How we check a shop
You should be able to verify how we reach a verdict. This page sets out what we check on a shop, where the information comes from, what a warning sign means and where our data falls short. The result is an automated assessment, not legal advice and not a purchase guarantee.
Collect the details
We open the shop, read the legal notice, legal texts and checkout, and query public registers and lists.
Assess each point on its own
Each check module returns a status and a sentence saying what it found.
Verdict with reasons
The individual results add up to an overall verdict. Next to it are the reasons and the gaps.
The eight groups of the check
There are eight places where a fake shop can give itself away. For each one you see what we check, how we know and what it can’t tell you. Behind them are 40 check modules. Not every module runs on every site: if it isn’t a shop, the checkout checks are skipped, for example.
All eight groups are drawn the same size. How much a single group counts towards the verdict is not something we publish.
Legal notice and provider
- What we check
- Does the shop have a legal notice, and does it contain the mandatory details? We also check whether terms, withdrawal notice and privacy policy can be reached, whether contact details and return address fit together, and whether the legal texts match the provider’s country.
- What it means for you
- A missing or incomplete legal notice is a clear warning sign. A complete one is a legal requirement for every shop and no reason yet to trust it.
- What it can’t tell you
- We cannot tell from the text alone whether the stated address belongs to the operator.
- Source
- The shop’s own pages. The yardstick for mandatory details is Section 5 of the German Digital Services Act (DDG).
Commercial register and VAT ID
- What we check
- We look up the company from the legal notice in the commercial register and compare name, registered office and register number with the entry. We also check whether the VAT identification number is valid.
- What it means for you
- Fake shops copy the company data of existing businesses. A valid number alone therefore proves nothing. If the company does not match the entry, the result says so, together with the entry we found.
- What it can’t tell you
- Sole traders without a registration duty and many foreign companies are not in any of these registers. This point then reads “Unclear”.
- Source
- The German states’ joint register portal (handelsregister.de), OpenRegister, and the EU’s VIES system for VAT IDs. A language model judges which register search hit belongs to the shop.
Domain, server and encryption
- What we check
- We read when the domain was registered and whether its name imitates a known brand. On top of that come the targets of redirects, where the server is and who runs it, the connection’s certificate and the domain’s mail records.
- What it means for you
- A shop with a large range on a domain only a few weeks old stands out. A certificate is standard today and free. It shows that the connection is encrypted. It doesn’t show who is behind it.
- What it can’t tell you
- Many registries do not disclose the creation date or the holder. Behind a content network such as Cloudflare we do not see the actual server.
- Source
- Registry WHOIS and RDAP, the certificate the server itself presents, network operator data (ipinfo, Team Cymru) and DNS.
Payment methods and money flow
- What we check
- We record which payment methods the shop offers and which are left at the end of the order. Is one with buyer protection among them? Does the recipient account match the provider?
- What it means for you
- If only prepayment by bank transfer is left, that is one of the clearest single warning signs. A transfer can hardly be recalled.
- What it can’t tell you
- We do not place orders. What a shop only asks for by email after the order, we do not see.
- Source
- The shop’s pages and approved reports from affected people. We never publish account or personal data.
Warning lists and security services
- What we check
- We match the domain against public fake-shop warning lists and against directories of phishing and malware.
- What it means for you
- An entry on a fake-shop warning list carries a lot of weight. An entry as a “problematic shop” is not the same as a confirmed fraud warning. We keep the two apart.
- What it can’t tell you
- A shop only gets onto a list once someone has reported it. A new shop is on none. That is why we check everything else regardless.
- Source
- Among others Watchlist Internet (Austria), the Hamburg consumer centre’s fake-shop list, Google Safe Browsing, URLhaus, OpenPhish and PhishTank. Each match is named in the result together with its source.
Reviews and reputation
- What we check
- We look for review profiles on independent platforms, reports about the shop on the web and the social media profiles it links to.
- What it means for you
- When many people consistently report that the goods never arrived, that is a strong warning sign. Few reviews are normal for small shops and not a warning sign on their own.
- What it can’t tell you
- Reviews can be bought. If there are none at all, we know nothing about other people’s experiences.
- Source
- Trustpilot, the public Trusted Shops interface and a web search for experience reports. A language model summarises the search hits. If a negative verdict results, a second, sceptical pass tests it: it looks for a nameable official warning and for positive evidence, and confirms only if such a source exists.
Trust seals
- What we check
- If the shop shows a seal, we check whether it links to its issuer and whether the certificate was issued for this shop.
- What it means for you
- A seal in the footer is, to begin with, an image. If it leads to no matching certificate, we treat that as an attempt to deceive.
- What it can’t tell you
- No seal is not a warning sign; most honest shops have none. And a genuine seal does not replace looking at everything else.
- Source
- The verification pages and directories of the seal issuers, plus their lists of known seal misuse.
Content and connections
- What we check
- We look at how much original content the site has and whether the texts look machine-assembled. Do prices look unrealistically low, or are there permanent extreme discounts? A language model judges this from the text of the site; we do not compare prices with other retailers. Does the site resemble a fake shop we already know, or show a known scam pattern?
- What it means for you
- If a shop resembles a fake shop we already know, that is often the earliest hint, long before it is on any list. We do not publish what we compare, as it could otherwise be deliberately bypassed.
- What it can’t tell you
- Language models can be wrong. What they find therefore never counts on its own and always appears in the result with a reason.
- Source
- The site itself, analysed with a language model, and our own stock of shops we have already checked.
How a check appears in the result
Each check gets one of four states, always as a word and a symbol, never as colour alone.
Positive
We found something in the shop’s favour, such as a matching register entry.
Suspicious
Something does not quite fit but is no proof on its own. Several suspicious points together weigh more.
Critical
A clear warning sign, such as an entry on a fake-shop warning list or a seal without a certificate.
Unclear
We could not check the point because the source did not respond or the information is missing.
Missing data is not an all-clear
If a query fails, the point is marked “Unclear”. It does not worsen the result, but it does not improve it either. We count a gap neither against the shop nor in its favour.
If too many points are unclear, we say so explicitly: the result then reads along the lines of “too little data for a clear verdict”. Thin data does not mean the shop is fine. It means we do not know.
The verdicts
The result comes with a trust score from 0 to 100. Higher means more trust. If the verdict comes from a warning list or a directory, we show no number, because we have not checked the site point by point. We do not publish how much a single point counts, so that nobody builds a shop to sit just inside the thresholds.
- DangerSeveral serious warning signs
For example no legal notice, prepayment only and a brand-new domain at once. We advise against buying.
- SuspiciousBe careful here
Some things count in the shop’s favour, others are missing or unclear. Read the reasons before you order.
- No major warningNo serious warning signs found
Not a recommendation and not a guarantee. The verdict holds for the day of the check. Pay with buyer protection where you can.
- Not verifiableToo little data for a verdict
We could check too little to reach a verdict. That is not a warning sign and not an all-clear.
One check, taken apart step by step
This is how one line in a result comes about, using the commercial register check of an invented shop. The domain markenoutlet-beispiel.invalid and the company do not exist; the .invalid ending is reserved for examples.
CriticalCommercial register: The company in the legal notice does not match the entry under this register number.
What we found
The legal notice says: Markenoutlet Handels GmbH, local court Musterstadt, HRB 000000. We read these details from the shop’s own pages.
Where the comparison comes from
We query the German states’ joint register portal (handelsregister.de) and OpenRegister. Under HRB 000000 at the local court Musterstadt, a company with a different name, based in a different city, is registered.
What it means
The company details probably do not belong to this shop. A real register number looks legitimate, which is why it gets copied. The result shows the entry we found, so you can look it up yourself.
Where the statement ends
Companies rename or move, and registers sometimes lag behind. Sole traders without a registration duty and many foreign companies are not in any of these registers. In that case the point reads “Unclear”, not “Critical”.
The whole example result
The same result lists further checks next to the commercial register. The reasons are worded the way they appear in a real result: what we found, and what follows from it.
None of these points would be proof on its own. Together they paint the picture of a shop we would advise against buying from.
- Commercial register · CriticalThe legal notice names a GmbH with an HRB number. A different company in a different town is registered under that number.
- Payment methods · CriticalThe home page shows five payment logos. At checkout only prepayment by bank transfer remains.
- Domain age · SuspiciousThe domain was registered three weeks ago; the shop offers more than 2,000 branded items.
- Warning lists · UnclearNo entry found. For such a young domain that is to be expected and not an all-clear.
Warning list and manual review
The warning list is built from check results. It is a risk signal, not an editorial finding that a shop is committing fraud.
Automated check
Shops with the verdict “Danger” appear on the warning list, with the check date.
Matching against lists
If a shop is on an external fake-shop warning list, it counts as confirmed; the source is named.
Manual review
We look at suspected cases without a list entry. We only set a manual classification with a link to evidence.
Objection
Operators can object. The objection is flagged and handled manually.
How often we check
Every result carries the date it was checked. The intervals are those set in our code; they are maximums, not promises.
| Re-check for unclear or mixed results | A stored result is reused for at most 7 days; after that we check again on the next request. |
|---|---|
| Re-check for clear results | Reused for at most 90 days, up to one year for manual classifications with evidence. |
| External fake-shop lists and directories | Matched daily. |
| List for the browser extension | Rebuilt on the server every 15 minutes, loaded by the extension every 4 hours. |
| Shops with a live seal | Each shop fully re-checked every 24 hours. If it fails, the seal lapses. |
Where we use AI
A language model is involved at these points, and this is how we label it.
Reasons from the page text
A language model reads the visible text of the page and names conspicuous patterns with a reason.
Summary of the web search
A language model summarises the experience reports the web search finds about a shop. A second, sceptical pass tests a negative verdict.
Commercial register match
We query handelsregister.de and OpenRegister first. Only if both return nothing usable does a language model evaluate search hits and judge which one belongs to the shop.
Reading the legal notice
A language model reads the provider details from the legal notice, where needed also from a screenshot of the page.
Recognising seal images
A language model recognises whether an image on the page shows a known trust seal.
Translation into English
Texts a language model produced are translated into English by a language model. The translation carries the label too.
Pre-check of reviews
A language model checks new user reviews in advance for spam, insults, bought praise, competitor bashing and phishing. Clear spam and insults are rejected automatically, unremarkable reviews are approved. A person reviews all other irregularities and unclear cases.
Email and SMS check
The language model picks out conspicuous passages of the message. The explanations for them are fixed texts of ours.
Overall summary
A language model summarises the check result in two to three sentences. This text appears only in the response of our interface for customers, not on the website.
Industry category
A language model assigns the shop to an industry, such as fashion or electronics. If it finds no clear industry, the field stays empty.
Short description of a shop
A language model writes a short, factual description of the offer and a tagline for the shop page on our site. The label shows whether a text comes from it.
Which texts carry the label
We mark texts a language model has written with “AI text” and the EU symbol for AI content. This covers the reasons from the page analysis, the summary of the web search and short descriptions of a shop written by a language model, in each case also in the English translation. We do not review these texts one by one, so we say so. The duty to do this is set out in Article 50 of Regulation (EU) 2024/1689. Fixed texts of ours, such as the sentences on individual findings, do not carry the label.
The trust score
We calculate the score by fixed rules, a language model does not assign it. Its assessments are inputs to those rules. Some of them can cap the score, for example a negative finding from the web search.
Language models make mistakes
A language model can be wrong even when the text sounds convincing. An AI text is a pointer, not proof. If a statement about your shop is wrong, you can request a correction.
Corrections for operators
Automated assessments can be wrong, for example if a register does not respond or a shop has moved. As an operator you can object via the form: with domain, company name, email address and a short explanation, ideally with the commercial register number.
An objection does not change the trust score automatically. It is flagged and reviewed by a person. If the review shows we were wrong, we correct the result.
Request a correctionCheck a shop yourself
Paste the address and read what counts against the shop and what counts for it. Free, no sign-up.
Check a shopWhat we explicitly do not do
- No buying your way outNo shop can buy a better result. Even the live seal only reads the check result and lapses if the shop fails.
- No purchase guaranteeWe are not liable for orders and do not promise that a well-rated shop will deliver.
- No personal dataWe name companies, but not names of people and no account numbers.
- No test ordersWe do not order or pay anything. What happens only after an order, we know only from reports.
- No advertisingThe check is free and ad-free for consumers. Operations are funded by offers for merchants and the evidence dossier. If you like, you can support the project voluntarily.
- No legal adviceA result is an assessment based on public information, not a judgement about a crime.