Can a website be a scam if it has a padlock and HTTPS?

Yes. HTTPS only means the connection is encrypted — it does not mean the business is real. Scammers can buy SSL certificates cheaply, so you still need to check the domain name, age, and reputation.

What is the fastest way to check if a link is safe?

Copy the full URL and paste it into Google Safe Browsing or URLVoid. These tools scan for phishing, malware, and fraud history in seconds. You can also hover over the link to see the real destination before clicking.

How do I know if a domain name is fake?

Read the address slowly and look for misspellings, extra words like 'secure' or 'verify', or unusual endings like .net or .xyz when the real site uses .com or .com.au. Compare it character-by-character with the official domain.

Should I trust a site if it was created last month?

Be cautious. Scam sites are often registered days or weeks before use. Use Who.is or ICANN Lookup to check the registration date. A brand-new domain claiming to be a major bank or retailer is a major red flag.

What should I do if I already entered my password on a fake site?

Change your password on the real site immediately. If you used the same password elsewhere, change those too. Enable two-factor authentication if you have not already. Contact your bank if you entered card details.

Are free online store reviews on the store itself reliable?

No. Fake sites often write their own testimonials. Look for independent reviews on Google, ProductReview, or Trustpilot. Also search the business name plus 'scam' or 'review' to see what real customers say.

Can I report a fake website to get it taken down?

Yes. Report it to Scamwatch in Australia, the ACCC, and the real company being impersonated. You can also report phishing pages to Google Safe Browsing and the web host listed in the domain's Who.is record.

Is it safe to shop on a website that only accepts bank transfer?

No. Most legitimate stores accept credit cards or PayPal, which offer buyer protection. Bank transfers and cryptocurrency are often irreversible. If those are the only options, shop elsewhere.

All scams

🔗

How to check if a website is a scam

A simple step-by-step guide to spotting fake websites, verifying links, and staying safe before you enter your details.

Link safetyGeneral

Fake websites are one of the most common ways scammers steal passwords, card numbers and personal data. They can look almost identical to real bank, government, shopping or delivery sites. Follow these steps every time you are unsure about a link or website.

Step 1

Inspect the URL carefully

The web address is the first thing to check. Scammers use lookalike domains that are easy to miss at a glance.

Read it slowly. "mygov-secure-au.com" is not "my.gov.au". "cba-verify-login.com" is not "commbank.com.au".
Watch for extra words. Real brands rarely add words like "secure", "verify", "login" or "update" to their domain.
Check the full address. Hover over links on desktop, or long-press on mobile, to see where they really go before you tap.

Step 2

Look for HTTPS — but don't trust it blindly

A padlock in the address bar means the connection is encrypted. That is good, but it does not mean the site is legitimate. Scammers can buy HTTPS certificates cheaply.

No padlock? Never enter passwords or card details.
Invalid certificate warning? Close the browser tab immediately.
Padlock present? Keep checking the other steps — it is not enough on its own.

Step 3

Look up the domain age and reputation

Scam sites are often created days or weeks before they are used. A brand-new domain claiming to be a major bank is a huge red flag.

Use Who.is or ICANN Lookup to see when the domain was first registered.
If the site was registered in the last few months, treat it as suspicious.
Search Google for "[domain name] scam" or "[domain name] review" to see what others are saying.

Step 4

Use free third-party safety tools

Several free tools scan websites for malware, phishing, and fraud history. Run any suspicious site through them before you sign in or pay.

Google Safe Browsing URLVoid ScamAdviser VirusTotal

Copy the full URL and paste it into one or two of these scanners.
If a tool flags the site, do not proceed — even if the site looks professional.

Step 5

Check for real contact details and reviews

Legitimate businesses display verifiable contact information. Fake sites often hide or fabricate these details.

Look for an Australian phone number, ABN, and a real street address.
Search the ABN on abr.business.gov.au.
Search for independent reviews on Google, ProductReview, or Trustpilot — not just testimonials on the site itself.
No contact page, or only a web form? That is a warning sign.

Step 6

Reverse image search stolen photos

Fake stores and investment sites often steal product photos and team headshots from real businesses.

Right-click any product or team photo and choose "Search image with Google".
If the same image appears on unrelated sites, the store is probably fake.
Team photos that look like stock images are another common red flag.

Quick safety checklist

Before you enter any password, card number, or personal detail on a website, confirm these five things:

1The URL matches the real company exactly — no extra words or misspellings.
2The site has HTTPS and no certificate warnings.
3The domain is more than a few months old (check Who.is).
4It passes a scan on Google Safe Browsing, URLVoid or ScamAdviser.
5You reached the site by typing the address or using a trusted bookmark — not by clicking a link in a message.