How to Check if a Website Is Legit Before You Enter Card Details
A calm, repeatable routine for checking a website before you type a card number, gift-card code or billing address — no special tools required.
Most card fraud that starts online does not involve hacking at all. It involves a person typing real card details into the wrong website. The page looked right, the logo looked right, and the request seemed reasonable — but the address in the browser belonged to someone else.
The good news is that checking a website is a skill, not a talent. You do not need technical knowledge, browser extensions or a paid service. You need a short routine you can repeat every time money or a card is involved. This guide gives you that routine.
Start with how you arrived
Before you look at the page itself, think about how you got there. The route you took is often the strongest signal you have.
- You typed the address yourself from the back of your card, a receipt, a statement or the packaging — strong starting point.
- You used a bookmark you created earlier from a trusted source — strong starting point.
- You opened the issuer’s official app from your phone’s app store — strong starting point.
- You clicked a search result or an ad — needs checking. Search results can include impersonators, especially in ads.
- You clicked a link in a text message, email, social post or chat — treat with suspicion until verified independently.
- Someone on the phone told you which site to visit — treat as a red flag until proven otherwise.
Read the address, not the page
Scammers can copy every pixel of a real page: logos, colors, footers, even the help-center links. What they cannot copy is the real domain name. That is why the address bar matters more than anything the page displays.
Look for the registered domain — the part immediately to the left of the ending such as .com, .net or .co.uk. In the address https://balance.mylabel.example/check, the registered domain is mylabel.example. Everything to the left of it (balance.) is a subdomain that the owner of mylabel.example controls.
mylabel.example/gift-balance is controlled by mylabel.example. But mylabel.example.balance-check.net is controlled by balance-check.net — the familiar name at the start is just decoration. Read from the ending backwards.
On phones, browsers often shorten the address. Tap the address bar to see the full version before entering anything sensitive.
Ask whether the request makes sense
Legitimate services ask for the minimum information needed for the task. A balance check for a gift card typically needs the card number and a security code printed on that card — not your bank login, not your Social Security number, and not a photo of the card front and back sent by chat.
- A page asking for a card PIN to “verify” the card is a major red flag. Online merchants do not need your card PIN.
- A page asking for both your card details and your online banking password is a red flag.
- A “free card checker” that asks you to type in a full card number, expiry date and security code is a red flag. Real issuers do not offer anonymous public tools that test whether a card works.
Check that the site says who it is
A real company is identifiable. Look for a clear legal name, a privacy policy, terms of use and contact routes that match what is printed on your card or receipt. Absence of these does not prove fraud, but presence of vague, copied or contradictory information is a warning.
Be careful with “Contact us” phone numbers shown on unfamiliar pages or in search snippets. Fake support numbers are a common route into card and gift-card scams. Use the number printed on the back of your card instead.
Notice pressure and urgency
Scams are built to stop you from thinking. Watch for countdown timers, warnings that your card will be “locked” or “cancelled” within minutes, prize claims, or messages saying your balance will be lost unless you act now. Real issuers do send alerts, but they do not need you to rush onto an unfamiliar website to fix them.
Use independent checks when unsure
If a page passes the basic checks but you still have doubts, there are free, independent signals you can use. None of them is proof on its own, but together they help.
- Browser warnings: modern browsers show full-page warnings for sites reported as deceptive. Never click through one when card details are involved.
- Public site-status tools such as Google’s Safe Browsing status page can show whether a site is currently flagged.
- Domain registration lookups (for example ICANN Lookup) can show when a domain was registered. A “bank” or “gift card” site registered a few days ago deserves extra suspicion.
- Compare the address with the one printed on your card or packaging, character by character.
Warning signs
- The domain is misspelled, has extra words, or uses a different ending than the one printed on your card.
- You reached the page from an unexpected message, pop-up or phone call.
- The page asks for a PIN, a full set of card details for a “free check”, or your online banking password.
- There is a countdown, threat of account loss or a prize you didn’t expect.
- Spelling mistakes, blurry logos or mixed brand names appear on the page.
- The site has no clear company name, privacy policy or terms.
- You were redirected through several addresses before landing on the page.
Checklist
- I reached this site by typing the address from my card, receipt or statement — or from a bookmark I trust.
- I read the full domain from the ending backwards and it matches exactly.
- The page only asks for information that this task actually requires.
- The site clearly identifies the company behind it.
- Nothing on the page is pressuring me to act immediately.
- My browser shows no security warning for this page.
Common mistakes
- Trusting the logo
- Logos and page designs are trivially copied. Only the domain identifies who controls the page.
- Trusting the padlock alone
- HTTPS means the connection is encrypted, not that the site is honest. Fake sites routinely use HTTPS.
- Clicking the first search result
- Ads and lookalike sites can appear above the real one. Prefer the address printed on your card.
- Calling a number from an unfamiliar page
- Fake support lines are a common scam. Use the phone number printed on your card.
What to do next
- Use our interactive website checklist before entering card details anywhere new.
- Bookmark the official sites you use regularly, using addresses from your card or statement.
- If you already entered details on a site that now looks suspicious, read our guide on what to do next.
Questions
Yes. Page design can be copied completely. The domain name in the address bar and the way you reached the page are far more reliable signals than how the page looks.
Not necessarily. The padlock means the connection is encrypted. It does not tell you who runs the site or whether they are trustworthy.
Sources and further reading
- U.S. Federal Trade Commission — How to Recognize and Avoid Phishing Scams (opens in a new tab)
- CISA — Recognize and Report Phishing (opens in a new tab)
- Google Transparency Report — Safe Browsing site status (opens in a new tab)
- ICANN Lookup — Domain registration data (opens in a new tab)
External links go to independent sources we consider authoritative. Check My Card is not responsible for their content.
This guide is general education, not financial or legal advice. For anything about your own card, contact your issuer using the number printed on your card. Spotted an error? Request a correction.
