--- title: "How to find out if a website is legitimate: what a safety scanner can't tell you" url: https://isthereathing.com/blog/how-to-tell-if-a-website-is-legitimate-what-scanners-miss/ summary: "No single checker proves a site is legitimate, because a scanner only tells you whether the site is already flagged as dangerous. Also check who runs the shop and whether it can be traced, and pay by credit card where you can." published: 2026-10-22 updated: 2026-10-22 author: "Jack Stovell" publisher: "Adapt Progress Evolve Limited" language: en-GB --- # How to find out if a website is legitimate: what a safety scanner can't tell you *By Jack Stovell. Published 22 October 2026.* No single checker proves a site is legitimate, because a scanner only tells you whether the site is already flagged as dangerous. Also check who runs the shop and whether it can be traced, and pay by credit card where you can. Short answer: run a scanner as your first check, and don't stop there. The checks that protect your money are about the business behind the site and how you pay, and none of them needs special software. ## A clean scan does not mean a legitimate shop You paste a link into a checker, it comes back green, and it feels like the job is done. The trouble is that a scanner answers a different question from yours. It asks whether the site is known to be dangerous. You want to know whether you will get your goods and keep your money. A shop can be completely free of malware and still never post anything. Google Safe Browsing shows what a scanner actually does. Google says it looks for unsafe sites: phishing and other deceptive pages, and sites that host malware or unwanted software. Its site status search tells you whether a site is currently dangerous to visit. It does not check whether a shop is a real business that delivers. A fake shop that opened last week may not have been reported to anyone yet. The padlock has the same limit. HTTPS means the connection between your device and the site is encrypted, so nobody else can read what you send. Get Safe Online points out that a fraudster's payment page can have the padlock too, and then you are simply connected securely to the fraudster. The padlock tells you about the connection. It tells you nothing about who owns the site. ## Step 1: Run the scanner, then stop relying on it Do run it. It is quick, and it catches sites that are already known for phishing or malware. Our [roundup of sites that check whether a link is safe](/a-website-that-can-check-if-a-link-is-safe/) covers the options, so use that for this step. If the result is flagged, leave. If it is clean, count it as one small tick and carry on, because it tells you very little about the shop itself. ## Step 2: Find out who is actually behind the site This check matters most, and it takes less time than it sounds. Under the Consumer Contracts Regulations, a trader selling to you at a distance must give you its identity and the geographical address where it is established. So look for a business name and a real postal address, usually in the footer, the terms or the about page. A contact form and a logo are not enough. If the site says it is a UK company, look it up on Companies House. A company's overview shows its number, registered office address, status, company type and the date it was incorporated. Compare these with the site. Does the name match? Is the company active? Does the incorporation date fit what the shop says about how long it has been trading? Companies House says it does not check the accuracy of what companies file, so a match is a good sign but not a guarantee. A missing or mismatched company number is a much clearer warning. For investments, loans, insurance or other financial services, use the FCA instead. Its Firm Checker tells you whether a firm is authorised for the service it is offering. Its Warning List names firms the FCA believes are operating without permission. The FCA warns that a firm missing from the Warning List may still be unauthorised or a scam, and that scammers clone the details of genuine firms. If a site claims to be authorised and the Firm Checker says otherwise, stop there. A domain lookup is also worth a quick look. ICANN's registration data lookup shows a domain's current registration record, which can reveal that it was registered very recently. Treat that as a nudge and nothing more. Plenty of honest new shops have young domains, and an old domain says little about who owns it now. ## Step 3: Check the site can be traced and contacted Look for a postal address, a phone number and an email address on a domain that matches the shop's own. Then check that these details agree with each other. Is the address on the contact page the same as the one in the terms? Does it match the registered office you found, or at least make sense for that company? Small mismatches like these are some of the clearest warnings you will get. Read the returns and delivery pages. A shop that really sells things tends to have dull, specific policies, because it has had to deal with returns. Vague, missing or obviously copied policies are a bad sign. Check the web address itself, too. The NCSC warns that criminals copy the look of genuine stores and use domains that are easy to mistake for the real one. For a shop you already know, type its address yourself instead of following a link. You can also email a simple question before you buy, such as when an item will ship. If nobody replies, or the reply dodges the question, that tells you something. ## Step 4: Treat reviews and trust badges as claims to verify A trust badge is just an image, and anyone can paste one onto a page. Click it. A genuine badge should take you to the organisation that issued it, and that organisation should list the shop. Testimonials on the shop's own pages are the shop describing itself. Look for reviews on sites the shop does not control, and be wary of reviews that are all glowing, all recent and all written in the same voice. If you suspect the product photos or review text were generated, see the roundups of tools that [detect AI images](/a-website-that-can-detect-ai-images/) and [detect AI writing](/a-tool-that-detects-ai-writing/). The same caveat applies as with the scanner: a result is one piece of evidence, never proof. ## Step 5: Pay in the way that protects you How you pay decides what you can do if things go wrong, so decide before you reach the checkout. A credit card gives you the strongest position. Under Section 75 of the Consumer Credit Act, you can claim from your card provider as well as from the seller when something goes wrong with a purchase, as long as the price falls within the range the Act sets. Citizens Advice notes that the range applies to each item rather than the whole order, and that you usually cannot use Section 75 if you did not buy directly from the trader. Check its current guidance for the exact limits before you rely on them. A debit card gives you less. You can ask your bank to make a chargeback on your behalf. It is not a legal right, and Citizens Advice warns that your bank might not agree to it. A bank transfer is the weakest option. The NCSC's advice is never to pay by direct bank transfer when shopping online. If a shop only takes bank transfers or unusual payment methods, that is reason enough to walk away. ## A worked example: a shop that passes the scan and fails the rest This example is hypothetical, made up to show how the checks fit together. You find a shop selling trainers well below the usual price. The link checker says clean and the padlock is there. Then you look closer. The footer has a copyright line and no business name. There is a contact form and no address. A Companies House search for the name in the logo finds nothing that matches. The domain lookup shows a very recent registration, which proves nothing on its own but fits the pattern. Every review is on the shop's own pages, and they all read the same. The checkout offers bank transfer only. The scan was accurate, because the site was not a known phishing or malware page. It just answered a question you were not asking. Every check that did answer your question came back badly. ## If you have already paid or entered details Act quickly. Contact your bank or card provider using the details on your card or its official website, never contact details from the shop or from a message. If you paid by credit card, ask about Section 75. If you paid by debit card, ask about a chargeback. If you entered a password on the site, change it, and also change it anywhere else you used the same one. Then report it. Send the web address to the NCSC's suspicious website reporting service, which investigates reports and may share them with law enforcement. To report the crime itself, use Report Fraud (formerly Action Fraud) if you live in England, Wales or Northern Ireland, or contact Police Scotland if you live in Scotland. The NCSC says reporting helps protect others online. ## Quick order of checks 1. Scan the link, and treat a clean result as one small tick. 2. Find the business name and address, and check them at Companies House, or with the FCA for financial firms. 3. Make sure the contact details, address and policies all agree. 4. Check reviews and badges somewhere other than the shop's own site. 5. Pay by credit card where you can, and never by bank transfer. To see how this site checks the tools it lists, read [how we check](/how-we-check/), or browse the other [safety and privacy questions](/categories/safety-privacy/). ## Sources - [Google Transparency Report: Safe Browsing site status](https://transparencyreport.google.com/safe-browsing/search) - [Google Safe Browsing (developers overview)](https://developers.google.com/safe-browsing) - [Get Safe Online: 'https' and green padlock, safe or not?](https://www.getsafeonline.org/personal/blog-item/https-and-green-padlock-safe-or-not/) - [Companies House: Find and update company information](https://find-and-update.company-information.service.gov.uk/) - [FCA Warning List of unauthorised firms](https://www.fca.org.uk/consumers/warning-list-unauthorised-firms) - [Consumer Contracts Regulations 2013, Schedule 2](https://www.legislation.gov.uk/uksi/2013/3134/schedule/2) - [GOV.UK: Online and distance selling for businesses](https://www.gov.uk/online-and-distance-selling-for-businesses) - [Citizens Advice: Getting your money back if you paid by card or PayPal](https://www.citizensadvice.org.uk/consumer/somethings-gone-wrong-with-a-purchase/getting-your-money-back-if-you-paid-by-card-or-paypal/) - [NCSC: Shopping and paying safely online](https://www.ncsc.gov.uk/guidance/shopping-online-securely) - [NCSC: Report a scam website](https://www.ncsc.gov.uk/section/about-this-website/report-scam-website) - [Report Fraud (formerly Action Fraud)](https://www.actionfraud.police.uk/) - [ICANN registration data lookup tool](https://lookup.icann.org/en) ## Questions people ask ### How do I know if I'm on a safe website? A scanner such as Google Safe Browsing tells you whether a site is currently known for phishing or malware. It cannot tell you whether a shop is a genuine business. For that, check who runs the site, whether its name and address check out on official registers, and how you will pay. ### Can a website have HTTPS and still be a scam? Yes. The padlock means your connection to the site is encrypted, and a fraudster's site can have one too. In that case you are simply connected securely to the fraudster. ### How do I check if a UK company is real? Search for it on Companies House. A company's overview shows its number, registered office address, status and the date it was incorporated, so you can compare these with what the website claims. Companies House does not check the accuracy of what companies file, so a match is a good sign but not a guarantee. For financial firms, use the FCA Firm Checker and Warning List. ### What should I do if I paid a fake website? Contact your bank or card provider straight away, using the official number or website. For a credit card payment, ask about Section 75. For a debit card payment, ask about a chargeback, which is not a legal right. Change any password you entered there or reused elsewhere. Report the site to the NCSC, and report the crime to Report Fraud in England, Wales or Northern Ireland, or to Police Scotland.