The internet has made it easier than ever to shop, make payments, access banking services, apply for jobs and communicate with businesses.
But there’s a growing problem: fake websites designed to steal your money, passwords and personal information.
A fraudulent website can look surprisingly professional. It may copy the logo, colours, fonts and layout of a legitimate company. Some even use domain names that look almost identical to the real website.
For Kenyan internet users, this can be particularly dangerous when dealing with M-Pesa, online banking, e-commerce, government services and mobile networks.
The good news is that you don’t need to be a cybersecurity expert to spot many fake websites.
Here are 10 warning signs to check before trusting a website.
1. Check the Website Address Carefully
The first thing you should check is the website’s URL.
Scammers often create addresses that look similar to legitimate websites but contain small changes.
For example, a fraudulent website might use:
- Extra words
- Misspelled brand names
- Unusual combinations of letters
- Additional hyphens
- Suspicious subdomains
- An unfamiliar domain extension
Don’t just look at the logo or website design. Read the actual address in your browser’s address bar.
Watch out for look-alike domains
A scammer might register a domain designed to resemble a legitimate company.
For example, a fake website could use a variation such as:
example-company-login.com
instead of the company’s genuine domain.
A familiar-looking name doesn’t automatically mean the website is genuine.
2. Don’t Assume HTTPS Means a Website Is Legitimate
You may have learned to look for the padlock icon and https:// before entering information.
HTTPS is important because it encrypts communication between your browser and the website.
However, HTTPS does not prove that a website is legitimate.
Scammers can also obtain HTTPS certificates for fraudulent websites.
Therefore, don’t stop at the padlock.
Check the entire domain name and make sure you reached the site through a trustworthy source.
3. Be Suspicious of Urgent Messages
Many fake websites are reached through messages designed to make you panic.
For example:
“Your account will be suspended today.”
“Your payment has failed. Verify now.”
“You have won KSh 100,000.”
“Your package cannot be delivered.”
“Your account requires immediate verification.”
The goal is to make you act before you have time to think.
If a message contains an unexpected link and creates a sense of urgency, stop and verify it independently.
Instead of clicking the link, open your browser and manually enter the company’s official website address.
4. Look for Poor Grammar and Strange Language
Many fraudulent websites contain spelling mistakes, awkward sentences or inconsistent wording.
A website pretending to represent a major company but containing numerous grammatical errors should make you cautious.
Look for:
- Spelling mistakes
- Strange sentence structures
- Inconsistent company names
- Poor translations
- Missing information
- Unprofessional wording
However, don’t rely on grammar alone.
Some sophisticated scam websites may contain professionally written content.
Treat language problems as one warning sign among several, rather than definitive proof.
5. Check the Contact Information
A legitimate business should generally provide ways for customers to contact it.
Look for:
- Physical address
- Official phone number
- Business email
- Customer-support information
- Social media accounts
- Company information
Be cautious when a website only provides a generic email address or a contact form with no other information.
You should also verify contact information independently.
A scam website can simply publish a fake phone number or email address.
6. Be Careful With Prices That Are Too Good to Be True
Extremely low prices are one of the oldest tricks used by online scammers.
Imagine finding a smartphone normally worth KSh 80,000 being advertised for KSh 15,000.
Before celebrating the deal, ask why the price is so low.
Scammers may use unrealistic discounts to convince people to make quick payments.
Be particularly careful when a website:
- Offers huge discounts
- Demands immediate payment
- Has no clear return policy
- Only accepts unusual payment methods
- Has no verifiable business information
Compare prices with established retailers before making a purchase.
7. Check the Payment Methods
Payment options can provide useful clues.
Be cautious if an unfamiliar website insists that you:
- Send money to a personal number
- Pay through an unusual account
- Purchase gift cards
- Send cryptocurrency
- Make an irreversible transfer
- Share your M-Pesa PIN or banking credentials
Never give your M-Pesa PIN, bank password or one-time authentication code to a website.
A legitimate payment process should not require you to reveal confidential security credentials.
8. Don’t Enter Sensitive Information Too Quickly
Before entering personal information, ask whether the website actually needs it.
Sensitive information can include:
- Passwords
- M-Pesa details
- Banking information
- Card numbers
- National identification information
- OTPs
- Security answers
Phishing websites are specifically designed to collect this information.
If a website suddenly asks for sensitive information after you clicked an unexpected message, close the page and independently visit the organisation’s official website.
9. Search for the Company’s Official Website Yourself
This is one of the simplest ways to avoid phishing links.
Suppose you receive a message claiming to be from a bank.
Instead of clicking the link in the message:
- Open Google or another trusted search engine.
- Search for the bank’s official website.
- Check the official domain carefully.
- Navigate to your account from there.
You can also type the known website address directly into your browser.
This removes the suspicious link from the process.
10. Check the Website’s Reputation
Before buying something from an unfamiliar online store, search for information about the company.
Search for:
Company name + reviews
or:
Company name + scam
Look for independent reviews and complaints.
Don’t rely entirely on testimonials displayed on the website itself. Fraudulent websites can create fake reviews.
You can also check whether the company has an established online presence, including consistent social media accounts and verifiable business information.
Fake Website vs Legitimate Website
| Warning Sign | Fake Website | Legitimate Website |
|---|---|---|
| Domain | Often suspicious or look-alike | Official company domain |
| Prices | Often unrealistically cheap | Generally competitive |
| Contact details | Limited or suspicious | Verifiable information |
| Payment | May demand unusual methods | Established payment options |
| Urgency | Strong pressure to act | Usually reasonable |
| Information | May request unnecessary data | Requests relevant information |
| Reviews | Often difficult to verify | Independent reputation available |
| Security | May contain phishing forms | Uses appropriate security practices |
How to Safely Check a Link Before Clicking
If you receive a suspicious link by SMS, WhatsApp, email or social media, don’t click it immediately.
Instead:
Step 1: Look at the full URL.
Step 2: Check the domain name for spelling mistakes.
Step 3: Ask yourself whether you expected the message.
Step 4: Visit the organisation’s official website independently.
Step 5: Check whether the same notification appears in your account.
Step 6: If you’re still unsure, don’t enter any information.
Remember: you don’t have to click a link just because someone sent it to you.
What to Do If You Already Entered Your Information
If you accidentally entered your password, banking information or other sensitive details on a suspicious website, act quickly.
If you entered a password
Change it immediately, especially if you use the same password elsewhere.
If the password is reused across multiple accounts, change it on those accounts too.
If you entered banking information
Contact your bank using its official customer-service channels and explain what happened.
Monitor your account for suspicious transactions.
If you entered M-Pesa-related information
Secure your account immediately and contact the relevant official support channel.
Never give your M-Pesa PIN or OTP to someone claiming they can “fix” the problem.
If you downloaded a suspicious file
Don’t open it again.
Run a security scan using reputable security software and consider removing suspicious applications or files.
How to Teach Your Family to Spot Fake Websites
Online safety isn’t only about protecting yourself.
Parents, children, employees and older family members can all become targets of phishing scams.
Teach them three simple rules:
Stop
Don’t click immediately.
Check
Look at the website address and verify the information independently.
Protect
Never provide passwords, PINs or authentication codes to suspicious websites.
These three steps can prevent many common online scams.
Final Thoughts
Fake websites are becoming more convincing, but most scams still depend on one thing: getting you to act without checking.
Before entering personal or financial information online, take a few seconds to examine the website address, question unexpected messages and verify the organisation independently.
Most importantly, remember that HTTPS, a padlock icon, professional graphics or a familiar logo do not automatically mean a website is genuine.
When something feels rushed, unusually cheap or suspicious, stop.
Think before you click. Verify before you pay. Protect your information.
Quick Fake Website Checklist
Before entering sensitive information, ask:
✅ Is the domain name correct?
✅ Did I expect this website or message?
✅ Is the offer realistic?
✅ Can I verify the company independently?
✅ Does the website provide trustworthy contact information?
✅ Is it asking for information it shouldn’t need?
✅ Is someone pressuring me to act immediately?
If you cannot confidently answer these questions, don’t enter your information.
