small new business may have few reviews despite being genuine. Consider the evidence together rather than relying on one sign.

For a marketplace listing, identify the individual seller as well as the platform. Check whether payment and complaints remain inside the platform. A request to move immediately to a personal transfer account can make it harder to use a platform’s dispute process.

Watch for misleading search results and adverts

A fake website can be promoted in a sponsored result or shared through a social media advert. Search placement alone is not an endorsement. Check the destination domain before entering a password or card details, and use a trusted bookmark for services you visit regularly.

Do not trust a pop-up saying your phone has a virus and asking you to call a number or install a cleaner. Close the tab without following its instructions. If the browser will not respond, close the browser through your phone’s normal app controls and seek help from a trusted source.

A convincing copy may use correct spelling and a polished layout. Poor grammar can be a warning sign, but the absence of mistakes does not prove a site is safe.

Look at what the form asks for

A delivery company may need an address to deliver an order. It does not need your internet banking password or the one-time code used to authorise a bank transaction. A supposed scholarship application asking for card PINs is another reason to stop.

Only provide information needed for a service you have verified. Review privacy terms before uploading an identity document, and do not send a copy to a stranger in a chat because they claim to be an agent. If a form asks for more than you expect, contact the organisation independently before continuing.

When you shop, compare the product description, total cost and refund policy. Our guide on shopping online safely covers seller and payment checks in more detail.

What if you already entered your details?

If you entered a password, use a trusted device to change it on the genuine service. Change it anywhere else you reused it, beginning with email and financial accounts. Review recent account activity and sign out unfamiliar sessions. Our email security guide explains where to look in a Google account.

If you entered card details or approved a payment, contact your bank or payment provider immediately through its verified contact details. Explain what you shared and ask whether the card or account should be secured. Keep any transaction references and messages; a reversal is not guaranteed.

If you downloaded a suspicious file, do not open it. Remove it if you can and seek help checking the device using reputable tools. If you installed an app or gave remote access, stop using the device for sensitive tasks until it has been checked.

The safest habit is simple: when a message pushes you towards an unfamiliar page, pause and reach the organisation another way. You can take time to verify a genuine request, but details handed to a fake site can be difficult to take back.