How to check if an online shop is legit: 8 checks before you buy

How can you tell if an online shop is legit?

A legit shop has a real company behind it that is easy to find, clear return rules and a sales history. A fake shop usually has prices that are too low, a fresh domain and no details you can verify.

Fake shops are a constant part of online fraud. CERT Polska's report for 2025 lists them among computer fraud cases, which made up 97% of 260,783 registered incidents. Below are eight checks that together take a few minutes.

How to check the shop's company: tax ID and business registers

In Poland an online shop must give its company details: the name, the authority that registered the business and the registration number, plus an address, email and phone number you can use to reach it quickly. Missing details are the first reason to walk away.

1. Find the tax ID (NIP) or court register number (KRS) in the terms or on the 'Contact' page.

2. Check a sole trader in the CEIDG business search on biznes.gov.pl, and a company in the KRS search (wyszukiwarka-krs.ms.gov.pl). Compare the name, address and start date.

3. If you pay by transfer, enter the account number in the VAT taxpayer register search (the white list). You will see whether the account belongs to the company named in the terms. An account in a private person's name or in a different country from the company's seat is a warning sign.

Note: scammers sometimes copy the details of a real, unrelated company. So also check whether the registered company has anything to do with the shop, for example whether it mentions the shop's address on its own site or in the media.

Check a foreign shop in the business register of its country. Remember that with a seller from outside the European Union, getting a refund or making a complaint is much harder, and the EU right of withdrawal cannot always be enforced in practice.

Terms, returns and the withdrawal form

4. Read the terms, even quickly. In the European Union, when you buy online you generally have 14 days to withdraw from the contract without giving a reason, with exceptions (such as made-to-measure items or goods that spoil quickly). The seller must tell you this and provide a model withdrawal form.

Terms copied from another shop (with someone else's name in the text), no information on returns, a returns address in a different country from the company's seat, or 'refunds only as a voucher' are signs your purchase could end in trouble.

Test the contact details before you buy. Call or send a simple question about delivery or returns. A number nobody answers, an email address that bounces, or only a contact form with no reply are signs that contact will be even harder after you pay.

You can check for free in website mode the privacy policy, terms and company details on the shop's site, as well as who the site passes your data to (third-party services).

How to check if a shop's website is safe: domain and address

5. Check the domain's age. For .pl shops use the NASK registry WHOIS (dns.pl/whois); for others, ICANN Lookup (lookup.icann.org). A shop with a huge sale on branded goods on a domain registered a few weeks ago is the typical picture of a scam.

Check the address itself too. A domain closely resembling a known brand, with '-outlet', '-sale' or '-pl' added, on an unusual ending, is a common pattern. A padlock and https decide nothing here, because scam sites have them too. We cover this in more detail in how to check if a website is safe.

Shop reviews: how to read them

6. Look for reviews outside the shop: search for 'shop name reviews' or 'scam', check forums and maps. Reviews on the shop's own site are controlled by the shop.

Since 1 January 2023, a seller in Poland that displays reviews must say whether and how it checks they come from real buyers, and whether it publishes all reviews or only positive ones. If that information is missing next to the reviews, nobody knows where they came from.

Look at prices and pressure too. A 70 or 90 percent discount on new branded goods, a countdown timer and 'only 2 left' on every product are a common set in fake shops. Compare the price with a few known shops: if the gap is huge, ask yourself why.

Be wary of reviews that are all five stars, written in similar language, and all from the last few days. Especially when the shop has existed for less time than its 'history of happy customers'.

The CERT Polska warning list and consumer warnings from UOKiK

7. Check the shop's domain on the CERT Polska warning list (lista.cert.pl). In 2025 almost 245,000 domains were added to it. If your Polish mobile operator uses the list, you will see a warning page instead of the site.

Also look at the consumer warnings from UOKiK, Poland's competition and consumer protection office (uokik.gov.pl, in the public information section). Its President issues them when there is a particularly well-founded suspicion of a practice that may cause significant losses to many consumers. There are few of them, and those from 2019 to 2025 mostly concerned financial services, investments and multi-level marketing networks, not online shops, so a shop missing from this list tells you little.

The UOKiK register of unfair contract terms (rejestr.uokik.gov.pl) shows whether clauses similar to those in the shop's terms have been found unfair.

How to pay safely and what to do if a shop scammed you

8. Pay by card or through a well-known payment provider. If you paid by card and the goods never arrived, you can file a chargeback claim with your bank, which UOKiK itself recommends to customers of dishonest shops. A transfer to a personal account is the hardest to recover.

Be careful if you are asked to pay outside the shop: a mobile payment code sent in chat, a transfer to an account given in a message, cryptocurrency or a gift card. These payment methods have no chargeback procedure and getting money back is very hard.

Check the address on the payment page. If the redirect leads to a domain that looks like a bank but is not, stop the payment. We explain how to read such addresses in how to check if a link is safe.

If the shop turned out to be a scam: call your bank (block the card, start a chargeback), report it to the police with the payment confirmation, screenshots and messages, and report the domain to CERT Polska at incydent.cert.pl. If you entered personal data on the site, read how to check if your data has been leaked.