How to Tell if a Website Is Legit: 11 Checks (2026)

Fake websites are now the quiet engine behind most online scams aimed at retirees. The FTC reports that online shopping is consistently one of the top fraud categories, and older adults lose more per incident than any other age group. The sites look polished: real logos, stock photos, glowing reviews and a padlock in the address bar. What gives them away is almost never the design. It is the details underneath.

The eleven checks below take about two minutes in total. You do not need to be good with computers to do them, and you only need one or two failures to know to walk away.

11 checks to tell if a website is legit

1. How did you get there?

This is the single most important check. Sites you reached by typing the address yourself or from a bookmark you created are rarely fake. Sites reached from a social media ad, a sponsored search result, a text message or an unexpected email are where nearly all fake stores and fake login pages live. If you arrived by a link, close the tab and go to the company another way.

2. Read the web address letter by letter

Scammers register look-alike names: arnazon.com (r and n instead of m), paypal-secure-login.com, walmart.shop-deals.net. Read the part just before .com, .org or .net — that is the real owner. In walmart.shop-deals.net the owner is shop-deals.net, not Walmart.

3. Don't trust the padlock

The padlock only means the connection is encrypted. Scam sites get the same free certificates as everyone else. A site without a padlock is a red flag; a site with one is not a green light.

4. Check how old the website is

Search for a free WHOIS lookup and enter the address. A clothing or furniture store that was registered six weeks ago and claims to have served customers since 1998 is lying. Most fake stores last only a few months before they vanish and reappear under a new name.

5. Is the price too good to be true?

Brand-name items at 70 to 90 percent off, going-out-of-business sales that never end, and a single store that undercuts Amazon and Costco by half are classic signs. Legitimate retailers cannot sell below cost for long.

6. Look at how they want to be paid

• Safe: credit cards and PayPal, because both let you dispute a charge.
• Risky: debit cards, which pull money from your checking account directly.
• Walk away: Zelle, Venmo, Cash App, wire transfer, cryptocurrency or gift cards. No real store insists on these, and the money is almost impossible to recover.

7. Find a real address and phone number

Scroll to the bottom of the page and open Contact Us. A legitimate business lists a street address you can look up on a map and a phone number a person answers. Only a contact form, only a Gmail address, or an address that turns out to be a house or empty lot is a warning.

8. Search the name with the word scam

Type the store name followed by scam or reviews into Google. Also check the Better Business Bureau Scam Tracker. Ignore the reviews on the site itself — those are easy to fake. Be suspicious of a store with no outside reviews at all.

9. Read the return and privacy policies

Fake sites often copy policies from other stores word for word, leaving in another company's name, or have policies full of odd grammar. A real return policy tells you where to send items and how long refunds take.

10. Watch for pressure tactics

Countdown timers, only 2 left in stock banners, pop-ups saying your computer is infected, or warnings that your account will close today are designed to stop you from thinking. Real businesses let you take your time.

11. Run it through a free checker

Paste the full address into our free Link Check tool. It checks the address against known phishing and malware lists and looks for look-alike tricks, and gives you a plain-English verdict in seconds, with no account needed.

The most common fake websites targeting retirees in 2026

• Fake online stores advertised on Facebook and Instagram selling furniture, garden tools, clothing or discounted brand-name items that never arrive.
• Fake bank, Medicare, Social Security and Amazon login pages reached from texts and emails, built to steal your password.
• Fake tech-support pages that freeze your browser with an alarm and a phone number to call.
• Fake package-delivery and toll-payment sites asking for a small fee and your card number.
• Fake investment and cryptocurrency platforms showing impressive, invented returns.
• Fake government sites charging for services that are free, such as passport renewals or Medicare cards.

What to do if you already used a fake website

1. Call the number on the back of your card and report the charge as fraud. Ask for a chargeback and a new card.
2. If you paid by PayPal, open a dispute in the Resolution Center within 180 days.
3. If you typed a password on the site, change it right away on the real site, and on any other account that used the same password.
4. Turn on two-factor authentication for your email and bank.
5. Watch your statements for the next few months, including small test charges of a dollar or two.
6. Report the site to the FTC at ReportFraud.ftc.gov and the FBI at ic3.gov. If you are over 60, you can also call the National Elder Fraud Hotline at 1-833-372-8311.

Simple habits that prevent most website scams

• Bookmark the sites you use for banking, shopping and Medicare, and only use those bookmarks.
• Never click to buy from a social media ad. Search for the store separately first.
• Use a credit card, not a debit card, for online purchases.
• Keep your browser and phone updated so built-in scam warnings stay current.
• Use a password manager — it will refuse to fill in your password on a look-alike site, which is a free early warning.
• Ask a family member or trusted friend to take a second look before any purchase that feels rushed.

Staying safe online in retirement does not require becoming a technology expert. It comes down to one habit: slow down, go to companies directly, and let a two-minute check decide whether a website earns your money.