Is this a scam? Use our 2-minute checklist for websites, emails, texts and calls, spot common scam patterns, and learn what to do if you already paid.
Quick answer: Ask "is this a scam?" whenever someone contacts you unexpectedly. It probably is if they claim to be a known organisation, create urgency, and ask for money, codes or personal details, especially by gift card, wire transfer, crypto or payment app. Stop, verify through an official channel you find yourself, and check any website's exact domain.
When you wonder "is it a scam?", you can usually find out in a couple of minutes. The US Federal Trade Commission sums up the pattern in four signs: scammers pretend to be from an organisation you know, say there is a problem or a prize, pressure you to act immediately, and tell you to pay in a specific way (FTC).
Is this a scam? The 2-minute checklist
Answer the questions for the channel in front of you. One "yes" is a reason to slow down; several mean stop.
For a website
- Is the domain misspelled, or does it add extra words to a brand name?
- Did you arrive from an ad, a text or a social media post rather than typing the address yourself?
- Are prices far below what every other shop charges?
- Is there no real company name, physical address or working contact method?
- Does it accept only bank transfer, crypto or gift cards?
For an email
- Does the full sender address use a domain that isn't the organisation's real one?
- Do links point somewhere else when you hover over them?
- Is it urging you to log in, pay or share a code right now?
For a text or direct message
- Did it come from an unknown number or a new, unverified account?
- Does it contain a link about a delivery fee, refund, prize or account problem?
- Is a "wrong number" chat slowly turning into friendship, investing or crypto?
For a phone call
- Is the caller asking you to move money, read out a code, install software or keep the call secret?
- Are they threatening arrest, fines or account closure?
- Are you trusting the caller ID? The FTC warns that scammers can fake the name and number you see (FTC).
If anything on the list applies, pause. Hang up or close the message, and contact the organisation using a number or website you find yourself. In the UK, if someone claiming to be your bank calls, you can hang up and dial 159 to be connected to the fraud line of participating banks.
How to check a website
Check the domain and its age
Read the address bar from right to left. The registered domain is the part just before the suffix, so example.com.shop-deals.example belongs to shop-deals.example, not to example.com. Look for misspellings and lookalike characters, then check the registration date with ICANN Lookup. A shop claiming years of history on a domain created last month is a red flag. More visual clues are in our guide to spotting a phishing website.
Don't treat HTTPS or the padlock as proof
HTTPS means the connection is encrypted. It says nothing about who runs the site, and scam sites use it routinely. The FBI has told the public not to trust a website just because it shows a lock icon or "https" (FBI IC3).
Check contact details
Legitimate sellers show a registered business name, a physical address, clear refund policies and contact methods that respond. A contact form and nothing else is a warning sign.
Look for reviews outside the site
On-site testimonials can be invented. Search the shop's name or domain with words such as "scam" or "reviews", and check independent forums and news. An "established" business with no outside footprint is telling.
Look at the payment methods requested
Cards and established payment services usually let you dispute a charge. The FTC's advice is never to pay someone who insists you can only pay with cryptocurrency, a wire transfer service, a payment app or a gift card (FTC).
Check Google Safe Browsing site status
Google's Safe Browsing site status tool lets you paste a web address and see whether Google currently considers it dangerous, without opening the site. Brand-new scam sites may not be flagged yet, so a clean result is not proof of safety.
How to check emails, texts and messages
For emails, check the full sender address, the reply-to address, where links really go and the authentication details your email app shows. Our guide is this email legit? explains each check in Gmail and Outlook.
Texts and direct messages give fewer clues. Don't tap links in unexpected messages; open the company's app or website yourself. Check that any "support" account is linked from the company's official site, since fake support accounts are common. Never share one-time codes: a genuine company will not ask you to read one out.
Common scam patterns to recognise
Fake online shops
Copies of real brands or invented stores, often promoted through social media ads, with steep discounts and countdown timers. Goods never arrive or are counterfeits.
Investment and crypto scams
Promises of guaranteed or unusually high returns, often promoted with fake celebrity endorsements or deepfake videos, and platforms that show growing "profits" but demand fees before you can withdraw. Read more in fake ads and deepfake investment scams.
Delivery scams
Texts or emails about a missed parcel or a small redelivery or customs fee, linking to a page that harvests card details. Our guide to fake parcel delivery SMS scams shows typical examples.
Tech support scams
Pop-ups or calls claiming your computer is infected, urging you to call a number, pay for a "fix" or install remote-access software. Treat any unsolicited warning about a virus that comes with a phone number as a scam.
Romance scams
Someone met only online builds trust, then needs money for an emergency or an "investment", and never meets or video calls.
Job scams
Easy remote jobs with high pay, "task" jobs that require deposits to unlock earnings, or employers who send a cheque and ask you to forward part of it.
What to do if you already paid or shared data
Speed matters. Work through these steps as soon as you can:
- Contact your bank or card issuer using the number on your card or in its app, and ask it to stop or reverse the payment and block the card. If you paid by gift card, wire transfer, payment app or crypto, contact that company immediately and ask for a reversal; the FTC lists steps for each payment method (FTC).
- Change passwords for any account whose login you shared, and anywhere you reused them. Turn on multi-factor authentication.
- If you installed remote-access software, disconnect from the internet, remove it and run a security scan.
- If you shared identity information, in the US use IdentityTheft.gov for a recovery plan; elsewhere, ask your national fraud reporting service which protective steps apply.
- Report it. In the US, report to the FTC at ReportFraud.ftc.gov. In England, Wales and Northern Ireland, report to Report Fraud online or on 0300 123 2040; in Scotland, contact Police Scotland on 101 (GOV.UK). Our guide to reporting a scam website covers hosting providers, registrars and browser blocklists.
- Beware of recovery scams. People who have lost money are often contacted again by "recovery agents" who promise to get it back for a fee.
If you found a scam website that copies a real company, you can report a phishing site through our form. Businesses whose customers are being targeted can book a free exposure scan to find impersonating domains and pages.
FAQ
How can I quickly check if a website is a scam?
Check the exact domain spelling and its registration date, look for independent reviews, confirm real contact details and paste the address into Google's Safe Browsing site status tool. Be suspicious of sites that accept only transfers, crypto or gift cards.
Does HTTPS mean a website is safe?
No. HTTPS only encrypts the connection between you and the site. Scam sites routinely use it, and the FBI has warned people not to trust a site just because it shows a padlock.
Is it a scam if they ask for gift cards?
Almost certainly. Gift cards are one of the payment methods the FTC says scammers insist on. If someone demands payment in gift cards, stop contact.
What if I clicked a link but didn't enter anything?
Close the page and don't enter any details. On an up-to-date device the risk from a click alone is usually low, but run a security scan if anything downloaded and watch for follow-up messages.
Who should I report a scam to?
Report it to the platform where it happened, to your bank if money was involved, and to your national fraud reporting service, such as ReportFraud.ftc.gov in the US or Report Fraud in the UK. Our guide on how to report a scam lists more options.
Is someone impersonating your brand?
We find lookalike domains and cloned pages and take them down. Start with a free exposure scan.