How to check if a website is legitimate in South Africa
Here is how to verify a website is legitimate: no single check proves it, so look at the address, the contact details and the owner behind the site together.
On this page5 sections
Here is how to verify a website is legitimate: no single check proves it, so look at the address, the contact details and the owner behind the site together. Then confirm the business through a source you already trust before you pay or enter any details. A fake site can look like the real one, so how it looks is not enough to go on.
In short: No single check proves a website is genuine. Check the address and contact details, confirm the business through a source you already trust, and treat the padlock as one clue only.
How do I know if a website is legit?
Does the padlock mean a website is safe?
What is a cloned website?
How a business can prove its website is the real one
Where an Authentikor check fits
How do I know if a website is legit?
Check several things together, because no single test proves a website is legitimate.
A BusinessTech article of 27 August 2023 quotes a co-founder of Digimune, a distributor of Norton antivirus software, who advises checking the About Us or Information pages and verifying the contact details, since poorly written content can be a giveaway. The same article says scammers rely on readers not noticing subtle differences in the URL or site design, so check the address carefully.
For financial services, the Financial Sector Conduct Authority (FSCA), as reported by Moonstone on 21 August 2023, advises checking that a provider is authorised, by phoning 0800 110 443 or using its online search, and obtaining proof that a bank account is registered in the entity's name before transferring money. That advice applies to financial providers only.
Here are steps you can take today:
Read the address in your browser slowly, and compare it letter by letter with the address you expect.
Read the site's about page and the page that lists its contact details, and look for writing that sounds wrong or details that do not add up.
Phone the business on a number you already trust, not on a number printed on the site you are checking.
Before you send money, ask for proof that the bank account is in the business's name.
If a check finds nothing, take that as a reason to ask more questions, not as proof that the site is fake.
If the code on an email or document fails its check, Authentikor advises not acting on the email or document and phoning the sender on a number you already trust.
Does the padlock mean a website is safe?
No, and the BusinessTech article of 27 August 2023 explains why: it says the padlock theoretically means a site is safe but can be manipulated, so relying on it alone is insufficient to judge authenticity.
Use it as one clue among several, and keep checking the address and the owner.
What is a cloned website?
A cloned website is a copy of a real business's website, made by someone else to pass as the original.
A cloned site can use the real logo and wording, so look at who owns the address rather than at the design. Treat a lookalike address as a warning even when the page looks right.
The FSCA says, as reported by Moonstone on 21 August 2023, that MyWealthinvestment.com cloned the website of an authorised provider, Regenesys Investment Fund (Pty) Ltd trading as MyWealth Investments, and falsely presented itself as authorised. Moonstone reports that MyWealth Investments denied any association with MyWealthinvestment.com. The same report describes several other cases of impersonation of authorised providers.
The Anti-Phishing Working Group (APWG) defines phishing as using deceptive emails, bogus websites and deceptive domain names to lead people to counterfeit websites that steal data. Its report for the fourth quarter of 2025, published on 18 February 2026, counted 853,244 phishing attacks worldwide in that quarter.
The South African Banking Risk Information Centre (SABRIC), in its 2025 annual banking crime statistics release, reports that digital banking crime losses rose to R2.4 billion in 2025 from about R1.9 billion in 2024. That figure covers digital banking crime in general, not cloned websites specifically.
How a business can prove its website is the real one
On its website verification page, Authentikor describes three steps: a business first goes through company verification, then proves control of its domain with a DNS TXT record or a hosted file, and then displays a website seal that links to the live verification record.
Authentikor says a person approves each verified company, and an account whose business is not yet verified is marked as such in every check.
Authentikor also notes that a copied badge image can be out of date, so visitors should open the linked company record, check the domain and read its current status.
Its wording is that the seal connects a website to a verified company and evidence of domain control, and that it is not a security audit or a promise that every page, link or transaction is safe.
Where an Authentikor check fits
The Check a website page on Authentikor lets a visitor type a website address to see the named owner, proof of control and current verification status. It does not promise that every page or payment on the website is safe.
If the check shows no named owner or verification status for a website, that is neither proof that the site is fake nor proof that it is genuine, so fall back on the earlier steps.
Authentikor says it does not judge how a message or site looks. A real one leads to a record in the Authentikor Vault. For a cloned website, website verification shows the verified company behind the real one, where that company has enrolled. The check does not detect a clone, so an empty result does not show that a site is fake or genuine.
Authentikor's FAQ says that when nothing is found, it means only that no seal or code was found to show for what was checked, and never that the item is fake.
Use this check after the basic steps above, not instead of them.
Questions and answers
How do I know if a website is legit?
Check several things together, because no single test proves a website is legitimate. Read the address letter by letter, read the about and contact pages for details that do not add up, phone the business on a number you already trust, and ask for proof that a bank account is in the business's name before you send money.
Does the padlock mean a website is safe?
No. A BusinessTech article of 27 August 2023 says the padlock theoretically means a site is safe but can be manipulated, so relying on it alone is insufficient to judge authenticity.
What is a cloned website?
A cloned website is a copy of a real business's website, made by someone else to pass as the original. Scammers rely on readers not noticing subtle differences in the address or the site design, so check the address carefully.
How can a business prove its website is the real one?
On its website verification page, Authentikor describes three steps: the business goes through company verification, proves control of its domain with a DNS TXT record or a hosted file, and then displays a website seal that links to the live verification record.