You're about to buy from, register on, or deposit money to a website you've never used. Spend 90 seconds on this checklist first.
The 10-point checklist
- Run it through GACS Safe Scanner. 4-second verdict against 250k+ reports.
- Domain age. WHOIS lookup. Under 6 months = high risk.
- HTTPS certificate issuer. Click the padlock. Real businesses use real CAs and often have organization names on the cert.
- Contact page. Real address, real phone, real company registration number. Not just a webform.
- Reverse-image-search the logo and team photos. Stock photos and AI-generated faces = run.
- Google "[brand name] scam" — read the third page, not the first.
- Check Trustpilot, BBB, and Reddit. Five-star reviews all in the same week = paid.
- Look up the company on the local business registry (Companies House, SEC EDGAR, ASIC, etc.).
- Check for a regulator if it's financial: FCA, ASIC, SEC, MAS, BaFin, FINRA.
- Try a tiny test transaction before any large one. If a $10 withdrawal is blocked, a $10k one will be too.
Catch-all rule
If you can't explain in one sentence how this business legally makes money, don't give them yours.