How to Recognise Fake Websites

Check a Website Before You Trust It

Fake websites copy the colours, logos, and wording of banks, delivery companies, government services, shops, and social networks. A page can look professional and still be controlled by a criminal. The website address is usually more useful than the design.

Start with the registered domain

The domain is the main part of the address that identifies who controls the site. It appears after https:// and before the next /.

• In https://www.gov.uk/check-passport/, the domain is gov.uk.
• In https://gov.uk.verify-account.co/login, the domain is verify-account.co.
• In https://secure.example-bank.com/, the domain is example-bank.com; secure is only a subdomain.

Read the address carefully from left to right, then identify the final registered name before the path begins. Watch for swapped letters, extra hyphens, unexpected words, and endings that do not match the organisation’s normal website.

Do not treat the padlock as approval

The padlock and https mean the connection is encrypted. They do not prove that the owner is trustworthy. Scam sites can obtain encryption certificates automatically, so check both the domain and the purpose of the page.

Warning signs on the page

Pause when a website:

• says an account will be closed unless you act immediately
• asks for a password, one-time code, recovery phrase, or remote access
• promises a prize, refund, investment return, or parcel release for a small payment
• offers a price that is dramatically lower than every established seller
• provides no verifiable company name, address, returns policy, or support channel
• prevents you from navigating to other parts of the supposed organisation’s site

Spelling mistakes can be a clue, but polished grammar is not proof of safety. Modern scam pages are often well written.

Use an independent route instead

If a message tells you to open a website, avoid its link. Use one of these safer routes:

1. Open the organisation’s official app from your phone.
2. Type an address you already know or use a trusted bookmark.
3. Find the organisation through an official government directory or a statement you already possess.
4. Call the number printed on your bank card, bill, or official document.

Do not rely on the phone number or contact details shown on the suspicious page.

If you already entered information

Close the page and act according to what you shared. Change an exposed password from the genuine service, enable two-step verification, and sign out other sessions. If you entered card or banking information, contact the bank immediately using the number on the card. If you installed software or allowed remote access, disconnect the device from the internet and seek trusted technical help.

For more guidance, read the US Cybersecurity and Infrastructure Security Agency’s advice on recognising and reporting phishing, or use the equivalent national cybersecurity authority in your country.