How to Tell If an Online Store Is Legitimate

Uncounted new online storefronts can appear overnight. Some are legitimate small businesses, perhaps hoping to catch the holiday rush, and some are built for exactly one purpose: taking your payment information and disappearing before a single package ships. The ads look polished. The prices look great. And increasingly, the sites themselves look convincing enough that even careful shoppers get caught.

1. Check the Site’s Age

Every website has a registration record, and it’s public. A quick way to check is a WHOIS lookup — a tool that tells you when a domain was first registered, and even sometimes who it was who registered it. ICANN Lookup is a free, official tool that takes about ten seconds to use: type in the store’s domain name, and you’ll see its registration date.

Here’s why this matters. A domain registered three weeks ago, running ads for 70% off name-brand goods, is a very different situation than a store that’s been registered for six years. New domains aren’t automatically scams — every legitimate business had to start sometime — but a brand-new domain paired with aggressive discounts and a flood of social media ads is one of the most consistent patterns behind these fraudulent businesses. Either way, you should look at every new domain with suspicion. Even if the website is legitimate, buying from it may not be worth the risk.

2. Look for Real Trust Signals

Scroll to the footer and the “About Us” page. Legitimate stores tend to have specifics: a real street address (not just a city name), a phone number that connects to an actual person when you call it, and an About page that describes the business in concrete terms. Look with suspicion on generic paragraphs and stock photography.

One common misconception that’s worth noting: the padlock icon and “https” at the start of a URL only mean the connection is encrypted. It says nothing about whether the business behind the site is trustworthy and will actually deliver a product that you purchase. Scam sites can (and do!) use https. It protects the data in transit, not you from the seller. Don’t let a padlock by itself convince you that a website is legitimate.

3. Verify Reviews Independently

Reviews posted directly on a store’s own website are the easiest thing for a scammer to fabricate. They control that page entirely, and can easily create fake reviews. Before trusting them, check the store’s name on a platform it doesn’t control: its Google Business Profile, the Better Business Bureau, or Trustpilot are better places to look for reviews.

Even these are not completely above fraud, and a few patterns are worth watching for once you’re looking through reviews on even those more-trustworthy sites. For example, a cluster of five-star reviews all posted within the same week, reviews that repeat oddly similar phrasing, or an account history with almost no reviews prior to a sudden string of them. None of these alone proves a scam, but stacked together, they’re a meaningful warning sign.

4. Read the Return Policy Before You Buy

It’s tempting to skip straight to checkout, especially on mobile. But a store’s return policy tells you a lot about how it expects to be held accountable. Red flags include:

• No return policy listed anywhere on the site
• “All sales final” on standard, non-custom merchandise
• A return window under seven days
• No identifiable way to actually contact customer service about a return. That means no working email and especially no phone number. Only a contact form that seems to go nowhere, if they even have one that

If you can’t find clear answers to “what happens if this doesn’t show up, or isn’t what I ordered,” then that website is likely not worth the risk.

5. Pay Attention to How You’re Asked to Pay

This is the single most reliable signal on this list, and the FTC’s guidance on holiday shopping scams puts it plainly: pay by credit card whenever possible. If you’re charged twice, sent the wrong item, or never receive your order, a credit card gives you the ability to dispute the charge directly with your card issuer. Debit cards, wire transfers, payment apps, and gift cards don’t offer the same protection. All that adds up to the implication that if a seller insists that gift cards, crypto, or wire transfer are the only accepted payment methods, you’re likely being set up for a scam.

This is also a reasonable time to think about which card you’re reaching for during your online shopping. If you’re comparing options, consider our Visa credit card that has a low rate of 12.90% (as of July 2026).

Your Five-Point Quick Check

Save this list; you’ll want it more than once this season:

1. Domain age — Run a quick WHOIS lookup. New domain plus steep discounts plus heavy ad presence is a pattern worth pausing on.
2. Trust signals — Real address, working phone number, specific About page. Remember that https alone proves nothing.
3. Independent reviews — Check Google, BBB, or Trustpilot, not just the store’s own site.
4. Return policy — Read it before you buy. No policy, or a statement that “all sales are final,” is a red flag.
5. Payment method — Credit card use gives you dispute rights. Gift cards, wire transfers, and crypto provide no protection.

Where to Go From Here

For a broader look at protecting your accounts and identity year-round, visit our Fraud Prevention & Cybersecurity Resource Center, and if you want a head start on the holiday-specific risks, our earlier post on staying safe while shopping online during the holidays is a solid companion read.