How to verify an online store before you pay

An honest shop says who runs it. The company name and registration number are usually in the footer or in the terms. If you cannot find them, you can stop: you do not know who you are contracting with, and if anything goes wrong there is nobody to approach.

Look the number up in the register of the country the company claims to be in. Most European registers are free, Companies House covers the UK, and US registrations sit with individual states. Most guides stop at “confirm the company exists”. That is the least the record can tell you.

The incorporation date is more interesting than the address. A company formed three months ago, selling electronics a third cheaper than everybody else, deserves the question of where the money comes from.

Compare the registered address with the address given for returns. When they differ and returns go to another continent, sending anything back will cost more than the item did.

The stated line of business need not match exactly, but a company registered only for consultancy that runs a cosmetics shop is a mismatch worth noticing. And when the company in the record has nothing to do with the site and nothing explains why, that is a signal — though trading under a different brand name is entirely ordinary.

An entry showing liquidation, administration or dissolution means the company is winding down. Ordering there is not automatically fraud, but it is a shop that may not exist in a few months, and there will be nobody to take a complaint.

A national register only knows its own companies. For a trader elsewhere in the EU, the VAT number is often the one independent confirmation available.

Enter the country code and the number from the shop's site into VIES. When the system says the number is valid, most member states also return the company's name and address. Compare them with what the shop says about itself.

Unavailable is not invalid. The answer comes from that country's tax administration, which is sometimes down or overloaded. “Cannot be verified” does not mean the number is wrong. It means you do not know right now.

Try more than one form of the number. Shops write VAT numbers inconsistently: with the country code, without it, with or without a leading zero. One failed lookup is not grounds for concluding the number is invalid. We made exactly this mistake in our own scanner, and a legitimate shop collected a serious finding it did not deserve.

When a trader outside the EU publishes neither a registration number nor a tax number, no independent record is left to you. Decide on the payment method instead, and pay in a way that lets your bank get the money back.

Any WHOIS lookup will give you a domain's registration date; for some country domains the national registry's own search is more reliable. The registration date is what you are after.

A domain a few weeks old on a shop with thousands of products raises the question of where the catalogue came from. On its own it proves nothing — every shop started somewhere. Combined with a missing company number and payment by transfer only, it does.

A hidden domain owner means little by itself. Registration privacy is normal and legal for private sites. On a shop you are about to send money to, it reduces traceability, so we count it as a minor point rather than a warning. Articles that treat it as an alarm are overstating it.

What an invented history on a new domain does to a shop's credibility is covered on the page about scam-shop lists.

This is the part guides leave out, and it is the part you most need.

Records say nothing about quality. A properly registered company can sell poor goods and take six weeks to deliver. Verification answers one question: is there somebody traceable behind this shop.

Card logos in the footer are not a payment method. A Visa and Mastercard image takes five minutes to paste in, and there need be no payment gateway behind it. Go through the checkout to the payment step. What each method means is covered in the piece on how to pay.

Reviews on the shop's own pages may have been written by the shop. You cannot tell, and neither can we. Look on independent platforms, and read the complaints rather than the praise. How the shop replied tells you more than the stars.

The padlock guarantees nothing. It means the connection is encrypted. A fraudulent shop gets a certificate free, exactly as easily as anybody else.

Sometimes we cannot read the terms either. When they are loaded by JavaScript, we retrieve an empty shell and do not assess their content. We say so on the result, and it is not the shop's fault.

The company registers our scanner can query are the Czech and Slovak ones. For a shop registered anywhere else that signal is simply missing, and we say so out loud rather than implying a source we do not have.

And the last limit, the one that matters most: even a verified shop is not a guarantee. When we found nothing that troubled us, that is exactly what it means, and not one word more.