A valid HTTPS certificate, a polished logo and high-definition visuals: these elements inspire confidence, but cost almost nothing to produce. Spotting the warning signs of a suspicious website means weighing several technical and legal indicators, not relying on visual impressions. This article reviews the measurable criteria that distinguish a trustworthy site from a fraudulent front.
Website trustworthiness: a table of technical signals to cross-check
No single signal is enough to determine that a site is fraudulent. It is the combination of several indicators that tips the balance. The table below brings together the most telling checks, ranked by reliability.
| Signal checked | Trustworthy site | Suspicious site |
|---|---|---|
| Domain age (WHOIS) | Several years old, identifiable owner | Domain registered only a few weeks or months ago, details hidden |
| Legal notices / terms and conditions | Company name, SIRET number, physical address, contact details | Missing, incomplete or copied from another site |
| Seller identity (marketplace) | Name, country and professional status displayed before purchase | No information about the third-party seller |
| URL and domain name | Consistent with the brand, with no suspicious characters | Typos, multiple hyphens, unusual extension (.xyz, .top) |
| Browser warning | No security message | “Deceptive site” warning or expired certificate |
| Payment policy | Traceable payment methods (card, PayPal) | Bank transfer only, cryptocurrency required |
A domain created less than three months ago, combined with missing legal notices, provides enough warning signs to rule out making a purchase. The following analysis explains the most revealing discrepancies.
URL and domain name: the first clues to an online scam
The web address is the quickest place to start. So-called homograph attacks replace a letter with a visually similar character (a “q” instead of a “g”, or “rn” made to look like an “m”). This type of manipulation targets well-known brands to attract traffic from users who trust them.
An article explaining how to spot a suspicious site like Aplouf.com illustrates the method well: check that the domain name, the claimed business activity and the displayed legal information are consistent.
Beyond spelling, the domain extension deserves attention. Cheap generic extensions (.top, .xyz, .click) appear disproportionately often in phishing campaigns because they cost less than one euro per year. A legitimate French commercial site most often uses .fr or .com.
Recent legal requirements: what websites must display in France and the EU
Regulations provide objective criteria for assessing a website, as long as you know what to look for.
- The SREN law of May 21, 2024 requires marketplaces to clearly state whether a seller is a business or an individual. The absence of this information on a marketplace is a legal violation and a concrete warning sign.
- The DSA (Digital Services Act) requires platforms to collect and make certain identification details about professional sellers available before any transaction.
- Since December 13, 2024, the EU General Product Safety Regulation has required product listings to identify a responsible person established in the EU and provide their contact details. A product sold online without this information violates the regulations.
These requirements provide a series of checks. A site that fails to meet them is not necessarily fraudulent, but it operates outside the applicable legal framework, limiting your options for recourse in the event of a dispute.
Missing or generic legal notices
The DGCCRF recommends checking for a company name, a physical address and a registration number. On a French website, the absence of a SIRET number is a strong warning sign. Copying the postal address into a search engine can sometimes reveal that it belongs to a vacant lot or an unrelated business.
Recent manipulation tactics: ClickFix and fake CAPTCHAs
Deceptive techniques have moved beyond traditional email phishing. The ClickFix scenario involves a page that simulates a technical error or CAPTCHA, then asks the user to copy and run a command on their own computer. The victim thinks they are fixing a technical problem, when in fact they are installing malware themselves.
Google has responded by adding specific protection to Chrome: the browser can now warn users before they paste a command deemed dangerous. Browser alerts of this kind are among the signals you should never ignore.
Unusual permission requests on a page
A legitimate site does not ask for permission to send notifications as soon as you land on its homepage, or request access to your clipboard. These premature requests point to aggressive data collection. If a page asks you to allow notifications before you have even viewed its content, close the tab.
Quickly check a website’s reputation: a three-step method
The DGCCRF suggests a simple approach: search for the site’s name followed by the word “scam.” Combined with two other checks, this method covers most cases.
- Search for the site or product name alongside “scam” or “reviews” to find any negative feedback from other consumers.
- Use a WHOIS tool to check when the domain was created and who owns it. A domain only a few weeks old, paired with a store offering very low prices, is a reliable warning sign.
- Check whether the site is active on social media: regular activity accompanied by authentic comments is a positive sign, although it is not an absolute guarantee.
These three checks take less than a minute and filter out the vast majority of fraudulent sites before you interact with the payment page.
The HTTPS padlock, often seen as a sign of security, only indicates that the connection is encrypted. A phishing site can have a valid SSL certificate obtained for free. This criterion alone says nothing about a site’s trustworthiness and should always be cross-checked against the signals listed above.
