How to reliably identify trustworthy websites

These days, practically every area of everyday life runs through the browser – whether you’re simply shopping, banking, streaming movies or booking a trip. Naturally, fraudsters know this too and try to exploit weaknesses in online security. According to an analysis by SCHUFA, the annual damage caused by fake shops, fake profiles, phishing and other scams amounts to several billion euros in Germany alone. 

More than a third of cases involve fake shops, and there are good reasons for that. It has never been easier to come across as professional online. Yet even as scams become more sophisticated, most dubious sites share the same weaknesses: They conceal who is behind them, collect more data than necessary, push risky payment methods and promise what no honest company can deliver. If you know what to look for, a reliable check takes only a few minutes.

A reputable company has no reason to hide the identity of the people behind its website – quite the opposite. That’s why the legal notice (Impressum) always includes the full company name, an address for service, an email address for quick contact and, where applicable, the registration number and VAT ID. In Germany, Section 5 of the Digitale-Dienste-Gesetz (DDG) makes this information mandatory for commercial websites.

However, this information only helps you detect fraud if you actually check it. Search online for the company name together with terms like “reviews” or “scam”, look up the address on Google Maps and check German companies in the commercial register (Handelsregister). You can do this without an account. If there is no legal notice, if the address turns out to be a residential building or a parking lot, or if the company name barely shows up online, if at all, simply leave the site right away.

Under the GDPR, websites must disclose exactly which personal data they collect, what it is used for and how long it is stored. A solid privacy policy is essential for this: It names the controller, lists service providers such as payment processors and explains how you can have your data deleted. Vague boilerplate text, or a policy in which a different company name suddenly appears, is not uncommon and immediately exposes dubious sites.

It’s also always worth checking the padlock icon in the address bar. That said, checking whether a site is encrypted isn’t enough, because anyone can use HTTPS. If a site is not encrypted, however, you should never enter any data. Pay close attention to how much data a site asks you for. If you’re supposed to upload sensitive data before you’ve even placed an order, or an app wants access to your contacts, be extremely cautious.

When it comes to paying online, you should exercise the utmost caution. It’s no coincidence that the EU has required strong customer authentication for most online payments since 2020. This usually means approving the payment in your banking app or entering a one-time code. A joint report by the European Banking Authority and the ECB confirms that this measure has significantly reduced the success rate of fraud attempts involving card payments. If, however, the payee is located outside the European Economic Area, where such checks are not mandatory, card fraud is 17 times higher. 

The data also shows where consumers are most vulnerable. For credit transfers, users bore around 85 percent of fraud losses themselves in 2024. That’s because they had authorized a redirected fake payment themselves. Once a transfer has been executed, the money is difficult or impossible to recover.

Our practical tips for you:

1. Choose payment methods with buyer protection or a chargeback option, such as credit cards or PayPal.
2. Always be suspicious if a site only accepts prepayment, cryptocurrencies or gift cards.
3. Never confirm a payment in your banking app that you didn’t initiate yourself.

In Germany, some industries may only operate with official authorization. These include, for example, banks, insurers, financial service providers, online pharmacies and service providers. The responsible supervisory authorities maintain public registers, known as whitelists. 

You can find authorized financial companies in BaFin’s company database, for example. Legal online pharmacies in the EU display a common safety logo that links to a national register. The same applies to other online services, there is a list maintained by the Joint Gambling Authority of the German States (Gemeinsame Glücksspielbehörde der Länder), where consumers can check whether licensed online gambling operators are officially authorised. Always make use of this option. Don’t simply rely on a seal in the site’s footer.

Terms and conditions may not be exciting, but they reveal a lot about a company. Before you enter into a contract, they must have been made easily accessible to you, and you must accept them. In addition, all prices are always shown including taxes, fees and withdrawal rights. For practically all online purchases in the EU, you as a consumer have a 14-day right of withdrawal. A reputable shop will inform you of this.

Strong warning signs include missing terms and conditions, spelling mistakes or the name of an unrelated company in the text, as well as missing or flawed withdrawal and privacy terms.

The oldest rule of consumer protection is also the most reliable one online. Brand-name goods at 70 percent off, guaranteed double-digit returns, a prize from a contest you never entered or a huge sign-up bonus? Stay away from this kind of bait! 

Heightened pressure to buy is another clear warning sign. Fake countdown timers, low-stock notices or urgent messages telling you to act immediately shouldn’t make you panic. Fraud often starts with a fake security alert that appears to come from your own bank and suggests you need to act fast.

Always take a critical look at reviews, too. When EU consumer protection authorities last examined 223 major websites, they could only confirm in 79 cases that the site operators were doing enough to prevent fake reviews.

If something has already gone wrong, every minute counts. Contact your bank or card provider immediately, change any affected passwords and report the incident to the police. The consumer advice center (Verbraucherzentrale) in your federal state can also help. 

To keep it from getting that far in the first place, all the previous tips taken together help you form a reliable picture of the company. So always take two minutes to answer these questions:

• Can I identify the company and verify its address?
• Does the privacy policy state who processes my data?
• Are payment methods with buyer protection available?
• Can I find any required licenses in the official register?
• Do I have to accept the terms and conditions and privacy policy before buying?
• Is the offer realistic?

This article was written in cooperation with DrückGlück