How to Check if a Website Is Legit to Buy From: 7 Free Checks

The quickest honest answer: a shopping website is worth trusting only when it passes several small checks together, and the one most people rely on, the padlock in the address bar, proves almost nothing. The Federal Trade Commission says it plainly on its online shopping page: the "s" in https means the connection is encrypted, not that the business is real, because scammers can encrypt their sites too.

So instead of one sign, use seven free checks. Together they take about ten minutes, and they matter most for the store you found through an ad and have never bought from before.

A padlock means your card number travels safely. It does not mean anything will ever arrive.

Why does this matter more in November?

Two things in the official record make this the month to slow down.

First, fake stores are a top-tier risk, not a rare one. In the BBB's 2025 Scam Tracker Risk Report, online purchase scams ranked third on the list of riskiest scam types, behind only investment and crypto scams and job scams. The BBB describes the pattern simply: an attractive deal online, payment made, and then nothing delivered, or something low-quality or counterfeit.

Second, the ads themselves are the problem. On November 2, 2026, the FTC asked the public to comment on imposter ads, the paid ads in social feeds, search results and shopping platforms that pretend to be well-known businesses. The agency says it is weighing changes to its Impersonation Rule, or a new rule, that could require platforms to vet advertisers, give people a way to report fake ads, and remove the ones that turn out to be scams. Comments are open until November 30, 2026.

With Black Friday on November 27 this year, the gap between "the ad looked real" and "the store is real" is where most of the risk sits.

What are the 7 free checks before you buy?

Do them in this order. The first three take under a minute each.

1. Type the address yourself. Do not shop from the ad's link. Look at the web address the ad sent you to, letter by letter, and compare it with the brand's real address. A lookalike name with an extra word, a swapped letter or an odd ending is the most common trick.
2. Search the store's name and its address, plus "scam" or "complaint." This is the FTC's first piece of advice for holiday shoppers: search both the seller's name and the exact web address the ad sends you to, alongside words like "review," "complaint" or "scam." Silence is not a pass, but a page of complaints is a clear fail.
3. Check the payment options. The FTC's rule of thumb: if a seller insists you can only pay by gift card, wire transfer, payment app or cryptocurrency, walk away. Those methods make it hard to get money back, which is exactly why scammers ask for them.
4. Look up when the web address was registered. ICANN, the body that coordinates internet addresses, runs a free registration data lookup tool. Type in the store's address and look for the registration date. A shop claiming years in business on a name registered weeks ago is a mismatch worth taking seriously.
5. Run Google's Safe Browsing site status check. Google's free tool tells you whether a site is currently flagged as dangerous to visit. Know its limit: it looks for malware and phishing, so a clean result does not prove the store will ship anything.
6. Find a physical address, a phone number and a real returns page. The FTC says a site must tell you whether you can return an item for a full refund. Read it: who pays return shipping, how many days you have, and whether there is a restocking fee. A policy that is missing, vague or copied word for word from another brand is a warning.
7. Read reviews in more than one place. The FTC warns not to rely on star ratings alone, because some reviews are fake, and fake reviews can be negative as well as positive. Check several sites, and look at who wrote the review and what else they have posted.

Does the padlock or a trust badge mean it's safe?

No, and this is the most common misunderstanding.

Why social media ads deserve the most suspicion

The BBB surveyed 2,820 people who reported a scam to its Scam Tracker in 2025. The top platforms where they said they dealt with the scammer were Facebook, Instagram and TikTok. Among the BBB's own tips: avoid making quick purchases while browsing social media, and research the website before paying.

The FTC describes the same trap from the other side: scammers run ads for brand-name products at unusually low prices, and the link leads to a site that sends a counterfeit, something that looks nothing like the picture, or nothing at all.

The practical habit is simple. When an ad catches your eye, close it, open a new tab, and go to the brand's real site or a store you already know. If the deal is real, it will usually be there too.

What should you do if you already paid?

Move fast. The BBB survey found 40% of respondents realized they were being scammed within 24 hours, and that early window is worth using.

• Paid by credit card? Call your card company. The FTC says that if you are billed for something you never got, or receive the wrong or a defective item, you can dispute the charge. To use that right, call right away and send a letter that reaches the company within 60 days of the date it mailed the first bill showing the error.
• Keep everything. The FTC's list: the store's name and web address, what you ordered and when, the price, the return policy, the promised shipping date, every email and text, and the statement that shows the charge.
• Know the shipping rule. If a seller gave no delivery time, the FTC says it must ship within 30 days of getting your order and payment. Our earlier guide, Order Never Arrived? The FTC's 30-Day Rule and Your Rights, walks through the steps.
• Report it. Tell the FTC at ReportFraud.ftc.gov, and report the ad itself on the platform where you saw it.

If the seller asked you to pay a way you cannot reverse, our guide on which payment methods scammers use explains why that request alone is the warning.

The bottom line

No single sign proves a website is real. The padlock only protects the connection, badges can be copied, and reviews can be planted. What works is stacking small, free checks: type the address yourself, search the name with "scam," pay by card, look up the registration date, and read the returns page before you pay.

For shoppers around DC, Maryland and Virginia, the same checks apply to every store, including ours. You can browse what is available on our shop page and in current auctions, and read how buying with us works on the FAQ page. For more on spotting fake praise, see How to Spot Fake Reviews.

Know someone who shops from social media ads? Send them this before Black Friday.