Questions: Detecting Fake Websites and Online Scams

Question 1

You receive an email from '[email protected]' with a link to a site that has a padlock (HTTPS) and looks exactly like PayPal. Which statement is correct?

• A. The site is likely legitimate — HTTPS confirms it is an official PayPal site
• B. The site is likely a scam — the real domain is 'secure-verify.net,' not 'paypal.com,' even though paypal.com appears in the address
• C. The email might be legitimate — companies often use third-party security subdomains like this
• D. You cannot determine legitimacy from the URL alone; the padlock is the most reliable trust signal

Answer: (B)

Reading a domain correctly is critical: read from right to left, stopping at the first slash. The real domain is the part immediately before the first slash — here, 'secure-verify.net.' Everything before it is a subdomain that anyone can create freely. So 'paypal.com.secure-verify.net' is a subdomain of 'secure-verify.net,' not of 'paypal.com.' The padlock only confirms the connection to 'secure-verify.net' is encrypted — it says nothing about whether that site is trustworthy. This subdomain pattern (trusted brand as prefix of attacker's domain) is described as 'especially deceptive and extremely common.'

Question 2

A website selling electronics has HTTPS, an attractive professional design, and prices about 40% below retail. Which signal is the most actionable red flag?

• A. The padlock — HTTPS is only used by verified legitimate businesses
• B. The professional design — fake sites always look amateurish
• C. The prices — unrealistically low prices are a common scam signal, and the padlock only confirms encryption, not legitimacy
• D. The .com domain — legitimate businesses typically use .org or .net

Answer: (C)

Unrealistically low prices are a classic scam signal. The padlock and HTTPS tell you only that the connection is encrypted, not that the site is legitimate — fake sites routinely use HTTPS. Professional-looking design is not a reliable signal either; scammers invest in appearing credible. The combination of polished appearance with prices far below market value is a strong fraud pattern: the product either never arrives or is counterfeit. HTTPS is necessary but not sufficient for trust.

Question 3

A website with HTTPS and a padlock icon is safe to enter your password on.

• T. True
• F. False

Answer: False

HTTPS confirms that data between your browser and the server is encrypted and cannot be intercepted in transit. It says nothing about who controls the server. A phishing site can and routinely does use HTTPS, meaning your credentials are securely transmitted to the attacker — the encryption is working perfectly, just not in your favor. The padlock means 'this connection is private'; it does not mean 'this site is legitimate.' Its absence is a strong red flag; its presence is not a green light.

Question 4

Urgency messages like 'Your account will be suspended in 24 hours' are a reliable indicator of a scam because legitimate institutions rarely communicate time-sensitive account issues.

• T. True
• F. False

Answer: False

The claim that legitimate institutions never communicate urgently is an overclaim. Real institutions do sometimes send time-sensitive alerts — password breach notifications, genuine fraud alerts. The key insight is not that urgency is always fake, but that artificial urgency is a scammer's primary tool for preventing you from pausing to verify. The correct response is to slow down: navigate directly to the official site by typing its URL, call the institution's known phone number, or check through an app you already have installed — rather than clicking the link in the urgent message.

Question 5

Why is typing a website's address directly into the browser safer than clicking a link in an email, even if the email looks legitimate and the link text shows the correct address?

Model answer: Displayed link text can be completely different from the actual URL the link points to. An email can show 'www.paypal.com' as visible text while the underlying href points to 'paypa1-secure.com' or a subdomain of an attacker's domain. Even URLs that appear correct in email formatting may use Unicode lookalike characters or typosquatting that is hard to spot. When you type the address directly, you navigate to exactly what you type — no third party controls your destination. For high-stakes actions (banking, passwords, financial transactions), direct navigation eliminates the entire category of link-based phishing attacks in one habit.

The fundamental vulnerability of clicking links is that displayed text and actual destination are independent — the browser goes to the href, not the text. Hovering reveals the true URL in a browser, but email clients may not show this, and even visible URLs can use deceptive Unicode characters. Direct navigation bypasses typosquatting, subdomain attacks, and display-text deception simultaneously, which is why it is the single most effective defensive habit for high-stakes web interactions.