How to Spot Fake Websites: Eight Verification Checks

Fake websites cost people money and give researchers bad data. Cloned shops take payment for goods that never ship, phishing pages collect passwords, and impersonation sites borrow the name of a bank, a charity or a government agency. The Anti-Phishing Working Group (APWG) counted 932,923 phishing attacks in the third quarter of 2024 and 989,123 in the fourth, about 1.9 million in the second half of the year (APWG phishing trends report). In a Pew Research Center survey of 9,397 U.S. adults in April 2025, 36% said they had at some point bought something online that never arrived or was counterfeit and was not refunded (Pew online shopping survey). U.S. consumers reported $15.9 billion in fraud losses to the Federal Trade Commission in 2025, up from over $12 billion the year before (FTC fraud testimony).

Even well-built fakes can leave traces. This guide sets out eight checks, from the homepage to the domain registration record, that a researcher, journalist or careful consumer can run with a browser and a search engine. It covers the website as a whole: who runs it, where it is registered and whether its claims hold up. For a closer look at fabricated material on individual pages, see the companion guide the visual fact-checking guide. Apply the same independent identity checks to claimed social media profiles.

Table 1. Selected figures on fake websites and related fraud, with source and period. These figures concern different populations, methods, and periods: they are context, not directly comparable estimates of fake-website prevalence. The Deloitte figure is a projection, not a measured loss.

Why Fake Websites Are Harder to Spot Than They Were

Poor spelling, clumsy design and awkward language used to give most fake sites away. Those cues are now unreliable. Generative AI tools produce professional layouts, plausible policy pages and fluent copy on demand. KnowBe4 found some use of AI in 82.6% of the phishing emails it analyzed between September 2024 and February 2025 (KnowBe4 phishing report), and Deloitte’s Center for Financial Services projects that fraud losses enabled by generative AI could reach US$40 billion in the United States by 2027 (Deloitte fraud projection).

Automated checks have limits too. A website can show different content to automated visitors than to people, a technique known as cloaking. In October 2025, researchers at the security firm SPLX showed that sites can recognize AI agents and crawlers and serve them altered content, which then shaped what those AI tools reported to their users (AI cloaking experiment). An automated scan or an AI summary of a site may therefore not reflect what a human visitor sees. No single tool settles the question; combine independent identity checks, technical signals, and source review. Do not enter credentials, pay, download files, or grant permissions while investigating an untrusted site. If a browser blocks it, do not bypass the warning.

Step 1: Start With the Homepage

The homepage is often where deception begins, and a careful reviewer can spot several problems at this stage.

Examine the logo

Fake websites may copy or alter logos. Low image quality can be a clue, but compression, resizing, or an outdated asset can also affect legitimate websites. Zoom in: blurred edges, unevenly rendered lettering or colors that look slightly off against the rest of the page suggest a copied asset.

To confirm, run the logo through a reverse image search such as Google Lens, TinEye or Bing Visual Search. If results lead elsewhere, investigate whether the logo is licensed, shared, or being used to impersonate another organization. A match alone does not establish fraud. Compare results across image-search engines and confirm the original context.

Test the navigation

Inspect navigation destinations without following unexpected redirects. Dead links and placeholder pages can justify closer review, but also occur on legitimate sites. Avoid unnecessary interaction with a suspected phishing page.

Right-click a suspicious menu and select “Inspect” in your browser. Menus can use links, buttons, scripts, or linked images. An image-based menu is not proof of fraud; assess whether its destinations and behavior match the claimed organization.

Count the ads

Pop-ups, interstitial ads, countdown-timer discounts and aggressive clickbait on a site that claims to be a retailer or professional firm do not fit its stated purpose. Established businesses in these sectors rarely place third-party ads on their own About or service pages.

Step 2: Read the Fine Print — Literally

Legal pages are an underrated diagnostic tool. Privacy policies, terms of use and disclaimers are expected in most jurisdictions, and they take time and expertise to draft properly.

Fake website operators often copy these pages. To check, copy a distinctive sentence of 8 to 15 words from the suspect site’s privacy policy and search for it in quotation marks. Repeated wording can come from a shared template or legal service. Investigate mismatched company names, contact details, dates, and practices; duplication alone does not prove fraud.

Make sure the policy fits the organization the site claims to be. Applicable privacy rules depend on jurisdiction, public or private status, activities, and the people served. Check whether the named entity and described practices fit the site. A policy’s legal references alone do not determine compliance or authenticity.

Step 3: Investigate the “About Us” Page

The “About Us” page exists to build trust, which makes it the page most likely to be fabricated on a dishonest site. Evaluate it against five criteria:

• Mission and organizational philosophy: Is there a coherent statement of purpose with specific claims you can check?
• Business structure: Is the legal entity named, and can its formation date be found in a public business registry?
• Team photos and credentials: Can the named people be found on LinkedIn, in professional directories or in news coverage?
• Email addresses: Do they use the company’s own domain name rather than a free webmail service?
• Partner logos and awards: Can each claimed affiliation be confirmed on the awarding or partner organization’s own website?

Use these questions as prompts, not a validated scoring system. A small business may lack a public team page or partner list. Resolve material inconsistencies through independent records rather than counting checked boxes.

Next, run the team photos through a reverse image search. Fake websites routinely use stock photography to stand in for a management team that does not exist. Stock portraits share recognizable traits: studio lighting, clean generic backgrounds with no personal items or brand material, exaggerated expressions and complete brand neutrality.

If a reverse image search on a “CEO” photo returns results from a stock-photo library, or shows the same face on other websites under different names, the image does not substantiate the claimed identity. It may be a placeholder, a licensed portrait, or impersonation; verify the named person independently.

Watch for AI-generated faces

Image generators can produce portrait-quality photographs of people who do not exist. A newly generated face may have no reverse-image matches, but the same is true of an unpublished genuine photo. A synthetic image may also be reused and produce matches. In a peer-reviewed study, participants could not reliably tell AI-synthesized faces from real photographs and rated the synthetic faces as more trustworthy (Synthetic face perception study). Look for artifacts such as hair at the edge of the frame blending into the background, asymmetric or incomplete ears, mismatched earrings, distorted backgrounds and inconsistent reflections in the eyes. Detection services such as Hive Moderation and Illuminarty estimate the probability that an image is AI-generated. Treat the score as one signal, not a verdict.

Step 4: Verify Contact Information Independently

Fraudulent sites tend to avoid direct contact, and their contact pages often leave details out or invent them.

Address: Enter the physical address in a map service and use street-level imagery to see whether the location fits the business. A large-company claim paired with an unexplained residential or mail-forwarding address warrants a check. Remote firms, registered offices, stale maps, and virtual offices can have legitimate explanations.

Phone numbers: Compare the phone number with independently published business details; area codes and caller ID alone do not verify location or identity because numbers can be ported, virtual, or spoofed. Look the number up in a reverse phone directory or caller-name (CNAM) lookup, and search for it online and on social media to see whether it is tied to the business.

Email addresses: An email on the claimed organization’s verified domain is a useful consistency check, but legitimate small businesses may use webmail. A plausible lookalike address does not establish affiliation; compare it with the brand’s independently confirmed contact channels. Mailbox-verification services can test whether an address exists, but a working mailbox only shows that someone set it up, not who.

Never use the contact details on a suspect site to vouch for the site. Find the organization’s details through an independent source, such as a government registry or a link you already trust, and contact it that way. CISA gives the same advice for suspicious messages: do not use the links or numbers in the message, and type the known address yourself (CISA phishing guidance).

Step 5: Check the Padlock — Then Go Deeper

A padlock icon in the address bar shows an encrypted connection, not a legitimate site. In 2019 the FBI warned that criminals exploit public trust in HTTPS and the padlock, and advised people not to trust a site just because it displays them (FBI HTTPS phishing warning). Free certificates are widely available and scam sites use them. Let’s Encrypt, for example, issues only Domain Validation certificates, which confirm control of a domain name rather than the identity of the organization behind it (Certificate authority FAQ).

What the padlock check should include:

• Open the certificate details: Note the issuer and the type of validation. A domain-validated certificate confirms domain control only and says nothing about who runs the site.
• Check the dates: A current certificate’s issuance date is not the website’s launch date. Legitimate sites renew short-lived certificates routinely. Assess domain history separately (Step 8).
• Check the name: First compare the address-bar hostname with the organization’s independently verified domain. Certificates can cover multiple hostnames or wildcards; a valid certificate for a lookalike domain still does not establish the brand’s identity.
• Heed “Not secure” warnings: Do not enter information on any login or checkout page that shows this warning.

Step 6: Scrutinize Product Listings and Checkout

Fake e-commerce sites exist to collect payments and personal data. Before any transaction, carry out a structured review.

Compare product photographs, model numbers, specifications, and any applicable regulatory or certification claims against the manufacturer’s information. CE, FCC, UL, and CSA marks serve different purposes and are not required on every product. Compare colors and label fonts with the official brand’s product images. Counterfeits often show small differences in color and font weight that are hard to see at thumbnail size but clear at full resolution.

A trust seal is only an assertion until checked. Where an issuer offers a public validation service, reach it independently and confirm that the record covers the same domain. Some legitimate logos are static; neither a clickable badge nor a static image establishes authenticity. Avoid following badge links on a suspected malicious site.

Refund and return policies should be clear, specific and easy to reach from the checkout page. Vague or restrictive terms often indicate a site that does not intend to handle returns honestly.

Pre-checked subscription boxes are common in scam checkout flows. Scroll through the whole checkout page and uncheck any auto-renewal or subscription you did not choose.

Step 7: Evaluate Reviews — With Skepticism

Customer reviews provide social proof, but in e-commerce they are often manipulated. Distinguish third-party reviews, collected independently on platforms such as Google Reviews, Yelp or Trustpilot, from testimonials published on the website, which the site owner selects. Assume on-site testimonials are curated and rely on independent platforms. In the United States, the FTC’s rule on consumer reviews and testimonials, in force since October 21, 2024, prohibits fake reviews and testimonials, and the Commission has said that AI-generated fake reviews are covered (FTC consumer reviews rule). The rule makes fake reviews unlawful; it does not make them rare.

When reading reviews, watch for:

• clusters of reviews posted within a narrow date range, particularly around a business’s launch;
• the same promotional vocabulary repeated across several reviews, which suggests templated text;
• reviews dated before the domain was registered (compare with Step 8);
• reviewer profiles with one review and no other history.

A quick copy check also helps: paste two to four distinctive phrases from a review into a search engine in quotation marks. If the text appears word for word on several platforms, check whether it was cross-posted, syndicated, copied, or coordinated. Identical text is a lead, not conclusive proof of fabrication.

Step 8: Check the Domain Registration

Before trusting an unfamiliar website, spend a minute on its domain registration record. For generic top-level domains such as .com and .org, ICANN made the Registration Data Access Protocol (RDAP) the definitive source of registration data on January 28, 2025, replacing the old WHOIS services, and points users to its ICANN Lookup tool (ICANN RDAP announcement). Country-code domains such as .ca or .uk are run by national registries, which publish their own lookup services.

The record will show:

• Registration date: If a website claims to have served customers for ten years but its domain was registered three months ago, investigate the discrepancy. Rebranding, a new domain, transfer, or re-registration can explain it; domain age alone does not establish business age or fraud.
• Registrar and jurisdiction: A registrar’s country is not the registrant’s location. Verify any financial institution directly in the appropriate official regulator’s register and use the domain published there.
• Status and nameservers: Nameservers and status fields describe technical configuration. Short registration terms, shared hosting, and changes can be legitimate; evaluate them alongside documented domain history and independent identity evidence.

Methods note: reading a registration record

Registrant names and contact details are now usually redacted for privacy, so an anonymous record is normal and is not, on its own, evidence of fraud. Concentrate on the fields that remain visible, especially the creation date, and compare them with what the site says about itself. Archived copies in the Internet Archive’s Wayback Machine show whether the domain previously hosted something different. Check the spelling of the domain too: CISA lists incorrect addresses such as “amazan.com” among the signs of phishing (CISA phishing guidance). Some commercial services link domains that share a registrant, nameserver or analytics code, which can suggest relationships, but shared hosting, analytics services, or nameservers alone do not prove common ownership. Record the date and time of every lookup, because registration data can change.

AI-Era Checks

In addition to the eight steps, a few checks address techniques that generative AI has made cheaper.

AI-generated images: Apply the face checks from Step 3 to product shots and “customer” photos as well as team portraits.

Video deepfakes: A meta-analysis of 56 studies found that correct identification of deepfake stimuli averaged 55.54% (95% confidence interval 48.87%–62.10%); for video it was 57.31% (47.80%–66.57%). These intervals include chance performance and results vary by task and stimulus (Human deepfake detection study). Do not rely on your eyes alone. The InVID-WeVerify browser plug-in supports keyframe extraction for reverse searches and metadata checks. For a full method, see the visual fact-checking guide.

AI content farms: By its update of June 23, 2026, NewsGuard had identified 3,749 AI content farm news and information websites in 16 languages. Its criteria are a substantial share of AI-produced content, little sign of human oversight, a presentation that suggests human journalists wrote it and no clear disclosure of AI use (NewsGuard AI tracking center).

Website safety checkers: useful, but not on their own

Reputation tools give a fast first opinion. ScamAdviser produces a trust score for a domain, URLVoid checks a URL against several blocklists, PhishTank is a community database of reported phishing URLs, and Google’s Safe Browsing site status tool shows whether Google currently flags a site as dangerous. Safe Browsing’s list is also used in Chrome, Firefox and Safari (Google Safe Browsing overview). These tools can miss new and cloaked sites, so a clean result means the service did not flag the URL at that time; it does not prove that the site is genuine.

Your Quick Verification Checklist

When evaluating an unfamiliar website, work through these checks in order. They are grouped by the time they take, so you can stop once you have enough evidence or continue if doubt remains.

First 90 seconds: visual triage

• The logo and branding have been compared with the independently located official site.
• Navigation destinations fit the claimed organization; unnecessary clicks on a suspect site are avoided.
• The URL is spelled correctly, with no character substitutions such as “rn” for “m”.
• The connection is encrypted on every page and no “Not secure” warning appears.
• Copyright and age claims are treated as assertions to verify, not trust guarantees.

Two to five minutes: content verification

• Policy names, contacts, and described practices fit the organization; template wording is not treated as proof of fraud.
• Material About Us claims have been checked against independent evidence.
• At least one named team member can be found on LinkedIn or in a professional directory.
• The physical address matches the business on street-level imagery.
• Polished language is not treated as evidence of legitimacy; factual claims have been checked.

Five to ten minutes: deeper verification

• The domain’s creation date in ICANN Lookup or the national registry is consistent with the site’s claimed age.
• Team identities and product claims are independently corroborated; a missing reverse-image match or detector score is not treated as proof.
• Contact details are consistent with independently verified organizational records.
• Any material trust-seal claim has been confirmed independently with its issuer where verification is available.
• A search for the business name with “reviews”, “scam” and “complaint” turns up nothing of concern.
• Independent review platforms, and in North America the Better Business Bureau, have been checked.
• The URL has been checked in Google Safe Browsing and at least one other reputation tool.
• Any video on the site has been checked with keyframe reverse searches.

If You Find a Fake Website: Report It

Reports help get fake sites blocked and taken down. In the United States, report fraud to the FTC at ReportFraud.ftc.gov and forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org (FTC phishing advice). In the United Kingdom, the National Cyber Security Centre accepts reports of suspicious websites. It can analyze them, seek to block malicious addresses and work with hosting companies to remove them, but it does not investigate crimes, which should be reported to the police reporting services (NCSC scam reporting guide). Dangerous sites can also be reported to Google Safe Browsing.

Before reporting, researchers should keep a dated record of what they found, with screenshots, the URL and the registration data, because fake sites often disappear quickly.

Conclusion

Fake websites are a large and organized problem, and the most convincing ones can look genuine to people and to automated scanners alike. Relying only on browser security indicators or on a site’s appearance is not enough.

The checks in this guide are not technically complex. They need a browser, a search engine, a registration lookup and a few minutes of focused attention. Above all, they need the discipline to apply them before any significant transaction with, or citation of, an unfamiliar website.

References

1. Anti-Phishing Working Group. (2025, March 19). Phishing activity trends report: 4th quarter 2024. APWG phishing trends report.
2. Cybersecurity and Infrastructure Security Agency. Recognize and report phishing. Retrieved November 4, 2026, from CISA phishing guidance.
3. Diel, A., Lalgi, T., Schröter, I. C., MacDorman, K. F., Teufel, M., & Bäuerle, A. (2024). Human performance in detecting deepfakes: A systematic review and meta-analysis of 56 papers. Computers in Human Behavior Reports, 16, 100538. Human deepfake detection study.
4. Federal Bureau of Investigation, Internet Crime Complaint Center. (2019, June 10). Cyber actors exploit ‘secure’ websites in phishing campaigns (Alert No. I-061019-PSA). FBI HTTPS phishing warning.
5. Federal Trade Commission. (2024, August 22). Trade regulation rule on the use of consumer reviews and testimonials. Federal Register, 89(163). FTC consumer reviews rule.
6. Federal Trade Commission. (2026, March 25). Prepared statement of the Federal Trade Commission [Testimony of L. Greisman before the U.S. Congress Joint Economic Committee]. FTC fraud testimony.
7. Federal Trade Commission. How to recognize and avoid phishing scams. Consumer Advice. Retrieved November 4, 2026, from FTC phishing advice.
8. ICANN. (2025, January 27). ICANN update: Launching RDAP; sunsetting WHOIS. ICANN RDAP announcement.
9. KnowBe4. (2025, March 20). New KnowBe4 report reveals a spike in ransomware payloads and AI-powered polymorphic phishing campaigns [Press release]. KnowBe4 phishing report.
10. Lalchand, S., Srinivas, V., Maggiore, B., & Henderson, J. (2024, May 29). Generative AI is expected to magnify the risk of deepfakes and other fraud in banking. Deloitte Insights. Deloitte fraud projection.
11. Leppert, R. (2025, November 19). About a third of Americans say they’ve had an online shopping scam happen to them. Pew Research Center. Pew online shopping survey.
12. Let’s Encrypt. FAQ. Retrieved November 4, 2026, from Certificate authority FAQ.
13. National Cyber Security Centre. Report a scam website. Retrieved November 4, 2026, from NCSC scam reporting guide.
14. NewsGuard. (2026, June 23). AI tracking center [Last updated]. NewsGuard AI tracking center.
15. Nightingale, S. J., & Farid, H. (2022). AI-synthesized faces are indistinguishable from real faces and more trustworthy. Proceedings of the National Academy of Sciences, 119(8), e2120481119. Synthetic face perception study.
16. Somogyi, S., & Miller, A. (2017, September 11). Safe Browsing: Protecting more than 3 billion devices worldwide, automatically. Google. Google Safe Browsing overview.
17. Vlahov, I., & Eymery, B. (2025, October 25). OpenAI’s new browser Atlas falls for AI-targeted cloaking attack. SPLX. AI cloaking experiment.