Anyone can build a professional-looking online store in an afternoon, which means a polished design is no longer proof that a business is real, reliable, or safe to buy from. Telling a legitimate store apart from a fake one now takes a slightly closer look, but it's a look most people can do in a few minutes without any technical background.
This guide walks through the checks that actually matter, grouped by what they tell you: the technical setup, the business behind the site, and what other buyers have experienced.
A decade ago, a clunky website with typos and broken images was a reasonably reliable signal of a low-quality or fraudulent store. That signal has mostly disappeared. Templates, AI-generated product copy, and stock photography now let anyone launch a store that looks as polished as an established retailer within hours, using the same design tools legitimate businesses use.
That shift means the checks worth doing have moved from "does this look professional" to "can I verify this is a real, accountable business." The second question is harder to fake, since it depends on details a scam operation usually avoids providing.
A free WHOIS lookup (through a service like ICANN Lookup or a domain registrar's WHOIS tool) shows when a domain was registered and, unless the registration is privacy-shielded, who registered it. A store claiming years of reputation on a domain that was registered a few weeks ago is a clear mismatch worth noticing. This alone doesn't prove fraud, since new legitimate businesses register new domains too, but it's a useful cross-check against other claims the site makes about its history.
Every page that collects personal or payment information should use HTTPS, visible as a padlock icon next to the URL in the browser's address bar. HTTPS confirms the connection between the browser and the site is encrypted, nothing more. It doesn't confirm the business is honest, since fraudulent sites can obtain HTTPS certificates too. Its absence on a checkout page, though, is a reason to stop immediately.
A legitimate store is generally willing to say who runs it. That means a real business name, a physical address (not just a city name), and legal pages covering terms of service, privacy, and returns that read as if they were written for this specific store rather than copied wholesale from somewhere else. A quick way to check the last point is to search a distinctive sentence from the policy in quotation marks; if it appears verbatim on unrelated sites, it was likely copied without adaptation.
Reachable, specific contact information, such as a working email on the store's own domain, and ideally a phone number, signals a business that expects to be held accountable after the sale. A contact form with no other way to reach the business, or a generic email hosted on a free provider, is weaker but not automatically disqualifying on its own.
Reviews published only on the store's own website can't be independently verified, since the store controls what gets shown. Reviews on third-party platforms, where the store doesn't control moderation, carry more weight. Warning signs include a cluster of reviews posted in a short window, reviews that read like generic marketing copy rather than specific experiences, and an unusually high volume of five-star reviews with no negative or mixed ones at all, which is uncommon even for genuinely well-run stores.
Searching the store's name together with terms like "scam" or "complaint" before buying takes a few seconds and often surfaces existing warnings from other buyers if the store has a pattern of problems.
Every check above requires a buyer to do some manual digging, and most buyers won't do all of it before a purchase. Independent verification badges exist to compress that process: a third party has already reviewed the business's legal identity, payment security, and policy transparency, and issues a badge only if the store meets defined standards, typically with a public page documenting what was checked. Welo Badge works this way, giving a buyer a faster starting point than reconstructing the checks manually, while still leaving the underlying verification open to review rather than asking for blind trust.
Before entering payment details on an unfamiliar store, it's worth confirming: the domain isn't brand new relative to the store's claimed history, the checkout page uses HTTPS, the business publishes a real address and reachable contact details, the return and refund policy is specific rather than vague, reviews exist on a third-party platform and not only on the store's own site, and the payment methods offered include ones with buyer protection, such as credit cards, rather than only bank transfers or cryptocurrency. If a store is missing several of these at once, that's a stronger signal than any single check on its own.
Rise above the usual.
