Scam websites and clone firms are designed to look like the real thing, so the most reliable defence is a habit of checking before you pay rather than trusting how a page looks. This article combines guidance from the National Cyber Security Centre (NCSC) on online shopping with the Financial Conduct Authority’s (FCA) guidance on checking financial firms, and explains how to report a suspicious site. The reporting routes differ between Scotland and the rest of the UK, and this article notes where.
Look-alike domains and how to avoid them
The NCSC warns that criminals create deceptive domains that imitate genuine retailers, giving the example www.tescos-sales.com. Its practical answer is to type the official website address of the organisation directly into the browser’s address bar, rather than following a link from a message, an advert or a search result you are unsure about.
Researching a shop you have not used before
The NCSC advises researching shops using consumer websites and trusted reviews before buying. Pair that with a look at the address itself, checking carefully for extra words or changed spellings compared with the brand you expect, since a look-alike domain relies on you not reading the address closely. If a deal seems far below prices elsewhere, treat that as a reason to look harder, not as a bargain to grab.
Choosing how to pay
- Use a credit card where you can, since many protect online purchases as part of the Consumer Credit Act, according to the NCSC.
- Debit cards offer less protection but may qualify for chargeback claims.
- Payment platforms such as PayPal, Apple Pay and Google Pay provide varying coverage, so check their terms.
- Never use a direct bank transfer for online purchases.
The NCSC also suggests giving only the mandatory information (marked with asterisks), using guest checkout when it is offered to avoid creating unnecessary accounts, avoiding storing payment details in browsers or with retailers, and using unique strong passwords with 2-step verification on important accounts.
Checking a financial firm on the FCA Register
For loans, investments, insurance and similar products, the FCA points consumers to the Financial Services Register, the official public record of firms and individuals. Its guidance highlights a specific risk called a clone firm, which it describes as a copy of a genuine, authorised firm. In a clone firm scam, fraudsters pretend to work for an authorised firm to con you.
The FCA’s protection strategy is to make sure the contact details you have been given for the firm match those on its Firm Checker. It also points out that the firm’s contact details on the register are provided and confirmed by the firm, so you should cross-reference independently rather than relying only on details supplied by the firm itself. It publishes a Warning List of the firms it has issued warnings about, so it is worth checking that too. The FCA guidance concerns financial services regulation and does not tell you whether an ordinary online shop is reliable, so use the NCSC advice for that.
Reporting a suspicious website
The NCSC runs a portal for reporting scam websites. It says reporting is free and takes about a minute, and you can submit as many suspicious URLs as you like, including sites that feel suspicious even if you are not certain they are scams. The NCSC’s advice is not to click any links on a suspicious website and not to enter any personal information.
After a report, the NCSC says it may seek to block the address that emails came from, work with hosting companies to remove links to malicious websites and raise awareness of commonly reported suspicious emails. It does not give individual outcome notifications, but says it acts on every message it receives. Its wider shopping guidance adds that suspicious emails can be forwarded to the Suspicious Email Reporting Service, suspicious texts sent to 7726, and scam adverts reported to the Advertising Standards Authority.
If you have already paid or shared details
The NCSC says to contact your bank immediately and report the incident to Report Fraud if you live in England, Wales or Northern Ireland, or to Police Scotland if you live in Scotland. Acting quickly matters because your bank can explain what options exist for the particular payment method you used.
A short pre-payment checklist
- Type the retailer’s address yourself, or use a bookmark you created earlier.
- Read the domain letter by letter for added words or spelling changes.
- Look for reviews from trusted consumer websites, not only testimonials on the site itself.
- Pay by credit card or a method whose terms you have read, and never by bank transfer.
- For financial products, check the FCA Register and Warning List, and use the register’s contact details.
- Report anything suspicious to the NCSC.
The bottom line
Look-alike websites and clone firms rely on you skipping checks. Type addresses yourself, research unfamiliar shops using trusted review sites, pay by credit card rather than bank transfer, and verify financial firms on the FCA Register using its contact details, not the ones you were given. Report suspicious sites to the NCSC, and if money or details are at risk, contact your bank and report to Report Fraud in England, Wales and Northern Ireland or to Police Scotland in Scotland.