Short answer: To check in about 3 minutes whether an online store really exists, run 7 checks: (1) the seller’s details in the terms and conditions, (2) the NIP tax number in CEIDG or KRS and on the VAT White List, (3) the age of the domain, (4) the site’s history in the Wayback Machine, (5) reviews and clones outside the store itself, (6) the address and contact details, (7) the payment method and price. No single check proves anything on its own — what counts is the total number of red flags. Two or more is a reason not to pay.
Fake online stores today often look professional: they have nice photos, a sale countdown, and terms and conditions copied from a real company. That’s why a site’s “good looks” are no proof at all. The proof is what can’t easily be faked: an entry in a state register, the age of the domain, the site’s history, and the payment method. You can check all of these for free.
7 checks step by step
Find the seller’s details in the terms and conditions and the footer
A Polish online seller is required to provide its details: its full name, address, NIP tax number, and contact details, including an email address. Open the terms and conditions or the “Contact” tab and write down the company name and NIP.
Red flag: no terms and conditions, no NIP, only the store’s name with no company name, or terms and conditions that clearly concern a different brand.
Check the NIP in CEIDG or KRS and on the VAT White List
You’ll find sole proprietorships in CEIDG, and companies in the KRS search engine. Then enter the NIP in the Register of VAT taxpayers (the White List). Compare whether the company’s name and address match what the store says.
Red flag: the NIP doesn’t exist, belongs to a completely different company, or the company has been struck off or suspended.
Check the age of the domain
Enter the store’s address in a WHOIS-type tool, e.g., who.is, and check the registration date. For .pl domains, the DNS Polskaservice is helpful. The rule: a store that claims “10 years on the market” but has a domain from three weeks ago is lying.
Red flag: a domain registered within the last few months while the company claims a long track record.
See the site’s history in the Wayback Machine
Paste the address into the Wayback Machine. A real store with a history of several years usually has saved copies from different years. We write about this tool in detail in the article How to use the Wayback Machine.
Red flag: no archived copies at all, or earlier versions of the site that sold something completely different.
Look for reviews and clones outside the store itself
Search Google for the store’s name together with the words “reviews,” “scam,” or “warning.” Don’t trust reviews displayed on the store’s website — they’re easy to write yourself. Also do a reverse image search of a product photo, e.g., in TinEye: if the same photos and descriptions appear in dozens of identical stores, they are probably clones.
Red flag: no presence whatsoever outside its own website, or a series of identical stores at different addresses.
Verify the address and contact details
Enter the address from the terms and conditions in Google Maps and look at Street View. A real store usually has a warehouse, an office, or at least a building that exists. Call or send an email with a simple question. We described how maps work in detail in the article Google Maps tricks.
Red flag: the address is a field, an empty lot, or a residential building with no connection to the company; contact only through a form or a messaging app, with no phone number or email in the store’s domain.
Evaluate the payment method and price
If the store only lets you pay by bank transfer to a private account or doesn’t offer card payments, treat it as a warning. Paying by card usually gives you a better chance of getting your money back (the chargeback procedure at your bank). A price much lower than the market price, a “last 3 items” counter, and a “clearance sale” are the classic set of bait.
Red flag: a forced transfer to an ordinary bank account, no well-known payment gateways, and a price 50–70% lower than everywhere else.
Cheat sheet: 7 checks in one table
| Check | Where to check | Time | Red flag |
|---|---|---|---|
| 1. Seller’s details | Terms and conditions, footer, Contact tab | 30 s | No NIP, no company name, someone else’s terms and conditions |
| 2. Registers | CEIDG, KRS, VAT White List | 60 s | The NIP doesn’t exist or the details don’t match |
| 3. Domain age | WHOIS (e.g., who.is), DNS Polska | 20 s | A domain from the last few months for a “long-established company” |
| 4. Site history | Wayback Machine | 20 s | No copies or a completely different earlier profile |
| 5. Reviews and clones | Google, reverse image search | 30 s | No traces outside the store or identical stores |
| 6. Address and contact | Google Maps, Street View, phone, email | 20 s | A fictitious address, contact only through a form |
| 7. Payment and price | The store’s shopping cart | 20 s | Only a transfer to an ordinary account, a price that’s too good |
How to score it: the total of red flags
One red flag doesn’t settle that it’s a scam. A new store may have a young domain, and a small company may have no reviews online. What matters is the pattern: the more flags, the lower the likelihood that there’s an honest seller on the other side. Use a simple scale.
0–1 flags
The store looks credible. You can buy, preferably by card or with a method that offers buyer protection.
2–3 flags
Be careful. Order something cheap as a test or look for the same product in a trusted store.
4 or more
Don’t pay. Probably a fake store. You can report it to CERT Polska.
What to do if you’ve already paid
If you suspect you’ve fallen victim to a fake store, act quickly. The first hours matter most.
- Contact your bank and ask about blocking your card and about the procedure for disputing the transaction (chargeback) if you paid by card. The rules and deadlines depend on the bank.
- Take screenshots of the website, the order confirmation, and the correspondence.
- Report the website to CERT Polska through the form at incydent.cert.pl.
- Notify the policeif you’ve lost money. A report is the basis for further steps.
- Use consumer assistance — you’ll find information about consumer rights on the website of UOKiK.
- Change your passwordsif you entered login details in the store or used the same password elsewhere.
Frequently asked questions
Find the company name and NIP in the terms and conditions, then check them in CEIDG or KRS and on the VAT White List. Then look at the domain’s age in WHOIS and the site’s history in the Wayback Machine. The whole thing takes about three minutes.
No. A young domain is only one red flag, because a new, honest store also has a young domain. The domain’s age matters only when it doesn’t match the seller’s claims or occurs together with other flags.
You can check sole proprietorships in CEIDG, companies in the KRS search engine, and VAT taxpayer status in the Register of VAT taxpayers (the White List) on podatki.gov.pl. All of these registers are free.
Not on their own. Reviews on a store’s website can be written by anyone who runs it. Reviews outside the store are more credible, e.g., in Google results, on forums, and on independent websites — but it’s worth reading those critically too.
By payment card, because in the event of fraud you can dispute the transaction with your bank (chargeback). Avoid transfers to a private account, because getting such money back is much harder. The rules depend on the bank, so it’s worth checking them with your card issuer.
You can report a fake website to CERT Polska through the form at incydent.cert.pl. If you’ve lost money, also report the matter to the police and your bank.
Want to search and verify even more wisely?
Buy the “How to Search?” guide
Concrete methods for searching and verifying information, step by step, with dozens of examples.
See the guide → ☕Support us on Suppi
We create these materials in our free time. Every bit of support helps us write more and more often.
Support → ▶️Watch us on YouTube
The same topics in a shorter video format — with concrete on-screen examples.
Subscribe →More from our blog
Sources: public registers — CEIDG (aplikacja.ceidg.gov.pl), the National Court Register (wyszukiwarka-krs.ms.gov.pl), the Register of VAT taxpayers (podatki.gov.pl); CERT Polska (incydent.cert.pl); UOKiK (uokik.gov.pl); DNS Polska (dns.pl); Internet Archive (web.archive.org); WHOIS (who.is). The register interfaces described may change — check the current look of the websites.