You’re shopping online, find a great deal, and notice a small padlock next to the website address. That usually feels reassuring.
For years, people have associated this symbol with online security. But there’s something important you should know: even a fake website can display a padlock.
Scammers can create convincing websites with familiar logos, professional designs, and encrypted connections to trick visitors into sharing passwords, payment details, and personal information.
So what does the padlock actually mean, and how can you tell whether a website is trustworthy?
The padlock traditionally displayed in a browser’s address bar indicates that a website uses HTTPS, a protocol that helps protect communication between your browser and the website’s server.
HTTPS uses encryption to make it harder for third parties to intercept or modify information while it travels across the internet.
For example, when you enter information into a form, HTTPS helps protect that information during transmission.
However, there’s a critical distinction: an encrypted connection does not guarantee that the person or company operating the website is legitimate.
Google explains this difference in its official guide on how to check whether a website’s connection is secure.
Yes. And that’s one reason phishing websites can be so convincing.
Imagine receiving a text message claiming that your package is being held until you pay a small delivery fee.
You open the link and see a familiar shipping company logo, professional-looking graphics, and an HTTPS connection.
Everything seems legitimate.
But the website may actually belong to scammers who created a fake page to collect your credit card number, address, or other personal information.
In that situation, HTTPS protects the connection to the fraudulent website. It does not prevent the website operator from misusing the information you submit.
That’s why the padlock should never be your only sign of trust.
The padlock became so widely misunderstood that Google redesigned how Chrome displays website security information.
Modern versions of Chrome use a controls icon instead of the traditional padlock.
The goal was to avoid suggesting that a website is trustworthy simply because its connection is encrypted.
In its official explanation, Google’s Chromium team described why it replaced the padlock icon, emphasizing that HTTPS does not establish the trustworthiness of a website.
The change reinforces an important distinction: a connection can be technically secure while the website itself remains dangerous.
Instead of relying on one symbol, look at several details before signing in, shopping, or sharing personal information.
Scammers frequently create domains that resemble those of legitimate businesses.
A swapped letter, an extra word, or an unexpected hyphen can make a fraudulent address look convincing.
For example, store-example.account-alert.com does not necessarily belong to a company called Store Example. The controlling domain in this example is account-alert.com.
Always compare the actual domain with the company’s official website.
Huge discounts, countdown timers, and messages claiming an offer will expire in minutes can be used to pressure shoppers.
Before entering payment details, visit the retailer’s official app or website independently.
Unexpected links received through SMS, iMessage, email, or social media should be treated cautiously.
Even messages that appear to come from familiar brands may be part of a phishing attempt.
Be suspicious if a website unexpectedly asks for your password, verification code, banking information, or sensitive personal details.
A professional design does not make these requests legitimate.
Security tools can help identify suspicious URLs before you open them.
In the PSafe blog, we explain how to check if a link is safe and how dfndr Security scans suspicious URLs.
A link checker can help identify potential threats, but it should always be combined with checking the domain and verifying the source of the message.
Some common red flags include:
A single warning sign does not always prove fraud. However, several signs appearing together should make you reconsider whether the website is legitimate.
If you realize a website may have been fraudulent after entering personal information, act quickly.
If you entered a password, change it immediately using the official website or app. Change that password anywhere else you reused it.
If you shared payment details, contact your bank or card provider through an official channel.
You should also enable multi-factor authentication, review recent account activity, and check for unexpected downloads or installations.
Avoid returning to the suspicious page to investigate further. Use the official company’s contact information instead.
HTTPS remains an essential part of safer web browsing.
It protects information in transit and helps prevent certain types of interception or tampering.
But encryption and legitimacy are not the same thing.
A trustworthy website should protect its connection, yet a protected connection alone does not make a website trustworthy.
Before making payments, entering passwords, or sharing sensitive information, take a moment to verify the address and the reason you’re being asked to act.
The padlock protects the connection. Checking the website helps protect you.
Have you ever received an Android update notification and decided to install it later? In…
A cyberattack targeting Einstein Hospital Israelita, one of Brazil's leading hospitals, has raised concerns about…
AI on your phone can already generate images, summarize text, answer questions and help write…
didn't try to log in, change phones, or register your number anywhere. It is easy…
Creating AI study flashcards has become a quick way to turn class notes, summaries, and…
OpenAI dots were announced on September 29 as agents that can keep working on a…