“I thought HTTPS meant the website couldn’t be fake.”
It’s an easy assumption to make.
For years, people were taught to look for the little padlock before trusting a website.
But HTTPS only tells you something important about the connection between your browser and the website.
It does not tell you that the website itself is legitimate.
Scam websites can use HTTPS too
A cybercriminal can create a convincing fake website, obtain a valid security certificate and display the familiar padlock — all while trying to steal:
- passwords;
- banking details;
- personal information;
- business credentials; or
- payment information.
The connection may be encrypted, but you can still be communicating securely with a scammer.
Cyber Tip: Check the domain, not just the padlock
Before entering sensitive information:
- read the website address carefully;
- look for misspellings or slightly altered domain names;
- be cautious of links received unexpectedly by email, SMS or WhatsApp;
- avoid trusting a site simply because it shows a padlock; and
- where possible, navigate to important websites yourself instead of following links.
The padlock has a limited job
The padlock means that data travelling between your browser and the website is encrypted.
It does not guarantee that the organisation on the other side is genuine.
That distinction is important.
A fake banking page can have HTTPS.
A phishing portal can have HTTPS.
A fraudulent online store can have HTTPS.
Encryption protects the connection.
It does not verify trust.
Pause. Check the domain. Then proceed.
Cybersecurity often comes down to small habits that interrupt an attack before it succeeds.
Taking a few seconds to inspect the website address can prevent stolen credentials, payment fraud and account compromise.
Stronger habits. Stronger security.
Take the next step
How secure is your business?
Get your free 2-minute Cyber Safety Score or chat to Stratus Cloud if you already know what you need.
