The padlock icon next to a web address does not mean a site is honest. It means the connection between your browser and the server is encrypted, so anyone intercepting the traffic cannot easily read it. That is a useful protection, but it says nothing about who runs the site or what they intend to do with your details. Understanding that distinction is the first step in checking whether a page deserves your credit card number or your home address.
Green Locks Explained
Years ago, browsers coloured the padlock or address bar green when a site used a stricter form of certificate. Most browsers have since dropped the green treatment, and now a plain lock, sometimes a small tune icon, simply signals that HTTPS is in use. Almost every serious website has this today, and so do many scam sites, because encryption certificates are cheap and quick to obtain.
So treat the lock as a baseline, not a badge of trust. A missing lock is a genuine warning: never type a password or payment detail into a page that still shows plain HTTP. But a present lock only tells you the tunnel is secure. If you click the lock, your browser will show who the certificate was issued to. For a bank or a large retailer, that name should match the company you expect. A generic certificate on a page asking for sensitive information is worth a second look.
Reading Website Signals
Beyond the lock, a legitimate business usually leaves a trail you can follow. Look for a physical address, a working phone number, and a clear returns or privacy policy written in coherent language. Check whether the company appears elsewhere on its own terms: a real firm tends to have consistent details across its social pages, listings, and reviews rather than a single lonely page that appeared last week.
Cross-referencing helps. If a local painting company claims to serve, say, the Mississauga area, you should be able to find that same business named consistently in independent directories and reviews, not just on the site trying to sell you something. When a page urges you to visit this site for a quote or a booking, take a moment to confirm the company behind it exists offline too. The domain age, spelling in the web address, and whether the contact email uses the company’s own domain rather than a free mailbox all add to the picture.
Reviews deserve a sceptical eye. A cluster of five-star ratings posted on the same day, all in similar phrasing, is less reassuring than a smaller number of detailed, dated comments that mention specifics. Photographs, staff names, and project details are hard to fake at scale.
Red Flags Everywhere
Certain signs should stop you before you enter anything at all. Pressure is the loudest: countdown timers, warnings that an offer expires in minutes, or messages claiming your account will be closed unless you act now. Legitimate businesses rarely need to rush you into handing over money.
Watch the web address closely. Scammers register lookalike domains that swap a letter, add a hyphen, or tack on an unusual ending to imitate a known brand. If you arrived by clicking a link in an email or text, type the address yourself instead of trusting the link. Be wary of pages that ask for more than the transaction requires, a booking for a home service should not need your full banking login, and of payment methods that offer no recovery, such as gift cards or direct bank transfers to a personal account.
Poor grammar, mismatched logos, broken images, and a checkout that suddenly redirects to an unfamiliar domain are all reasons to close the tab. Any one of these on its own might be a harmless mistake. Several together usually mean the site is not what it claims to be.
Next time a site asks for your details, do one small thing before you type: open a new tab and search the company’s name alongside the word “reviews” or “scam.” A minute of checking is far cheaper than undoing a fraudulent charge.