How to Know if an Online Business or Company Is Legitimate

Co-authored by Michael R. Lewis

Last Updated: April 27, 2024 Approved

Scammers are always looking to make a quick buck off of you online. Although this is a sad fact of life, it is also possible to be proactive in finding out if a business is legitimate. If you feel like a business isn't legitimate, it's always better to be safe than sorry by not buying from that company.

Quick Steps

Check your browser’s address bar for a key or padlock icon.
Scan URLs for an “s” (in “https://”), signifying it’s a more secure site than a plain “http.”
Look for a physical business address on the site and Google it to confirm it’s real.
Check for typos, unprofessional language, and suspicious offers.
Avoid sites with lots of pop-up ads (and don't click on them when you close them).

Part 1

Part 1 of 3:

Looking for Signs of a Bad Business

Download Article

Legitimate online stores and sites that store personal information will have a closed padlock or key in the address bar portion of your web browser (the bar at the top where you type in the website's address). This symbol means that the connection with the website is encrypted and your information is secure. Some browsers may also show the address bar as green for these websites. Avoid sites where the address bar is red, the padlock is shown as open, or the key is broken. This signifies an unsecured connection. ^{[1]
X
Research source}
2
Check for a physical address. Even online businesses should have physical addresses. If the website you are looking at doesn't appear to have a physical address or contact information at all, that's suspicious. You should be able to contact the business in case of trouble.
- Choosing a website based in the US can help you to avoid scammers who work in other countries. When scammers are in other countries, it can be harder to follow up with the law.
- To determine the location of the website, use an IP-checker website like check-host.net or get-site-ip.com. The website's country and, in some cases, specific location, will be shown.
Advertisement
While a professional-looking website does not mean it's legitimate, a very unprofessional website is a sign it could be a scam. Look for spelling mistakes, loading errors, and poor-quality pictures. If you notice these signs, you may want to investigate further or not use that company at all.
Legitimate business generally avoid placing pop-up ads that open new tabs or windows without your permission on their websites. This is because such ads drive away business and make their websites seem unprofessional. If you come across a website with this type of ad, don't input any personal information or buy anything. And don't click on the pop-up ads; just close them as quickly as possible. ^{[2]
X
Research source}

Part 2

Part 2 of 3:

Checking Up on the Company

Download Article

If the business has a number listed, call the number. See if they answer as the business and sound professional. If they do, this doesn't necessarily mean they are legitimate. However, if they don't, that's a sign you should take your business elsewhere.
The company must do business in a particular state. Most states require companies to register their business with the state. Therefore, you can use the registry in your state to check to see if it's an actual business.
3
Search the Better Business Bureau. The Better Business Bureau gives reports on businesses, partially based on reviews reported by customers like you. Not every business is listed, but you can find out more information about your business if it is, such as what kind of rating it has. The Better Business Bureau gives out grades, much like a teacher on a paper. ^{[3]
X
Trustworthy Source
Better Business Bureau
Nonprofit organization dedicated to promoting marketplace trustworthiness by educating consumers and reviewing businesses
Go to source}
- For instance, a very good business will have an A+. A very bad business will have an F. A business that has a B or a C may be a legitimate business, but it may not offer very good customer service or it may have other problems.
While reviews can be faked, if a business is bad or even a scam, you should be able to find bad reviews about it. Check major review sites, which offer reviews of even online businesses. Check to make sure people aren't saying the business is bad or is a scam. ^{[4]
X
Research source}
5
Ask friends and family. Check around with your friends and family. See if any of them have used the business before and what their experience is with the business. Oftentimes, someone you know will have used the business, and they can confirm it is legitimate.
- A quick way to check is to use social media. Post the name of the online business on your account, for instance, and ask your friends if anyone knows anything about the company.

Part 3

Part 3 of 3:

Protecting Yourself

Download Article

If a business sends you an error message for your payment, your natural inclination is to want to figure out another way to pay. However, if the company asks you to wire money instead, that's a red flag. Stop right there, and ignore any further messages from the company.
Credit cards offer more protections than if you use your bank account or debit card. Therefore, if you make a purchase with your credit card and the company is fraudulent, you may have an easier time getting your money back or cutting the card off.
Another option is using a payment mediator instead, such as PayPal. These services are designed to protect your information from those who may want to steal it. PayPal accounts are free to setup and use if you are using them to buy goods online (the company only charges fees to sellers and international money transfers).
4
Check for the "s." When on a website where you're giving your personal info, look for the "s" after the "http." In other words, it should be "https://" This "s" means your personal information is more secure than on sites that don't have it. The "s" refers to the secure socket layer and that communication between your browser and the website is encrypted. ^{[5]

X
Research source}
- Also, look for a tiny padlock when you are checking out. It should be in the bottom, right-hand corner.
- Alternatively, the website might have a statement about how the website is secured. ^{[6]
  X
  Research source}
If the company sends you an email asking for personal information, do not send it to them. Legitimate companies will never ask for things like your password, your social security number, or your credit card number through email. ^{[7]
X
Research source}
6
Update your computer and smartphone software and hardware. Keeping your technology up-to-date is important, as often these updates are related to security. Therefore, whenever your computer or phone asks you to update your software, you should do so. ^{[8]
X
Research source}
- However, never click on a part of a website or popup from the internet that tells you to update, as often times these are a scam to infiltrate your computer with a virus. Make sure it is actually your computer software asking you for the update.
7
Make strong passwords. Use strong passwords with your financial information. Strong passwords are longer than 8 characters and have at least letters and numbers. Some companies also let you add special characters. Don't use the same passwords on all sites, even legitimate ones, since a hacker could easily break into one account after another if they get one of your commonly-used passwords. ^{[9]
X
Research source}
- One way to create a strong password is to think of a phrase that you can remember, such as "I like blueberry pie for dinner." Start replacing things in the phrase with other things. For instance, you could replace some of the words with the number of letters in the word, such as "Ilike9336."
- Alternatively, you could replace some of the words with special characters, representing the number of letters in the word but using the symbol on the keyboard in place of the number. For instance, "Like" has 4 letters. You could use the symbol "$" in place of it, because it shares a key with the number 4. Your phrase, then, might look something like this: "!$(#4dinner." Just make sure you can remember or keep it in a secure location.
Phishing is when a scammer poses as a legitimate website to steal your information. If you get an email from a company you trust, make sure it is actually from them by looking at the email name. Also, when you click on the link, make sure it has the company at the top. Often, it's safer just to put in the company's website yourself if you need to update information. ^{[10]
X
Research source}