Short answer: a website is probably legitimate if it publishes a real legal entity name and address, names a grievance officer with a working contact, has a domain older than about a year, accepts payment through a regulated gateway rather than a personal UPI handle, and states a returns policy in specific numbers. If it fails three or more of those, stop before you pay. The full 14-point check below takes about five minutes and needs nothing but a browser.
This is a consumer guide, not legal or financial advice. Nothing here is a verdict on any particular company.
Why the usual advice does not work any more
Most “how to spot a fake site” lists still say look for the padlock. That advice is a decade out of date. Domain-validated TLS certificates are free and issued automatically, so a fraudulent store gets its padlock in about ninety seconds. In practice, HTTPS now tells you exactly one thing: nobody on the network in between can read what you type. It tells you nothing about who is on the other end.
The signals that still work are the ones that cost a fraudster either money, time, or legal exposure to fake. A registered company identity costs legal exposure. A two-year-old domain costs time. A regulated payment gateway costs both, because onboarding requires KYC. Those three axes are what the checklist below is built on.
The 14-point check, ranked by how hard it is to fake
| # | Check | How to do it | Strength |
|---|---|---|---|
| 1 | Legal entity is named | Scroll to the footer and the Terms page. Look for a full registered name (“… Private Limited”, “… LLP”) and a street address, not just a brand name and a Gmail address. | Very strong |
| 2 | That entity actually exists | Search the name in the MCA company master data (mca.gov.in) for companies and LLPs. An unregistered seller is not automatically a fraud, but a claimed company that does not exist is decisive. | Very strong |
| 3 | GSTIN is published and valid | If a GSTIN is shown, verify it with “Search Taxpayer” on gst.gov.in. The legal name it returns must match the one on the site. | Very strong |
| 4 | A grievance officer is named | The Consumer Protection (E-Commerce) Rules, 2020 require Indian e-commerce entities to display a grievance officer’s name, contact and a resolution timeline. Its absence is both a red flag and a regulatory breach. | Very strong |
| 5 | Payment goes to a gateway, not a person | At checkout, do you land on Razorpay / PayU / Cashfree / CCAvenue / Stripe, or are you asked to send money to a personal UPI ID, a QR code, or an individual’s bank account? The second is the single most reliable fraud signal there is. | Very strong |
| 6 | Domain age | Any WHOIS lookup shows a creation date. Under ~6 months on a store selling branded goods at a heavy discount is a serious warning. | Strong |
| 7 | Contact test | Send one specific pre-sale question. A real business answers a pre-sale question, usually within a working day. Silence before they have your money predicts silence after. | Strong |
| 8 | Returns policy is specific | “7 days from delivery, unopened, buyer pays return shipping” is a policy. “We stand behind our products, customer satisfaction guaranteed” is marketing copy pretending to be one. | Strong |
| 9 | Product photos are original | Right-click → search image. If the same photo appears on twenty other stores and an AliExpress listing, you are looking at a dropship shell, not a retailer. | Strong |
| 10 | Price sanity | Compare against two established retailers. A genuine 70% discount on current-season branded electronics essentially does not exist outside clearance events with stated terms. | Moderate |
| 11 | Review pattern, not review count | Look at distribution and timing, not the average. Dozens of five-star reviews within a few days of each other, all short, all first-name-only, is a manufactured pattern. | Moderate |
| 12 | Off-site footprint | Search the brand name plus “complaint” and plus “refund”. Look for discussion the company does not control — forums, subreddits, consumer sites. | Moderate |
| 13 | Social accounts have history | An Instagram account created last month with 40k followers and 6 posts is bought reach. Look for two years of ordinary, boring posting. | Moderate |
| 14 | Site quality | Broken template text, mixed currencies, a “Contact” page linking to a different brand, policy pages copy-pasted from another store with the old name still in them. | Weak on its own |
The five-minute version
If you only have five minutes before you decide, do these five in this order. They catch the overwhelming majority of fraudulent stores:
- Read the footer and Terms page for a registered legal name and address (checks 1 and 4).
- Look up that name on MCA or GST (checks 2 and 3).
- Start a checkout and stop at the payment step to see who is being paid (check 5).
- Check the domain creation date (check 6).
- Search “brand name + refund” and read the first page of results that the brand did not write (check 12).
A site that clears all five is not guaranteed to be good. It is, however, a real business you can pursue if something goes wrong — and that is what “legit” actually means in practice.
Red flags that should end the transaction immediately
- Payment to a personal UPI ID, QR code or individual bank account. There is no consumer-protection path behind a person-to-person transfer you authorised. This is the one that ends conversations.
- Pressure to move off the site — “WhatsApp us for a better price”, “order on Telegram”. It removes every audit trail and every dispute mechanism.
- A request for an OTP. No legitimate business, bank, courier or marketplace ever needs an OTP read out to them. Ever.
- An advance “delivery fee”, “customs charge” or “refund processing fee” to release something you are owed. Money never has to flow toward you to reach you.
- Cryptocurrency or gift cards as the payment method for ordinary retail goods.
- No physical address anywhere on the site, or an address that turns out to be a residential flat, a coworking desk, or a location in a completely different country from the claimed one.
What a legitimate but poorly-run site looks like
Not every bad experience is fraud, and it is worth knowing the difference, because the remedies differ completely. A legitimate but badly-run business typically has a real registered entity, a working gateway, a genuine but slow support queue, and a returns policy it honours inconsistently. Your route there is the company’s own grievance officer, then the National Consumer Helpline on 1915, then a consumer commission complaint through the e-Daakhil portal.
Fraud looks different: no traceable entity, payments to individuals, and contact channels that go dark the moment money moves. Your route there is the cybercrime helpline 1930 and cybercrime.gov.in, and speed matters far more than paperwork.
How to check a site you have already bought from
Doing the checklist after the fact is still worth it, because it tells you which queue to join. Run checks 1 to 5. If the entity is real and the payment went through a gateway, you have a commercial dispute and a months-long but reliable path. If the entity does not exist and you paid a person directly, treat it as fraud and report within hours rather than days — the practical chance of recovering funds falls sharply once the money has been moved on.
Frequently asked questions
Does an HTTPS padlock mean a website is safe to buy from?
No. A padlock only means the connection is encrypted so that third parties cannot read it in transit. Domain-validated certificates are free and issued automatically within minutes, so fraudulent sites have them as routinely as legitimate ones do. Encryption says nothing about who is receiving your money.
How do I check if an Indian company is registered?
Use the MCA21 portal at mca.gov.in and search the company master data for the exact registered name shown on the site. For a GSTIN, use “Search Taxpayer” on gst.gov.in and confirm the legal name it returns matches. Both are free and need no login.
Is a website with very few reviews automatically suspicious?
No. New legitimate businesses genuinely start with no reviews. What matters is whether the review pattern is plausible: a handful of mixed reviews over several months is ordinary, while two hundred five-star reviews inside a fortnight is not. Judge the shape of the distribution, not the count.
What should I do if a seller asks me to pay by UPI to a personal number?
Do not pay. A person-to-person UPI transfer that you authorise is treated very differently from a gateway payment: there is no merchant on the other side to raise a dispute against, and reversal depends almost entirely on the recipient’s bank freezing the account before the money is moved. Ask to pay through the site’s normal checkout instead, and treat refusal as a final answer.
How old should a domain be before I trust it?
There is no hard threshold, but domain age is a useful weight rather than a verdict. Under six months on a store advertising deep discounts on branded goods deserves real suspicion. Over two years, combined with a verifiable registered entity, is reassuring. A brand-new domain on an otherwise fully verifiable company is normal — businesses do launch new sites.
Can I get my money back if a website turns out to be fake?
Sometimes, and speed is the main variable. Card payments have a chargeback route through your issuer. Gateway-processed payments can be disputed with the merchant and the gateway. Direct UPI transfers to an individual are the hardest to recover and depend on reporting to 1930 or cybercrime.gov.in quickly enough for the receiving account to be frozen.
Comments (0)