How can I tell if a website is real or a scam?

Signals that mean nothing

Worth clearing these out first, because they are the ones most commonly repeated and they cause real harm by producing false confidence.

• The padlock icon. Certificates are free and issued in seconds. Essentially every phishing site has one. A padlock means the connection is encrypted, not that the destination is honest.
• A professional-looking design. Templates are free, and fraudulent sites frequently copy a legitimate site's markup wholesale.
• Trust badges and security seals. Almost always images. Anyone can add one. If it does not link to a verifiable record on the issuer's domain, it is decoration.
• Reviews on the site itself. Self-published and unverifiable by construction.
• A privacy policy existing. Frequently copied verbatim from a real company, sometimes with the original name left in.

Signals that genuinely help

Check the domain character by character

The most common attack is a lookalike domain: arnazon.com, paypa1.com, brand-support.com, brand.co where the real one is .com. Read the domain slowly rather than glancing at it, and be aware that visually identical characters from other alphabets can be used deliberately.

Look for a verifiable identity

• A full postal address you can look up, not a PO box or a city name alone.
• A phone number that connects to someone.
• A company registration number, where the jurisdiction issues them.
• Named people with a history that exists elsewhere.

Fraudulent sites almost never provide these, because each one is a real thread back to a real person.

Check the mail path

A domain that sends transactional mail generally has MX records and SPF configured. A site set up last week to take card details often does not — the mail infrastructure is effort that serves no purpose for the fraud.

dig +short MX suspicious-site.com
dig +short TXT suspicious-site.com | grep spf1

Look for asymmetric effort

The most reliable structural signal. Fraudulent sites invest in whatever the visitor sees on the path to payment and neglect everything else. A polished checkout with a broken about page, an empty blog, no working contact route and no history is a recognisable shape.

Checks worth two minutes

1. Read the domain character by character and compare it against the brand you expect.
2. Search the exact domain name alongside the word "scam" or "review".
3. Look for a physical address and a phone number, then verify one of them independently.
4. Check the payment methods. Bank transfer, gift cards or cryptocurrency only, for ordinary retail, is close to conclusive.
5. Try the contact route before you buy. No answer is an answer.
6. For anything substantial, pay by a method with buyer protection.

What an audit adds

Technical measurement cannot determine honesty, and it would be dishonest to imply otherwise. What it can do is surface the credibility signals objectively — whether contact details exist, whether an author or organisation is identifiable, whether mail infrastructure is configured, whether the site uses dark patterns, whether third-party trackers vastly outnumber the actual content. A site failing most of those is not proven fraudulent, but it has declined every opportunity to be verifiable, which is itself informative.