A polished website, five-star reviews, and a professional-sounding name used to be reasonable signs of a trustworthy business. Not anymore. Scam operations now launch sites that look as convincing as real companies — complete with fake testimonials, copied logos, and “live” customer support — in a matter of days. Learning how to check if a website is legit before you hand over money or personal details is one of the highest-value skills you can have online.
The framework below takes about ten minutes and works for almost any business: online stores, investment platforms, lenders, job offers, and charities. You won’t need special software — just a browser and the official public records that exist precisely so you can do these checks.
The 10-minute due-diligence framework: how to check if a website is legit
Work through the six steps below in order. Each step either confirms something the business claims about itself or exposes something it would rather hide. If any step raises a red flag, stop and treat the site as suspicious until proven otherwise.
Step 1 — Check the domain record (2 minutes)
Every website runs on a domain, and domains leave a paper trail. ICANN — the organization that coordinates the global domain name system — operates a free Registration Data Lookup tool that shows the registration record of any domain, including when it was created, which registrar handles it, and its status.
Paste the website’s domain into the tool and look for these things:
- Creation date: A business claiming “10 years of trusted service” on a domain registered last month is lying. Scam sites are often brand new, because they get reported and taken down quickly.
- Registration details: A legitimate company usually registers its domain for multiple years through a well-known registrar. A one-year registration on an obscure registrar, combined with heavy privacy masking, deserves skepticism (though many honest small businesses use privacy protection too, so treat this as one data point).
- Status codes and mismatched nameservers: Odd status codes or rapidly changed DNS records can indicate a domain being shuffled around, which is common in fraud infrastructure.
A brand-new domain is not proof of fraud — but a brand-new domain for a company claiming a long track record is proof of dishonesty.
Step 2 — Verify the company actually exists (2 minutes)
Real businesses are registered somewhere. In the UK, the official company register is Companies House; in the US, companies register at the state level (for example, with a Secretary of State’s business search). Look the business up by name and check:
- Does the registration exist, and does the business name match exactly?
- Is the company active, dissolved, or very recently incorporated?
- Do the registered address and directors look plausible — or is the “company” a two-week-old shell with a residential address?
The FCA’s research found that one in ten investors wouldn’t conduct basic checks such as verifying whether a firm was regulated or checking company registration records before investing — and scammers rely on exactly that skip. Also note: incorporation alone is not a safety stamp. A scammer can register a company for pocket change. It proves existence, not honesty.
Step 3 — Search the regulator warning lists (2 minutes)
This is the step that catches the most dangerous frauds: checking whether a financial or investment firm is actually authorized to do what it claims.
- In the UK, the Financial Conduct Authority (FCA) advises consumers to check whether a firm is authorized using its Firm Checker, and to always check the FCA Warning List before dealing with a company — the Warning List shows firms the FCA knows are operating without its authorization. Crucially, only use the contact details listed on the FCA Register, never the contact details the firm itself gives you.
- In the US, the SEC’s investor-education site (Investor.gov) lets you check the registration and license status of investment professionals and firms, and the SEC’s EDGAR database holds company financial reports.
- The FCA has also warned specifically about “clone firms” — fake companies that steal the name, address, and authorization number (FRN) of real, legitimate firms, then link to the real firm’s website to look convincing. Victims in the UK lost an average of £45,242 each to clone-firm frauds in 2020, according to Action Fraud data published with the FCA’s warning.
If the firm is on a warning list — stop. If you can’t find it on any register — treat that as a red flag too. And if it claims to be authorized, verify it independently on the regulator’s own site rather than trusting badges on the firm’s page.
Step 4 — Interrogate the reviews (2 minutes)
The FCA found that more than one in five people say online customer reviews increase their trust in an investment company — and that scammers deliberately create professional-looking platforms featuring fake customer reviews, logos, and statements to lure victims. Reviews are evidence, but only if you read them critically:
- Look for the negative reviews first. A perfect 5-star rating across dozens of reviews, with no specifics and no complaints, is itself suspicious.
- Check the dates. A cluster of glowing reviews all posted within the same week, especially soon after the domain was registered, smells like a batch upload.
- Read the language. Generic praise (“Great service, highly recommend!!!”) repeated across profiles, or reviews that never mention a specific product or interaction, are classic paid or fabricated reviews.
- Cross-check platforms. Compare Trustpilot, Google reviews, the Better Business Bureau, and Reddit or forums. A business with 400 five-star reviews on one platform and nothing anywhere else — or warnings elsewhere — has a problem.
- Search the business name + “scam” or “complaint.” Do this on a search engine and sort by recent results. Victim reports and consumer-forum threads often surface this way.
Step 5 — Check the contact details and physical address (2 minutes)
Legitimate businesses are reachable. Suspicious ones hide. Verify:
- Phone number: Call it. Does a real person or a real IVR system answer during business hours? Is the number consistent with the country it claims to operate from?
- Email: Free or disposable email addresses (gmail.com, proton.me, and similar) for a business’s official contact are a warning sign for financial services.
- Physical address: Paste it into a map service. Is it a real office building, a mailbox-forwarding service, a residential street, or nothing at all? Many scam sites list prestigious addresses that turn out to be virtual offices.
- Clone check: For financial firms in the UK, confirm the phone number and email against the FCA Register entry for the real firm. The FCA explicitly warns that scammers copy authorization numbers and encourage victims to “check the register” to sound convincing — so compare the fine details, not just the reference number.
Also, be wary of the business asking you for remote access or screen-sharing “to help.” The FCA flags requests to share your screen or give remote access to your device as a major warning sign of a scam, even if you were the one who contacted them.
The “Is it legit?” 9-point scoring checklist
Score the site: give it one point for every “yes.” Seven or above suggests a business worth dealing with; anything under five means walk away until doubts are resolved.
- The domain is older than the business’s claimed track record, or at least not suspiciously new.
- The company is registered in an official public record that matches its name and address.
- A financial firm appears as authorized on the relevant regulator’s own site — found by you, not via their link.
- The firm does NOT appear on the regulator’s warning list.
- Reviews exist across multiple independent platforms, including some critical ones, with realistic dates.
- A working phone number and physical address check out against independent records.
- The “About us” page names real people with verifiable professional histories (LinkedIn, press coverage).
- Payment options include reversible, protected methods — not only wire transfer, gift cards, or crypto.
- Nothing on the site pressures you to decide immediately (“limited offer,” countdown timers on services).
Red flags: how to check if a website is legit, fast edition
If you spot any of these, treat the site as guilty until proven innocent:
- Domain registered days or weeks ago, while the company claims years of history
- No company registration number, no named team, and no physical address anywhere on the site
- Financial firm absent from regulator registers, or present on a warning list
- Authorization badges and license numbers on the site that can’t be confirmed on the regulator’s own pages
- “Guaranteed returns,” “risk-free profit,” or income claims that sound too good to be true
- Only unreversible payment methods: wire transfers, gift cards, cryptocurrency
- Reviews that are all recent, all perfect, and all vague
- Aggressive urgency: countdown timers, “only 3 spots left,” pressure to deposit today
- The business contacted you first — especially about an “investment opportunity”
- Requests to install screen-sharing software or hand over remote access
- Mismatched branding: logos that look slightly off, email addresses on free domains, phone numbers in unexpected countries
How to verify and protect yourself: the 10-minute drill
Bookmark these checks and run them every time money or personal data is on the line:
- Run the domain through ICANN’s Registration Data Lookup and note the creation date.
- Confirm the company in the official company register for its claimed country.
- For anything financial, check the FCA Register/Firm Checker and Warning List (UK), or Investor.gov (US) — using addresses you type yourself.
- Read reviews critically across multiple platforms and search “[name] + scam / complaint.”
- Verify the contact details independently, and never share your screen with a firm that asks.
If something doesn’t add up, report the site: suspected investment scams can be reported to the FCA in the UK, and to the FTC at ReportFraud.ftc.gov and the FBI’s IC3 in the US. Your report helps take down infrastructure that targets the next person. Ten minutes of due diligence is the cheapest insurance you’ll ever buy — and once you’ve run this drill a few times, you’ll spot the patterns in seconds.
Sources
- FCA — “Screen sharing scams” (last updated Jan 19, 2026): https://www.fca.org.uk/scamsmart/screen-sharing-scams
- FCA — “FCA warns of increased risk of online investment fraud” (ScamSmart press release): https://www.fca.org.uk/news/press-releases/fca-warns-increased-risk-online-investment-fraud-investors-scamsmart
- Trading Standards — “FCA issues warning over ‘clone firm’ investment scams” (Jan 2021): https://www.tradingstandards.uk/news-policy-campaigns/news-room/2021/fca-issues-warning-over-clone-firm-investment-scams/
- ICANN — “ICANN Lookup” registration data tool: https://lookup.icann.org/en/lookup
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.