How can you tell if a website is legitimate?

Start by discarding the padlock heuristic. HTTPS means the connection is encrypted, not that the operator is trustworthy, and free certificates mean the large majority of phishing sites display the padlock. What actually matters is the domain itself: read it character by character, since attackers register lookalikes using substitutions, extra words, and unusual endings that scan correctly at a glance. Type known addresses directly or use a bookmark rather than following links from email or text, because the display text of a link tells you nothing about its destination.

Beyond the address, the reliable signals are mundane. Legitimate businesses publish a physical address, a working phone number, and clear return and privacy policies; scam storefronts have vague contact forms and copied policy text. Prices dramatically below market are the most common lure, and a site that only accepts wire transfers, gift cards, cryptocurrency, or payment apps rather than credit cards is deliberately avoiding the payment methods that offer chargebacks. Check domain age with a registration lookup, since a site claiming decades of operation on a two-month-old domain is settled. Search the site name with the word scam and read complaints. And treat urgency itself as evidence, because manufactured time pressure exists to prevent exactly the checks described here. If you have already paid, contact your card issuer promptly, since dispute windows are limited.