How to Tell If a Website Is Safe (the Padlock Is Not Enough)

We were all taught to "look for the padlock", and today that advice is actively dangerous. The padlock only means the connection is encrypted. A page built to steal from you can have one too — and nearly all of them do.

The signal that matters: the domain

Read the address character by character. Fake pages imitate known brands using tricks like:

• A changed or doubled letter that is easy to miss at a glance.
• An extra word attached to the brand name.
• The brand name used as a subdomain of some unrelated site.
• A different ending than the one the brand actually uses.

Other warning signs

• You arrived via a link: from an email, message or ad. Almost no scam finds you if you type the address yourself.
• Urgency: "your account will be suspended in 24 hours". The rush exists so you do not think.
• It asks for more than it needs: a store selling digital goods does not need your banking password.
• Sloppy writing and odd translations.
• An offer that makes no sense: if the price cannot possibly work, something is broken in the middle.

The golden rule

If a message tells you to log in somewhere, do not use that link. Close it, open the official app or type the address yourself. If the alert was real, you will see it there too.

If you already entered your details

1. Change that password immediately
2. Change it anywhere else you reused it
3. Turn on two-factor authentication where you can
4. If you entered banking details, contact your bank

The scams doing the rounds in 2026

• Giveaway DMs. A message on Instagram, TikTok or Discord says you won skins, diamonds or a gift card. The link opens a cloned login form. Discord's own red flags: the sender shares no servers with you, is in a rush, and wants you to click.
• QR codes "to verify". Scanning a QR someone sent you can log your account in on their device. Only scan QR codes you generated yourself in the official app.
• "I reported you by mistake". You are told to contact an "admin" to avoid a ban. The admin is the accomplice.
• Sponsored ads that copy a brand. They sit above the real result with the right logo and a look-alike domain. Paid placement verifies nothing.
• Cheap top-up sites asking for your game password for a product that everywhere else is delivered by player ID.

How to read an address without getting fooled

The part that identifies a site is the last two pieces before the first slash: the name and its ending (for example, mybank.com). Everything else is decoration. With a made-up example: in "pay.mybank.com/login" the site is mybank.com. In "mybank.com.secure-pay.xyz/login" the site is secure-pay.xyz, and "mybank.com" is just a subdomain the scammer chose.

• On a phone the browser shortens the address. Tap the bar to see the full URL before typing anything.
• In email, compare the display name with the actual address; Google recommends exactly that because the name can be anything.
• On a computer, hover over a link without clicking: the real destination appears at the bottom left.
• Brands keep the same ending. If a site was always .com and today it is .xyz, .top or .shop, it is someone else.

Browser and system tools that cover you

• Chrome Safe Browsing: Settings > Privacy and security > Security > Enhanced protection. It blocks many known phishing pages before they load.
• Safari on iPhone: keep Fraudulent Website Warning on in Settings > Apps > Safari.
• Your password manager as a detector: if it saved a login for a site and does not offer it on the current page, the domain does not match. That pause has saved more accounts than any warning banner.
• Passkeys: where a service offers them, use them. A passkey is bound to the real domain and cannot be typed into a fake page, so classic phishing stops working. Google supports them on Android 9+ and iOS 16+.

How to vet a store before paying

1. Look for reviews outside the store's own page (Google, communities), not just testimonials it displays.
2. Check for a legal notice, a refund policy and a contact channel that answers. On Krosty Shop you can read the customer reviews, the legal notice and the refund policy.
3. Compare what they ask for with what the product needs: an ID-based top-up does not need your password or a photo of your ID card.
4. Be suspicious of prices far below everyone else. If the number cannot work, the margin comes from something they are not telling you.

If you are buying for someone in Venezuela, Is Krosty Shop safe? covers delivery, reviews and guarantees in detail.

If you clicked but typed nothing

Clicking a bad link rarely compromises an account by itself; entering data or installing something does. Even so:

• Close the tab and do not open any file that downloaded.
• Review active sessions in your Google account (Security > Your devices), Apple and Discord, and sign out the ones you do not recognize.
• Report the message: in Gmail it is under the three-dot menu as Report phishing. That helps the next person.