Before you pay, check the legal notice, the address and age of the domain, the payment methods, the price, reviews and trust seals. The German Federal Office for Information Security (BSI), the consumer advice centres (Verbraucherzentrale) and the German police crime prevention service (ProPK) name largely the same features for this. Since 9 October 2025 a further check applies to bank transfers: the bank compares the name of the recipient with the IBAN.
Which features the BSI, consumer advisers and police name
The three bodies name mostly the same features. We placed their pages side by side on 3 October 2026. The BSI lists seven features, and so does the Verbraucherzentrale (as of 11 June 2025). The police crime prevention service names three signs and adds protective advice.
- In all three sources. Payment methods, legal notice, price and trust seals. The police mention the seal in their protective advice (quotations from German sources in this article are our translation): “Be sceptical if a shop displays trust seals but does not link to the issuers.”
- BSI and Verbraucherzentrale. The web address. Both give the example of a familiar address with a second ending appended.
- BSI only. The label on the order button and the contact routes. According to the BSI, vague words such as “Log in”, “Complete” or “Order” on the button are not permitted. A post office box or a contact form as the only way to get in touch counts as a pointer there.
- Verbraucherzentrale only. The terms and conditions. If they are missing or read as if they came from a translation program, the Verbraucherzentrale advises against ordering.
- Reviews. The Verbraucherzentrale lists them as a separate feature. The BSI and the police name them as a step to take: look for reports in review portals or via a search engine.
Legal notice: who is behind the shop
A shop based in Germany must state who operates it. Section 5 of the German Digital Services Act (DDG) requires name and address, for legal entities the legal form and the authorised representative, an email address, the register with register number and a VAT identification number if one exists. The details must be easy to recognise and directly accessible. The specifics are in the glossary under legal notice requirement.
Even a complete legal notice can be copied. The BSI names as a pointer that the address is correct but the supposed company cannot be found there after an internet search. The Austrian consumer platform Watchlist Internet writes that criminals in many cases use the legal notice details of real companies.So search for the company name separately from the shop and compare address and register number. How borrowed register numbers stand out is described in the article on other companies’ register numbers in the legal notice.
Address, padlock and age of the domain
The padlock shows that the connection is encrypted. The BSI writes: “Fake shops, too, use a secure connection more and more often.” If encryption is missing, do not enter payment details. Encryption says nothing about the operator. The technical background is in the glossary under SSL and TLS.
The address itself tells you more. The Verbraucherzentrale names two oddities: a familiar address with a second ending appended, and an address that does not fit the range, such as shoes under a name that sounds like plants. Then there is age.Watchlist Internet treats a recently registered domain as a pointer, because detected shops are taken down and the operators register new addresses.On 3 October 2026 we queried the registration date of 87 domains of confirmed fake shops, a partial selection ending in .com and other endings (without .shop, .de and .at). 66 of them were at most 180 days old. Method and limits are in the article Fake shops from a kit.You reach the registration date via a WHOIS query, more under domain age.
Payment methods: what is left at the end of the order
Look at the choice in the last step of the order. The BSI describes as typical of fake shops: “First there is a choice of methods, but when ordering only advance payment is possible.” The Verbraucherzentrale and the police describe the same sequence.
According to the Verbraucherzentrale (as of 3 August 2026), a transfer you ordered yourself can no longer be reversed once the bank has executed it, and many transfers are booked in real time. The bank can try to reclaim the amount. According to the Bundesbank, a reversal depends on the consent of the recipient, and with a fake shop that is not to be expected. Other payment methods leave a route open:
- Purchase on invoice. You pay after delivery. The BSI and the police name purchase on invoice first.
- SEPA direct debit. Under Section 675x BGB you can demand a refund without giving reasons if you do so within eight weeks of the debit. How this works is explained under returning a direct debit.
- Credit card. A payment can be cancelled in the chargeback procedure through the card-issuing bank. The Verbraucherzentrale points out that a processing fee may apply. More under credit card and chargeback.
- PayPal and other payment services. Buyer protection has its own conditions. PayPal requires the report within 180 days of the payment date. According to the Verbraucherzentrale, protection is excluded if you use the option “send money to friends and family”. More under PayPal buyer protection.
If only a transfer is left, read what your bank displays. Since 9 October 2025, according to the German financial supervisor BaFin, credit institutions must check before release whether name and IBAN match. If the bank reports a mismatch, do not release the transfer. A matching result only shows that name and IBAN fit together.More in the article on verification of payee and fake shops and in the article Advance payment in online shops.
Price, reviews and trust seals
- Price. The Verbraucherzentrale writes that not every very cheap shop is a fake shop and not every fake shop is extremely cheap. If strikingly low offers pile up, look more closely. The police call a price well below market value a warning sign, including on sale days.
- Reviews. Following the advice of the Verbraucherzentrale, do not rely solely on reviews inside the shop. If praise piles up there while reviews elsewhere differ sharply, that is an additional pointer. How to go about it is in the article Checking shop experiences and reviews.
- Trust seals. According to the BSI, the seal logos of fake shops are often not clickable or invented. Open the seal provider’s directory yourself and look the shop up there. The police internet crime guide (Ratgeber Internetkriminalität) advises not to follow the seal link in the shop for this, because seal providers’ pages have been faked as well. The checking route per provider is described in the article Fake trust seals, and an overview of the seals is under trust seals.
What our shop check looks at in these places
The shop check reads the same places automatically and states for each point what it found. In detail:
- Legal notice. It looks for the legal notice page and reads address, contact, register and VAT ID.
- Register and VAT ID. For German numbers it queries which company is registered under the number. It queries the VAT ID with the European Commission’s validation service.
- Age of the domain. It determines since when the domain has been registered and displays the age as far as it can be established.
- Payment methods. It reads which payment methods the shop names.
- Trust seals. It looks for displayed seals and checks their connection to the seal provider.
- Connection and warning lists. It reads the certificate of the page and matches the address against warning lists.
Before you pay: six steps
- Check the address.
Read the address character by character and enter it in the shop check. The warning list shows whether it has already stood out with us. The browser protection shows a notice when you open a listed page.
- Search for the company separately from the shop.
Look up the company name from the legal notice in a search engine and compare address and register number. If in doubt, call a number you looked up yourself.
- Look the seal up in the provider’s directory.
Open the seal provider’s site yourself, via a bookmark or a search engine, and look the shop up in its directory. Clicking the seal in the shop is at most an extra and proves nothing, because the shop set the link itself.
- Go as far as the payment choice.
Put an item in the basket and see which payment methods are left in the last step. If only a bank transfer remains, cancel the order or ask the retailer for another payment method.
- For a transfer, read what the bank displays.
Enter as recipient the name given in the legal notice. If the bank reports a mismatch, release nothing. You can match the IBAN against known fraud reports beforehand in the IBAN check.
- Already paid and unsure.
Contact your bank or the payment service and secure evidence. The steps are under Already transferred money and Securing evidence, and the online police station of your German federal state is under Reporting offices.
If doubts remain
If several oddities remain after these steps, buy from a retailer you know or pay on invoice. Further warning signs with examples are on the page Spotting a fake shop. Which scams are currently circulating is shown in the overview Current scams.
