Is this website safe? How to check before you sign in or pay

Fake shops, copied login pages and "too good to be true" deals can look every bit as polished as the real thing. A few minutes of checking before you sign in or pay catches most of them — and the most famous safety sign, the padlock, isn't one of the checks that matters.

The padlock doesn't mean the site is legit

HTTPS — the "s" in the address and the security symbol next to it — means your connection to the site is encrypted. It doesn't mean the site is legitimate: scammers know how to encrypt sites too, the US FTC points out. Chrome's own help page describes its address-bar symbol as a sign of whether the connection is secure and private, nothing more.

Five checks before you trust a site

1. Read the address slowly. Look for misspellings of a known brand or a switched letter. Chrome warns about some lookalike addresses with messages such as "Did you mean…?" or "Fake site ahead" — but don't count on it catching every one.
2. Look the site up in Google's Safe Browsing site status tool (transparencyreport.google.com/safe-browsing/search). It shows whether a site is currently flagged as dangerous. Many flagged sites are legitimate sites that were hacked, and a clean result isn't a guarantee.
3. Search the seller's name and web address together with words like "review", "complaint" or "scam", as the US FTC suggests.
4. Don't rely on star ratings alone. Some reviews and ratings are fake or misleading.
5. Be suspicious of ads for brand-name products at unusually low prices. Scammers impersonate real companies and run exactly those ads.

Pay the safe way

• Pay by credit card where you can. The US FTC says card payments best protect your money if something goes wrong; check your card issuer's rules for disputing a charge.
• Never buy from a seller that insists on gift cards, wire transfers or payment apps — common red flags in the US FTC's guidance.
• Avoid paying with cryptocurrency on a site you don't know. Crypto payments don't have the same legal protections as credit and debit cards.

Let your browser help

• Chrome: Safe Browsing is on by default and shows a red "Dangerous site" warning on known phishing and malware sites. To check the level, open More > Settings > Privacy and security > Security and choose Enhanced or Standard protection.
• Microsoft Edge: Microsoft Defender SmartScreen checks sites against a list of reported phishing and malware sites. Make sure it's on under Settings > Privacy, search, and services > Security, and report a bad site from Help and feedback > Report unsafe website.
• Treat the warnings as a strong signal, not a full check — a site that isn't flagged may simply not have been reported yet.

If you already bought from a fake site

• Paid by credit card? Report it to the card issuer right away and ask to dispute the charge.
• Typed a password on the site? Change it — and anywhere you reused it — and turn on two-factor authentication.
• Report the scam to the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca or on 1-888-495-8501 — even if you didn't lose money.
• If you've lost money, also report it to your local police.

Does antivirus check websites?

Most security suites add their own warnings on top of the browser's. Norton includes Safe Web with its Scam Protection on every plan, every TotalAV plan has WebShield, McAfee includes web protection on every plan, and Avast's free antivirus includes Web Guard, with Real Site in Premium Security. Useful as a second opinion — the checks above are still yours to make.

The padlock tells you the line is private, not who's on the other end. Check the address, check the seller, and pay with a card.