HTTPS protects a connection; it does not establish that a seller will deliver what you ordered. Before paying an unfamiliar website, combine checks of the address, business, offer and payment destination. No single badge, review or search result can certify the transaction as safe.
Check the address you actually opened
Use the browser’s address bar, not just a logo or link’s displayed text. Read the hostname between https:// and the next slash. Then identify the registered domain and any subdomains. For example, shop.example.com is under example.com, while example.com.offers.test is under offers.test. These are illustrative addresses, not recommended shopping sites.
Spelling substitutions, misleading subdomains and an unexpected payment domain deserve investigation. Some legitimate payment processors use a different domain, so verify it through the merchant’s documented checkout flow. Never bypass a browser certificate or security warning to enter payment details.
Use HTTPS for its actual purpose
The FTC’s marketplace guidance explains that encrypted sites can still be scams. Keep HTTPS as a requirement for sensitive forms, then evaluate the seller separately. A polished page and a valid connection are not evidence of honest fulfilment.
Verify the business and the offer
- Look for a usable contact method, business identity and a specific delivery and refund policy.
- Compare the offer with other sellers and read independent reviews across more than one source. A single anonymous accusation or a wall of perfect ratings is not a verdict.
- Where a registration number is claimed, check it with the relevant official registry and compare the entity details. Not every legitimate business has the same registrations.
- Read exclusions, return shipping costs and payment terms before checkout.
- Stop if the seller changes the destination unexpectedly or pressures you to pay outside a marketplace’s protected process.
Use India’s suspect search with its limitations
The official NCRP suspect repository searches identifiers reported in cybercrime complaints. Its disclaimer says the reports can contain errors, are subject to investigation and do not form a complete database.
A match is a reason to pause and investigate. It is not conclusive proof that a named person committed a crime. No match is not a safety certificate: an identifier may be new or unreported. Use the website-search option linked from the official portal when checking a URL, and do not publish another person’s financial identifiers.
Banking domains are a clue, not a substitute for verification
The RBI’s .bank.in circular identifies IDRBT as the exclusive registrar for that banking domain and instructed banks to migrate. Verify your bank’s exact address through its official app, documents or support. A string containing “bank.in” somewhere in a longer hostname is not necessarily a .bank.in banking site. Do not extend that circular into a blanket claim about every .fin.in address.
Check the payment before authorising
Read the payee, amount and purpose in the payment app itself. Do not authorise an unexplained debit to receive a supposed refund. Review the card issuer’s or platform’s actual dispute process; protection and deadlines depend on the payment method, provider and circumstances. UPI and bank-transfer complaints should still be reported even though recovery is not guaranteed.
Do not install an unexpected APK or remote-access tool at a checkout’s request. If a service genuinely needs its app, find the official app independently and verify the reason before proceeding.
If you have already paid a suspected fraud in India, contact your bank or payment provider promptly, call 1930 and report through cybercrime.gov.in. Save the order, URL, messages and transaction reference. There is no reason to abandon reporting merely because an hour has passed.
Reviewed on 27 October 2026. Replaced absolute safety verdicts with evidence-based checks and clear limitations.
Techleez Editorial Team
The Techleez publishes practical digital guides. For our scope, use of AI assistance and corrections process, read our editorial policy.
More from this author →
