How to Check if a Website Is Safe or Fake Before You Pay or Log In
To check if a website is safe, read the real domain name (the part just before .com, .in or .gov.in), not the logo or design. Then paste the link into Google Safe Browsing site status or VirusTotal, check how old the domain is with a WHOIS lookup, and be careful with sites that accept only UPI to a personal ID. The padlock does not mean safe: it only means the connection is encrypted. If you already paid a fake site in India, call 1930 at once.
2-minute checklist
- Read the domain:
sbi.co.inis real;sbi-kyc-update.inis not SBI. - Check it: transparencyreport.google.com/safe-browsing/search and virustotal.com.
- Check age: a WHOIS lookup. Created last week? Red flag.
- Check payment: UPI to a person, gift cards or crypto only? Walk away.
- When in doubt, close the tab and open the official app.
A live example first
Ravi gets an SMS: "Your electricity will be disconnected tonight. Update bill at msedcl-billpay-update.com". He checks before tapping.
- Domain: the real Maharashtra electricity company's site ends in its own official domain.
msedcl-billpay-update.comis a different domain that just contains the name. - Search separately: he searches "MSEDCL bill pay" on Google and finds the official site and app; the SMS link is not there.
- Reputation: he pastes the link into VirusTotal. Several security vendors flag it as phishing.
- WHOIS: the domain was registered 3 days ago.
- He deletes the SMS and reports the number on Sanchar Saathi → Chakshu.
Friends, every check took under a minute, and none of them needed opening the link.
How do you judge a website?
The padlock is not proof. Read the real domain, then check reputation, age and payment method.
Scammers can copy a logo and design perfectly in minutes. What they cannot copy is the real registered domain. Everything else (age, reputation, payment method) helps confirm what the domain tells you.
How do I check a website step by step?
- Long-press the link (do not tap) and copy it, or read it in the address bar.
- Find the registered domain: the name just before the ending (
.com,.in,.co.in,.gov.in). - Compare it with the official domain you find by searching yourself.
- Paste the URL into Google Safe Browsing site status and VirusTotal.
- Do a WHOIS lookup (for example on who.is or an ICANN lookup site) to see the creation date.
- Look for a real address, GST number, and reviews on other sites.
- Check the payment page: cards and UPI through known gateways are better than "send UPI to this number".
- Only then log in or pay.
Read the domain: examples
| URL | Real owner? | Why |
|---|---|---|
https://www.irctc.co.in/ |
Yes | Official domain |
https://irctc-tatkal-booking.in/ |
No | Different domain containing the name |
https://onlinesbi.sbi/ |
Yes | SBI's official domain |
https://onlinesbi.sbi.kyc-verify.top/ |
No | Real domain is kyc-verify.top |
https://www.incometax.gov.in/ |
Yes | .gov.in is only for government |
https://incometax-gov-in.com/ |
No | .com domain pretending |
https://amaz0n-sale.in/ |
No | Zero instead of "o" |
Rule: read the domain from the right side, just before the first single slash.
By type of site
| Site type | Extra checks |
|---|---|
| Shopping | Domain age, real address, return policy, COD option, reviews on Google Maps/other sites |
| Banking | Never from SMS/WhatsApp links; type the address or use the bank app |
| Government | Must end in .gov.in or .nic.in; no payment by personal UPI |
| Job / work-from-home | Real companies do not charge "registration fees" or give paid "tasks" |
| Apps (APK links) | Install only from Play Store / App Store; APK files from links are a top fraud tool |
| Investment / trading | Check SEBI registration on the SEBI website |
Tools and what they tell you
| Tool | What it shows |
|---|---|
| Google Safe Browsing site status | Whether Google lists the site as phishing or malware |
| VirusTotal (URL scan) | Results from many security vendors |
| WHOIS lookup | When the domain was created and its registrar |
| Browser warning (red page) | Known dangerous site; do not continue |
| Sanchar Saathi → Chakshu | Report fraud calls, SMS and WhatsApp messages in India |
A clean result does not prove safety (new scam sites may not be listed yet), but a bad result is a clear warning.
Real example
Indian Railways and IRCTC have repeatedly warned users about fake apps and websites that copy the IRCTC name and logo, asking people to use only the official website and app. Banks like SBI regularly warn about "KYC update" links in SMS. These scams work because the design looks right. The domain is what gives them away.
If you already clicked or paid
- Do not enter any more details or OTPs.
- If you paid: call 1930 and file at cybercrime.gov.in immediately.
- If you entered banking details: call your bank to block the account/card, then change passwords from the official app.
- If you installed an APK: turn on airplane mode, uninstall it, and get the phone checked.
- Keep screenshots of the site, link, SMS and payment ID.
Summary table
| Clue | Safe sign | Warning sign |
|---|---|---|
| Domain | Matches official domain | Extra words, odd endings, look-alike letters |
| Padlock | Needed, but not proof | Missing padlock on a login page |
| Age | Years old | Days or weeks old |
| Reputation | Clean on Safe Browsing/VirusTotal | Flagged as phishing |
| Payment | Known gateway, COD | UPI to a person, gift cards, crypto |
Quick quiz: check what you learned
What does the padlock (HTTPS) prove?
- The connection is encrypted
- The website is a real business
- The site has no malware at all
- The government approved it
Show answer
A. HTTPS only protects the connection, not honesty.
Which part of a URL shows who owns the site?
- The domain before .com/.in
- The page title in the tab
- The logo on the page
- The words after the slash
Show answer
A. The registered domain is the key clue.
A shop domain was registered 5 days ago. This is:
- A red flag to check further
- Proof the shop is safe
- Normal for big brands
- A sign of a gov site
Show answer
A. Very new domains are common in scams.
You paid on a fake site in India. First step?
- Call 1930 at once
- Wait a week for refund
- Post on social media
- Pay again to unlock it
Show answer
A. Quick reporting gives the best chance to hold money.
Learn it properly
These pages go deeper:
Frequently asked questions
Does the padlock mean a website is safe?
No. The padlock (HTTPS) only means the connection is encrypted. Scam sites get free certificates too, so they also show a padlock.
How do I check if a website is fake?
Read the exact domain, check its age with WHOIS, test the URL on Google Safe Browsing or VirusTotal, and look for official contact details and reviews outside the site.
Are .gov.in sites always real?
Only the government can register .gov.in domains, so a true .gov.in domain is a good sign. But check carefully: "gov-in.com" or "gov.in.example.com" are not .gov.in.
What if a site offers huge discounts?
70–90% off on phones or branded goods with UPI-only payment is a common fake-shop pattern in India. Check the domain age and reviews first.
I entered my bank password on a fake site. What now?
Call your bank to block access, change the password from the official app, and report on 1930 / cybercrime.gov.in.
Can a browser warn me?
Yes. Chrome, Edge, Firefox and Safari use Safe Browsing or similar lists and show a red warning page for known phishing sites. Never click past it.