Scam Website Checker: Spot a Fake Site (and Check Your Own)

You landed on a site you've never heard of, and something feels off. Maybe the discount is absurd, maybe the checkout page looks thrown together, or maybe you want a second opinion before typing in a card number. That's what a scam website checker is for: a way to tell a real business from a page built to take your money and disappear.

This post covers both halves. First, the red flags a scam website checker looks for, plus a manual check you can run in under two minutes, no tool required. Second, a flip that matters if the site in question is yours: passing every one of these checks proves you're not running a scam, not that your app isn't quietly leaking its users' data, which happens to honest, well-meaning teams more often than most founders expect.

⚡ TL;DR

• Real scam sites share a small set of tells: a brand-new domain, a lookalike URL, no contact info or terms of service, deals that are too good to be true, pressure tactics, no HTTPS or a mismatched certificate, reused stock photos, gift-card-only payment, and reviews that don't exist anywhere off the site.
• A two-minute manual check catches most of these without installing anything.
• Blocklist-based checkers are useful but only flag domains someone has already reported; a scam domain registered yesterday still comes back clean.
• "Not a scam" and "not dangerous" are different questions. A legitimate app built with AI coding tools can still leak user data even when nobody involved intended harm.

The red flags a scam website checker looks for

None of these prove fraud on their own, but two or three together are worth walking away from.

• A domain that's only weeks old. Scammers register a domain, run it hard for a short stretch, then abandon it once complaints pile up. A domain age lookup (most registrars and WHOIS tools show this for free) is one of the fastest tells.
• A lookalike or misspelled URL. An extra hyphen, a swapped letter, or the wrong ending (.net instead of .com for a brand you know as .com) is built to pass a glance, not a read.
• No contact details or terms of service. A real business gives you a way to reach a human: a support email that isn't a free webmail address, a physical address, or at minimum a terms of service and privacy policy page.
• Deals that are too good to be true. An 80 percent discount on a name brand, a job offer with no interview, a return of 20 percent a month. The oldest tell in the book, still working.
• Pressure and countdown tactics. A timer that resets every reload, "only 2 left," or a warning that your account will be suspended within the hour. Urgency skips the part of your brain that would otherwise ask questions.
• No HTTPS, or a certificate that doesn't match the site. HTTPS (the padlock icon) means traffic between your browser and the site is encrypted over TLS (Transport Layer Security). Click the padlock and check the certificate name matches the domain you're on. A missing padlock is a flag; a mismatched certificate is worse.
• Reused stock images. Product photos, "team" headshots, and testimonial faces that show up verbatim on other sites. A reverse image search finds this in seconds.
• Payment only by wire transfer, gift card, or cryptocurrency, with no other option. A card payment gives you a dispute path if something goes wrong. A seller who only accepts irreversible payment is telling you something.
• Reviews that all sound the same, or don't exist off the site. Five-star reviews clustered in a week, near-identical phrasing, hosted only on the seller's own page, are worth less than a handful of mixed reviews somewhere you don't control.

How to check if a website is legit in two minutes

Think of this as a fake website checker you can run with nothing but your browser.

1. Hover before you click. Read the actual domain in the link preview or address bar, not the display text.
2. Search off-site, not on-site. Search the site's name plus "scam" or "reviews" in a new tab. What turns up outside the site matters more than anything printed on it.
3. Check the footer. Look for a working contact page, a terms of service link, and a privacy policy.
4. Click the padlock. Confirm the certificate name matches the domain, not a different company.
5. Check the payment options before you pay. No card option at all is a serious flag, not a minor inconvenience.

For a longer walkthrough of vetting a specific site before you buy or sign up, see how to tell if a website is legit and how to tell if a website is safe to use.

Where blocklist-based checkers fall short

Most free dangerous site checkers work off a blocklist: a database of domains already reported as malicious, phishing, or scam. That catches established bad actors instantly, but the blind spot is built in. A domain that went live yesterday hasn't been reported by anyone yet, so it comes back clean, not because it's safe but because nobody has flagged it. That's exactly the gap the manual checklist above covers.

"Not a scam" is a low bar

Every check so far answers one question: is this site trying to take your money or your identity outright. That's a real question. It isn't the only one.

A site can pass every item on that checklist, be run by people with no intent to harm anyone, and still put its users' data at risk because of how it was built, not why. This shows up most in apps assembled quickly with AI coding tools ("vibe coding"), where the person shipping the product often isn't a security specialist and has no way of knowing a gap exists.

CVE-2025-48757, disclosed in May 2025, found 170 of 1,645 scanned Lovable-built apps (10.3 percent) leaking data through missing or misconfigured database permissions, reachable with nothing more than a public key every one of those apps was supposed to ship. None were scam sites; their operators built real products and had no idea the door was open. The Tea app breach the same year is a similar story from a different angle: a legitimate, funded app exposed roughly 72,000 images, including around 13,000 selfies and government IDs, through an unsecured storage bucket, then a second breach exposed more than 1.1 million private messages. Neither app was trying to defraud anyone. Both leaked anyway.

For the fuller pattern, see the vibe-coding breach timeline, and for the direct answer on whether this is common for apps built this way, are vibe-coded apps secure.

If the site you're vetting is your own, this is where the scam checklist stops being useful. You already know your intentions weren't fraudulent. What you don't automatically know is whether your database only shows each user their own rows, whether a secret key ended up in your browser bundle, or whether a storage bucket is open to anyone with a link. Those gaps have nothing to do with fraud and everything to do with configuration.

How to check your own site for both

For your own app, prove two things: that it presents as legitimate, and that it's actually locked down.

Legitimacy, the same checklist above, pointed at yourself: terms of service and privacy policy live and linked, a real contact method, enough domain history to look established, HTTPS with no certificate warnings.

Lock-down, the part a scam checker skips entirely:

• Confirm your database's access rules restrict each user to their own data, not everyone's.
• Open your site's JavaScript in dev tools and search for a secret key that should never have left your server.
• Copy the direct URL of a file that belongs to a logged-in user, then open it in a private, logged-out window to see if it loads for a stranger.

Doing the lock-down half by hand takes real effort and some comfort with dev tools. A free website security scan does it automatically in under a minute.

FAQ

Is there a free tool that checks if a website is a scam?

Yes. Several checkers cross-reference a URL against blocklists of known phishing and scam domains, and catch established bad actors quickly. Their limit is that a brand-new scam domain has no track record to be listed under, so it comes back clean. Pair any blocklist checker with the manual checklist above.

Does having HTTPS mean a website is safe?

No. HTTPS, delivered over TLS, means the connection is encrypted. It's now common on scam sites too, since a certificate is free and easy to get. It tells you the connection is private, not that the operator can be trusted.

My site isn't a scam. Why would a security scan flag it?

Because "not a scam" and "not vulnerable" are different questions. A scan looks for configuration gaps, like a database that hands data to any visitor or a secret key shipped inside the browser bundle, and those have nothing to do with intent. Most flagged sites are run by honest people who never knew the gap existed.

What's the single fastest scam check before buying from a new site?

Search the site's name plus "reviews" or "scam" in a separate tab and read what turns up outside the site itself. A brand-new domain, no off-site reviews, and payment offered only by wire transfer or gift card, together, is the combination worth walking away from.

The bottom line

A scam website checker answers one question: is this site trying to take your money or your identity. The checklist above catches most fake sites before you hand over either. But if the site under review is your own, passing that checklist only proves you're not running a scam, not that your app is safe for the people using it. An attacker can find a missing permission or an exposed key in minutes. Running that same check on your own site first, and again after every change your AI tool ships, is the only way to close the gap before someone else finds it.