The padlock is not the answer. Five checks that tell you who is really behind a site.
Resources / How do I check if a website is safe before I buy from it?
Five free checks, about two minutes, and not one of them is the padlock. Shopping scams were the most reported scam type involving financial loss in Australia over the first nine months of 2025, with 9,628 reports and $8.6 million lost, up 19 per cent on the same period the year before. The padlock in your address bar only means the connection is encrypted. It says nothing about whether the business is real or will send your order. Here is what actually tells you.
Five checks, all free
Proves encryption, not honesty
Lost to shopping scams, Jan to Sep 2025
The padlock and the https in your address bar mean one specific thing: the connection between your browser and that server is encrypted, so nobody in between can read what you type. That is worth having. It is not evidence of anything else.
Certificates that produce the padlock are free and automated. Anyone who controls a domain name can get one in minutes, and scammers do, because a site without the padlock now gets a visible browser warning that scares buyers away. A scam storefront set up last Tuesday will have a perfectly valid certificate.
Browsers used to show a green bar with a verified company name for higher-assurance certificates. They removed it years ago, partly because people read it as a trust badge it was never designed to be. So the padlock is the floor, not the verdict.
The reverse still matters. If a checkout page shows Not Secure, do not enter card details at all. That is a genuine red flag, just not a useful green light.
Australian businesses selling to Australians almost always have an ABN, and you can check it free and instantly on ABN Lookup, the Australian Business Register's public search. Find the ABN in the site's footer, terms or contact page and search it. If you cannot find an ABN anywhere on a site selling to Australians, that alone is worth pausing on.
Look at three things on the result: that the ABN status is active, that the entity name is a plausible match for the trading name on the site, and when the ABN was registered. An ABN registered three weeks ago, attached to a name that has nothing to do with the shop, on a site selling heavily discounted goods, is the pattern you are looking for.
You can also search by business name rather than number, which is useful when the footer gives you a company name but no ABN. For a larger purchase it is worth checking GST registration too, because a business charging you GST should be registered for it.
Scamwatch, run by the National Anti-Scam Centre, collects scam reports from across Australia and publishes warnings about current ones. Search the business name and the domain there before you buy.
Then do the plain search everyone forgets: put the business name into Google with the word scam, and again with the word reviews. Do the same with the bare domain name. You are looking for complaints that cluster around the same thing, usually goods that never arrived or a card that kept getting charged.
Ignore the testimonials on the site itself. Anyone can write those, and scam storefronts ship with them pre-filled. Reviews that sit on a platform the seller does not control are worth something. Reviews on the seller's own page are worth nothing.
Most scam storefronts are only weeks old, because they get reported and shut down, and the operators simply register another name. A free whois lookup shows you when a domain was first registered, and it is one of the fastest signals available.
A domain registered three weeks ago, selling brand-name goods at a large discount, is the single strongest warning sign in this list. A domain that has been running for eight years is not proof of honesty, but it is a much harder thing for a scammer to fake.
Australian domains carry an extra signal. To hold a .com.au or .net.au licence, auDA rules require an Australian presence, backed by an ABN, ACN or registered trade mark. That identity check does not exist behind a plain .com. It is a signal rather than a guarantee, but a business selling to Australians from a .com.au has at least been verified as an Australian entity.
Look for a real street address rather than just a PO box or a web form, a phone number, an ABN in the footer, and a returns policy that names a physical address to send things back to. Then test them. Call the number. Put the street address into Google Maps and see whether it is a warehouse, a suburban house, or a virtual office in another country.
One quick trick catches a lot of them: copy a full sentence from the About Us page and paste it into a search engine in quotes. Scam storefronts are cloned from the same templates, so the identical paragraph often appears on a dozen unrelated domains.
Check the email address too. A business with its own domain that asks you to email a free Gmail or Outlook address for support is worth a second look, for the same reasons we set out in why you should not run a business on a Gmail address.
This is the check that decides whether a mistake costs you money or just time. A credit card or PayPal gives you a chargeback path, so if the goods never arrive you have a real route to get the money back. Bank transfer, PayID, cryptocurrency and gift cards do not. Once those are sent, the funds are effectively gone.
So watch what happens at checkout. If a site pushes you off card payment at the last step, our payment processor is down, just transfer to this account, that is not an inconvenience. That is the scam, and it is the moment it happens.
The pressure pattern is the same one used inside businesses, where a message that looks like it came from the boss asks someone to buy gift cards urgently and quietly. Urgency plus an untraceable payment method is the combination worth reacting to, whoever is asking.
Everything above is what a cautious customer does before they trust you with a card number. That makes it a checklist for your own site, not just for other people's. A valid certificate so nobody sees a Not Secure warning, an ABN and a real address in the footer, a phone number that gets answered, and a returns policy that says something specific.
There is a technical half to this that customers never see but search engines and mail providers do, including whether your certificate is about to expire and whether your domain is protected against someone sending email that looks like it came from you.
Our free Website Security Checker runs that technical half on any site in a few seconds and gives you a graded report of what to fix. It is the same check we run at the start of a client engagement.
Website Security Checker: Run the technical half of these checks on any site, free and instantly.
CEO just emailed you asking for gift cards: The same urgency and untraceable-payment pattern, aimed at your staff.
I clicked a phishing link, what now?: The first hour decides how bad it gets. The steps, in order.
Email Security Checker: Check whether someone can send email that looks like it came from your domain.
No. The padlock means the connection is encrypted, so nobody in between can read what you type. Certificates are free and automated, so anyone who controls a domain can get one in minutes, scammers included. Treat it as a floor: a checkout page without it should never get your card details.
Search it on ABN Lookup at abr.business.gov.au, which is free and instant. Take the ABN from the site's footer or terms and check that the status is active, that the entity name plausibly matches the trading name, and when it was registered. A brand new ABN that does not match the shop name is a warning.
In one specific way, yes. auDA rules require an Australian presence backed by an ABN, ACN or registered trade mark before you can hold a .com.au licence, so there is an identity check behind it that a plain .com does not require. It is a useful signal, not a guarantee.
A credit card or PayPal, because both give you a chargeback path if the goods never arrive. Avoid bank transfer, PayID, cryptocurrency and gift cards, which are effectively final once sent. If a site pushes you off card payment at checkout, stop there.
Contact your bank or card provider straight away and ask about a chargeback, because the first hours matter most. Report it to Scamwatch, and if business accounts or credentials were involved, report it to ReportCyber at cyber.gov.au. Keep the order confirmation and any messages as evidence.
Tell us your team size and current setup. We will map what fits, honestly, with a fixed quote in one business day. Free 30-minute discovery call, no obligation.
Prefer to talk? Call (02) 9053 8789.
Belivanis Information Systems