A bag listed at half its usual price on a site you have never heard of is either a clearance or a con, and the page will not tell you which. It shows a padlock, a badge and a row of stars. So does the genuine site.
Shoppers have grown better at sensing that something is wrong and no better at proving it. Almost every reassurance a checkout page offers was written by the checkout page, which leaves it worth roughly as much as a stranger's word.
The signals worth anything are the ones somebody else keeps a copy of. A handful sit on registers anyone can open, and one consumer market publishes the entire list of who is allowed to operate in it. What follows is what each signal actually proves, and how long it takes to find out.
A Trust Badge Is A Picture File, And The Site Picks Which One To Show
A padlock graphic, a shield outline, the words "secure checkout" in a gray box: each of those is an image the site chose and placed. Showing one requires passing no check.
The badges that mean something behave differently. Click it and it opens a page on the issuer's own domain that names this specific site, with a date on it. A badge that opens nothing, or opens another page on the same site, is decoration.
That instinct is already familiar here. Goodordering's walk through four second-hand e-bike listings in August 2026 ranked a £1,200 Raleigh Motus above a £350 alternative partly because the cheaper listing used photographs that did not match the viewing address. Every check that carried weight there had an outside record behind it, and nothing the seller simply asserted did.
Chrome Retired The Padlock In 2023 Because It Proved The Wrong Thing
The browser padlock had the same flaw, and Google eventually acted on it. The Register reported the plan in May 2023, and the lock icon gave way to a tune icon that opens site settings. The change shipped with Chrome 117 that September.
People had been reading the padlock as a verdict on the business. It was never that. It reported that the connection between browser and server was encrypted, which means a message cannot be read in transit and says nothing about who is waiting at the other end.
Encryption had also stopped separating anybody. Google's HTTPS reporting describes Chrome navigations on Windows climbing from 95% to 98%. A fraudulent shop registered last week obtains a certificate on the same terms as a shop that has traded since 2011.
Fake Reviews Became Illegal In Great Britain In April 2025
Star ratings acquired a law of their own in 2025. Under the Digital Markets, Competition and Consumers Act 2024, a group of review practices became banned practices in April 2025, meaning they count as unfair and illegal automatically rather than something a regulator has to argue case by case.
The list reaches past invented reviews. Paid reviews that are not clearly marked as incentivized sit on it, and so does the handling: burying negative reviews, or presenting a star rating that gives an inaccurate picture of what customers said.
Enforcement followed the law quickly. Pinsent Masons reported 14 live consumer law cases at the Competition and Markets Authority under its direct enforcement powers as the first year of those powers closed.
Five of those cases were opened into companies over online reviews or star ratings: Autotrader, Feefo, Dignity, Just Eat and Pasta Evangelists. The regulator has made no findings in any of them.
Volume explains why the law arrived at all. Trustpilot's 2025 Trust Report put the fake reviews it removed during 2024 at 4.5 million, or 7.4% of everything submitted to the platform that year. A rating aggregates opinions and gets cleaned up after publication. It is never a record of permission.
A Company Number Proves Existence, Not Permission
The first thing a buyer can genuinely look up is the company. Companies House search costs nothing, and a registration number returns the legal name, the registered address, the officers and the filing history. Two minutes there will show whether a business claiming twelve years of trading was incorporated this year.
What the register will not tell you is whether that company may sell what it is selling. Registration records existence. Permission lives in a separate register kept by whoever supervises the activity, and most sectors have no such register. Nobody licenses a company to sell a bag.
Where a permission register does exist, it changes what a buyer can find out alone. The Financial Conduct Authority publishes the firms it has authorized and the activities each one may carry on. Gambling runs on the same principle and pushes it further than most.
Comparing Online Casinos Starts With The Register, Not The Offer
In Great Britain the operating license conditions include one covering display of licensed status. A licensed gambling site therefore has to carry the operator's legal name, its Commission account number and a link to its current entry on the public register. Anyone can search that register, and the site is obliged to point at it.
The Netherlands built its check into play rather than display. The Kansspelautoriteit publishes the operators it has licensed, and a licensed operator has to check every player against Cruks, the national exclusion register, before a session begins.
Because the permission is public, comparison work in this category can begin with the register rather than the offer. Bonus.com's guidance for comparing online casinos runs through the criteria that separate licensed operators across the US markets it covers. Licensing is the one criterion a reader can settle without taking the operator's own word for it.
That ordering transfers to anything else you buy. Payout speed and terms are claims a company makes about itself, written by the company. The license is the single line on the page that a third party holds a copy of, and once that line fails, nothing underneath it is worth reading.
A register is a snapshot rather than a certificate. Licenses get granted, surrendered and revoked, so a site that checked out in the spring may not check out by the autumn. Bonus.com posts on Facebook when rules across those US markets change, and a check run once is worth running again.
Card Recourse Is The Backstop When Nothing Checks Out
Plenty of purchases will survive none of this, because the category keeps no register and the seller is new. The last checkable thing is the payment method, and it happens to be the part of the transaction the buyer picks.
Section 75 of the Consumer Credit Act 1974 makes a credit card provider jointly liable with the seller where the cash price is more than £100 and no more than £30,000. The claim runs against the card company, which counts for most when the seller has stopped replying or stopped trading.
Chargeback covers the rest, debit cards included, and it carries no force of law. Which? describes chargeback as part of the card schemes' own rules, which participating banks subscribe to, with a limit of roughly 120 days from the transaction date or from the date delivery was expected.
The mechanism does work. Which? recorded a shopper conned out of £150 by a fake shop advertised through a TikTok advert, who was then told a refund would follow only after paying up to £30 toward shipping. A chargeback claim through Nationwide returned the money inside a week.
None of that substitutes for the check. Recourse is slower, it is not guaranteed, and it only starts once the money has gone. It belongs at the bottom of the list.
Run The Checks In The Order That Costs The Least Time
Order matters because patience runs out before curiosity does. Badges first, since clicking one takes a second and settles whether the site is willing to be verified at all. Then the register, where the category has one. Then the reviews, read for the shape of the complaints rather than the average. Then the card.
|
Signal |
What It Proves |
Who Holds The Record |
Time To Check |
|
Browser Padlock Icon |
The connection is encrypted, nothing about the seller |
The certificate authority |
Seconds |
|
Trust Seal Graphic |
Nothing, unless it opens a record on the issuer's own site |
Usually the site displaying it |
Seconds |
|
Star Rating Average |
Aggregated opinion, policed after publication |
The review platform |
2 to 5 minutes |
|
Company Registration Number |
The company exists, and who runs it |
Companies House |
About 1 minute |
|
Gambling License Number |
The operator may run the games it offers |
The Gambling Commission register |
About 1 minute |
|
Card Payment Method |
Recourse once a purchase has already failed |
The card issuer and the scheme |
Chosen at checkout |
Two of those rows moved in the past three years. The padlock stopped meaning what shoppers thought it meant, and star ratings picked up a law that had not existed before. The registers did not move, which is exactly why they sit in the middle of the list rather than at either end.
More cases will land on the same powers. The Competition and Markets Authority set the autumn as the point for an update on its early termination fees case against Adobe, where customers who cancel more than 14 days into an annual plan billed monthly pay 50% of the remaining year. That is the same enforcement route, pointed at contract terms instead of reviews.
None of this makes a seller honest. It swaps a question with no answer, "does this feel right", for one that has an answer: what could I open, and what did it say. Five minutes usually settles that, and the sites that fail tend to fail in the first thirty seconds.
Anchor image by Image by Nadia Whitfield
