Check Website Legitimacy: How to Spot Fake Shops

Why fake shops look convincing

The product is right, the price looks good and the website looks professional. Only at checkout do you discover that bank transfer is the only payment option. That is a good moment to leave. Polished design is no substitute for a verifiable seller.

Fraudsters copy product photos, legal text and genuine companies' details. A tempting price anchors your expectations; countdowns and scarce-stock claims discourage checking. Close the basket and compare the product independently. A bargain is not worth paying an unexplained recipient.

The German consumer centre describes these warning signs. They do not always appear together. Normal prices and fluent writing do not establish legitimacy either. The legal guidance below concerns consumer purchases under German law.

Quick checks before you order

Compare the legal notice with independent records

Commercial online shops generally need seller information under section 5 DDG. Look for a name, a serviceable postal address and electronic contact options including email. Legal entities must also state their legal form and representative; register details apply where a relevant registration exists. The DDG replaced the TMG in May 2024. As of 10/2026.

Compare the details with the German company register where applicable. Not every sole trader needs an entry. Check the address independently. If in doubt, contact the real business through details found elsewhere: fraudsters can copy its entire legal notice. Finding a genuine company does not prove that it operates this particular website.

Read the withdrawal information

For ordinary goods bought online from a business, German consumers generally have 14 days to withdraw. Section 355 BGB sets the duration; section 356 BGB governs when it starts, generally upon receipt, but not before proper information about withdrawal. Section 312g BGB contains exceptions, including goods made to your specifications. As of 10/2026.

Find out whom to notify, where returns go and who pays return postage. Resolve different company names across the legal notice, returns information and checkout before buying. A copied policy offers little practical help if the seller never intends to deliver.

Follow payment options through to checkout

Footer logos are not enough. What matters is the payment method actually available. If promised alternatives disappear and only an advance bank transfer remains, do not order. Check the recipient too. A payment processor may legitimately have a different name, but an unexplained private recipient is a reason to stop.

HTTPS encrypts the connection to the displayed domain. It does not confirm the trader's identity or intention to deliver. Do not enter card details on a suspicious site simply because the browser shows no warning.

Read reviews beyond the star rating

Search for the exact domain and company name outside the shop, adding terms such as “reviews” or “order never arrived”. Look for specific delivery and refund experiences. A sudden cluster of similarly worded praise may suggest purchased reviews. It does not prove manipulation: genuine campaigns can also cause bursts of reviews.

Check that reports concern the same domain, rather than a similarly named business. No results mean only that you have found no reports.

A Trusted Shops logo can be copied. Open its certificate and check the issuer's domain as well as the certified shop address. If uncertain, search directly with the seal issuer. The consumer centre explains this certificate check. A valid seal adds evidence, not an unconditional guarantee. A small trader without a seal is not automatically untrustworthy.

Check the domain and technology manually

Read the full browser address for swapped letters, added words and unexpected endings. A brand name in the URL does not establish domain ownership. Reach familiar retailers through bookmarks or independently verified addresses.

ICANN Lookup provides registration information for many international domains; DENIC handles German domain enquiries. Whois and RDAP expose different information depending on the domain extension. A registration date may be unavailable. Hidden ownership details do not prove fraud, and an old domain can have a new operator. Compare claimed trading history with what you can verify.

You do not need an automated server scan for these checks. Read the seller information, compare addresses and open sources yourself. External registry lookups still make their own network connections. A technical audit is optional, not a replacement for checking who is selling.

What to do if you have already paid

Save the offer, full URL, order confirmation, correspondence and payment receipt. Note the order date and promised delivery. If you suspect fraud, do not wait through repeated excuses.

Credit card: Ask your card issuer about a chargeback for goods not received. Document your attempt to contact the seller. Visa and Mastercard frequently use 120 calendar days, but the start date and exceptions depend on the dispute reason. A later promised delivery can change the starting point, with longer outer limits. “Always a maximum of 120 days from payment” is therefore misleading. Ask your bank to confirm your actual deadline (Adyen's dispute timeframes, as of 10/2026). A refund is not guaranteed. If you entered card details on a suspected scam site, also discuss blocking the card.

PayPal: For an eligible purchase, open a dispute within 180 days of payment. If unresolved, escalate it to a buyer protection claim within 20 days of opening. Personal “Friends and Family” payments are excluded. See the German buyer protection terms for exclusions and evidence requirements, as of 10/2026. Do not pursue PayPal buyer protection and a card chargeback simultaneously for the same payment.

Bank transfer: Call your bank immediately to request a stop or recall. You cannot simply reverse an already executed transfer you authorised. The consumer centre explains the limits. Report suspected fraud to the police and give the reference number to your bank or payment provider. Do not pay further fees to supposed recovery agents.

Checklist to work through

1. Compare the offer independently and ignore the countdown.
2. Match the seller's name and address against independent sources.
3. Read withdrawal information, return arrangements and costs.
4. Check the actual payment method and recipient at checkout.
5. Find external reports about the exact domain and verify seals with their issuer.
6. Read the full URL and resolve contradictions in the shop's history.
7. Save evidence and leave without buying if important questions remain unanswered.

How the studio-tools checks help

Use the Fake Shop Check to record warnings you have investigated yourself. It evaluates your entries locally without fetching the shop. Its score is not a probability of fraud. Even a low score cannot resolve an unexplained payment recipient.

For a customer account, the Passkey Tester checks your browser's capabilities on your device, not another shop. The Password Checker evaluates length, character types and simple patterns locally. Try an unused sample rather than your real login password. Its rating does not tell you whether credentials have leaked. Use a separate password for every account.

The Website Auditor checks technical basics such as titles, headings and metadata. It sends the public URL to our server, which fetches the website. Do not enter private or token-bearing links. A good audit result confirms neither the seller's identity nor the legality of an offer. Base your purchase decision on verifiable seller details and payment terms you understand.