Updated: October 28, 2026
Fake websites copy the look of banks, stores, delivery companies and streaming services so you enter your card or password. They usually arrive through a text, an email or an ad. These are the clearest warning signs.
1. The address is not exactly the brand's
Read the full address in the bar at the top. Copies use swapped letters, hyphens or extra words: paypa1.com or amazon-secure-login.com do not belong to those brands.
2. You arrived through a link you did not ask for
If a message says your account will be locked or that you won a prize, do not follow the link. Type the address yourself or open the official app.
3. You are being rushed
"30 minutes left", "final notice", "verify today". Urgency is a scammer's favorite tool: it is meant to stop you from thinking.
4. It asks for more than usual
No bank asks for your full password, the code sent to your phone, or your card details to "verify" your account.
5. The padlock is not enough
The padlock only means the connection is encrypted, not that the site is legitimate. Almost every scam site has one too.
6. The domain is brand new
Scam sites live for days. A site claiming to be a well-known brand that was registered last week is a red flag.
7. The prices are impossible
Sneakers at half price, phones in a "total clearance": if it looks too good to be true, it probably is.
Free ways to check a website
| Tool | What it tells you |
|---|---|
| Google Safe Browsing site status | Whether Google has flagged the site |
| A WHOIS lookup | When the domain was registered |
| Searching the site name plus "scam" or "reviews" | Whether other people reported it |
If you already entered your details
- Call your bank using the number on the back of your card and block it.
- Change the password you used, and any account that shares it.
- Report the site to your bank and to your country's fraud reporting service.
What Qhawa does
Qhawa compares every page you open in Chrome with public lists of phishing and malware sites updated daily, and warns you before a known scam page loads.
Add to Chrome
Frequently asked questions
Does HTTPS mean a website is safe?
No. HTTPS only encrypts the connection. Most scam sites use it too.
How can I check if a website is legit for free?
Check the exact address, look up when the domain was registered, search for reviews and use Google Safe Browsing site status.
What if I only visited the site without typing anything?
Close it. Simply visiting is rarely enough to cause harm, but do not download anything it offers.