Online shopping safety: how to check a website is genuine

Last checked November 2026. Offers and rules change: confirm with the provider before you rely on them.

Shopping online is safe when you buy from a genuine retailer, on its real website, and pay by card. The risk comes from fake shops and copycat sites, and a few two-minute checks will keep you clear of nearly all of them.

The padlock and "https": what they do and do not mean

Look at the address bar at the top of your screen. A secure page has an address beginning https:// (the "s" stands for secure), and many browsers show a small padlock or a similar symbol beside it. This means the information you type, such as your card number, is scrambled on its way to the website so nobody can read it in transit.

It is a necessary check: never type card details into a page without https. But it is not enough on its own.

Watch out: The padlock tells you the connection is private. It does not tell you the shop is honest. Fraudsters can and do set up fake shops with a padlock.

Check the web address letter by letter

Copycat sites use addresses that look right at a glance: an extra hyphen, a swapped letter, or a well-known name followed by something odd such as "-outlet-sale.shop". Read the address slowly. If you reached the site by clicking an advert, a link in an email or a social media post, close it and type the retailer's address in yourself.

Seven signs of a fake shop

Prices that are too good. A well-known brand at 70 or 80 per cent off, on everything, is the classic sign.
No real contact details. A genuine business gives a company name and a geographic postal address. A contact form alone is not enough.
Bank transfer only. A shop that will not take cards, or pushes you to pay by transfer for a "discount", should be avoided.
A countdown clock or "only 2 left". Pressure is a sales trick at best and a scam sign at worst.
Clumsy wording. Odd English, pictures that do not match, or a returns policy that makes no sense.
A very new website. Fake shops appear and vanish within weeks, often just before Christmas or Black Friday.
Found only through an advert. Many fake shops rely on social media adverts rather than being found by name.

How to check a retailer you have not used before

Search for the shop's name plus the word "reviews" or "scam". Look for reviews on independent sites rather than on the shop's own pages. A flood of identical five-star reviews posted in the same week is itself a warning.
Find the company details. UK companies should show their registered name and address, usually at the foot of the page or under "About us" or "Terms". You can look a limited company up free on the Companies House service on gov.uk.
Read the returns policy. A UK retailer selling online must normally give you 14 days to change your mind. A site that says "no returns" on ordinary goods either does not know the law or does not intend to follow it.
Check where it ships from. If goods come from overseas, delivery may take weeks, returns can be expensive and UK consumer law is harder to enforce.
Ask someone. A quick word with a relative or friend costs nothing. If they have never heard of the shop either, think again.

Tip: If you want the item but are unsure of the shop, see whether a retailer you already trust sells the same thing. Paying a few pounds more for a shop with a UK address and a working phone line is often the real bargain.

Safe habits for every order

Pay by card. A credit card gives the strongest protection on purchases over £100; see paying safely online.
Use a different password for each shop, so one leaked password cannot open the others. Passwords made simple explains how.
Shop on your home broadband or mobile data rather than free public Wi-Fi in a café or on a train, particularly when typing card details.
Keep your device up to date. When your phone, tablet or computer offers an update, accept it. Updates fix security weaknesses.
Only give what is needed. A shop needs your name, address, email and payment. It does not need your National Insurance number or your bank PIN.
Keep the confirmation email until the goods have arrived and you are satisfied.

Emails and texts after you order

Once you have ordered something, you will be expecting messages about it, and fraudsters know that. A genuine dispatch email will quote your order number and will not ask for your card details again. If a message asks you to "confirm your details" or pay a fee, do not click. Go to the retailer's website yourself and look at your order there. More examples are in spotting scams.

If you think you have used a fake shop

Ring your bank or card provider at once on the number on the back of your card, or dial 159 to be put through to your bank safely.
Change the password you used on that site, and anywhere else you use the same one.
Report it. In England, Wales and Northern Ireland use Report Fraud (the service that replaced Action Fraud) online at reportfraud.police.uk or on 0300 123 2040. In Scotland, ring Police Scotland on 101.

Common questions

Does the padlock mean a website is safe to buy from?

No. It means the connection is encrypted, so others cannot read what you type. You still need to check that the shop itself is genuine.

Are big marketplaces safer than small shops?

They offer buyer-protection schemes, but the seller may be a separate business or a private person. Our guide to buying on marketplaces explains how to tell.

Is it safe to let a website save my card details?

With a large, established retailer it is a reasonable convenience. If you would rather not, leave the "save my card" box unticked; it just means typing the number each time.

How can I tell if a review is fake?

Be wary of very short, gushing reviews posted close together, and of products with no critical reviews at all. Read the three- and four-star reviews: they tend to be the most honest. See also your consumer rights if the goods are not as described.