A careful buyer, a payment provider and Google Merchant Center check a new shop in much the same way: they compare the company details with official registers, look at the age of the domain, search for copied photos and read the reviews. An honest WooCommerce shop can fail that test through plain neglect, such as an old address in the terms or a personal bank account in the transfer instructions. This guide walks through those checks from the shop owner's side, with what to fix before a customer finds it. The registers, laws and authorities named here (Companies House, HMRC's VAT check, Confirmation of Payee, the NCSC and Report Fraud in the United Kingdom; the CRO, the CCPC and An Garda Síochána in Ireland) apply to shops based in or selling to those two countries. The domain history, padlock, reverse image search, Merchant Center and WooCommerce checks work the same anywhere.
Irish shoppers have had a particular reason to become suspicious. The Competition and Consumer Protection Commission (CCPC) reports “a large increase in ads on social media for websites presenting themselves as Irish shops selling online, often at huge discounts”, many with “Irish-sounding names and stories but no physical presence in Ireland” (CCPC, fake online shops). A buyer who has read that advice checks every shop they do not know, including yours.
How customers check whether an online shop can be trusted
Checking a shop is open-source intelligence (OSINT): conclusions drawn only from public sources. Company registers, the VAT number check, the WHOIS database, web archives, image search and online reviews. None of it needs technical knowledge, which is why the same steps end up in consumer guides. The National Cyber Security Centre tells UK shoppers to research a store they have not used before, using “consumer websites, or reviews from people (or organisations) that you trust”, and warns that criminals copy the design of real shops and use lookalike domains, giving www.tescos-sales.com as an example of an address easily mistaken for www.tesco.com (NCSC).
Every inconsistency a buyer finds looks exactly like a fraud signal. The CCPC lists “privacy policies or terms and conditions that are generic, incomplete or reference other brands” and returns policies “copied word-for-word from other sites” among the red flags of a scam shop. To a buyer, two different addresses in the footer and the terms are a warning sign, even when one of them is just a forgotten update.
What company details an online shop has to display
In the United Kingdom, three sets of rules overlap. Regulation 6 of the Electronic Commerce (EC Directive) Regulations 2002 requires anyone providing an online service to make available, “in a form and manner which is easily, directly and permanently accessible”, its name, the geographic address where it is established, contact details “including his electronic mail address”, the register and registration number where it is in a public trade register, and its VAT number where it carries out VAT-able activity (legislation.gov.uk). Schedule 2 to the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 adds, for every distance contract, the identity of the trader and the geographical address and, where available, the telephone number and email address “to enable the consumer to contact the trader quickly and communicate efficiently” (legislation.gov.uk). For a limited company, regulations 24 and 25 of the Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015 require the registered name on its websites, together with the part of the UK where it is registered, its registered number and its registered office address (regulation 25).
Ireland has the same layers. Regulation 7 of the European Communities (Directive 2000/31/EC) Regulations 2003 lists the name, geographic address, email address, trade register entry and the VAT registration number among the information an online service provider must give (Irish Statute Book). Section 151(4) of the Companies Act 2014 requires a company with a website to display its name and legal form, its place of registration and registered number, and its registered office address “in a prominent and easily accessible place on that website” (Irish Statute Book).
A customer compares these details in four places: the footer, the terms, the privacy policy and the invoice. Then they type the company number into a register search. The free Companies House service shows the registered office address, date of incorporation, current and resigned officers, filed documents, previous company names and insolvency information (GOV.UK). In Ireland, the CCPC tells consumers to “check if the business is listed on official registers, like the Companies Registration Office (CRO)”, and to look for a name, physical address, phone number and email, using Google Maps and Street View to verify the location (CCPC).
One field on the Companies House record deserves attention. Each company page lists its “Nature of business (SIC)”, the standard industrial classification code chosen at incorporation: the record for Tesco PLC, for instance, reads 47110, retail sale in non-specialised stores with food, beverages or tobacco predominating (Companies House). A company registered as a design studio that sells cosmetics will raise questions with a careful customer and with a payment provider. If your trade has changed since incorporation, check that the SIC code on the register still describes the business you actually run.
What to fix in your own shop:
- one version of the company name, registered number, VAT number and address in the footer, terms, privacy policy, WooCommerce transactional emails and invoices,
- a registered office that matches the Companies House or CRO entry, and a change of address filed in the same week as the move,
- a working phone number and email address, because the CCPC tells buyers to “be suspicious if contact details are missing”.
How customers check a shop’s VAT number and bank account
HMRC’s Check a UK VAT number service shows whether a UK VAT registration number is valid and “the name and address of the business the number is registered to” (GOV.UK). It works the other way round from a company search: you cannot look a business up by name, only enter the number you were given. HMRC adds that most businesses print their VAT number on invoices, receipts or the website, which is exactly where a buyer will copy it from. If the name the service returns differs from the trading name in your footer, say on the contact page which company trades under that name.
The bank account gets checked too, and in both countries the buyer’s bank now does it automatically. In the UK, Confirmation of Payee compares the name a payer types with the name on the receiving account before a new transfer. According to Pay.UK, when the name is close the payer is shown the account holder’s actual name, and when it does not match “they will be told that the details do not match”; for a business, the payer should use “the registered business name or a trading name” registered to the account (Pay.UK). Ireland, as a euro-area country, falls under Article 5c of Regulation (EU) No 260/2012, inserted by the Instant Payments Regulation (EU) 2024/886: the payer’s bank must verify the payee “immediately after the payer provides relevant information about the payee and before the payer is offered the possibility of authorising that credit transfer”, and warn the payer when the account identifier and the name do not match. Payment service providers in euro-area Member States had to comply by 9 October 2025 (EUR-Lex).
For a business customer this check carries real money. A wholesale buyer’s accounts team that sees a no-match warning on a new supplier is likely to stop the payment and call before it pays. The NCSC goes further for consumers and advises: “Never pay by direct bank transfer” (NCSC). A shop that offers only bank transfer is therefore asking a careful customer to do the one thing the government’s cyber security agency tells them to avoid. Offer a card payment as well, and keep bank transfer for business customers who prefer it.
In WooCommerce, the account number for bank transfers goes into the settings of the direct bank transfer payment method (in code: bacs), and the shop shows it on the order confirmation page and in the order email (WooCommerce). Enter the account held in the company’s registered name there, and put the account name exactly as the bank holds it in the account name field. The owner’s personal account, or an account held under a trading name the bank does not know, is the first thing that fails the payee check.
How to check a shop’s domain age in WHOIS
Fake shops have short lives. The CCPC tells consumers to be suspicious if “the site looks newly created” and lists “recently set up websites and social media profiles with very few posts” and shops that “use multiple domain names or change their name frequently” among the warning signs. That is why buyers look at the domain registration date. For .uk domains, the Nominet WHOIS shows the registrar and the registration date; for the oldest names the answer is simply “before Aug-1996”, which is what a query for bbc.co.uk returns. For .ie domains, the registry WHOIS at weare.ie shows the creation date and the registrar: a query for rte.ie returns a creation date of 11 February 2000 and Blacknight Solutions as the registrar. For any domain, the second source is the Wayback Machine, which shows what the site looked like in previous years.
The CCPC adds a warning that matters for Irish shops in particular: “A ‘.ie’ website address does not guarantee that a business is registered or based in Ireland.” The same is true of .co.uk. A buyer who knows this goes from the domain to the register, which is why the company number on your website matters more than the extension.
A young domain does not mean fraud, but combined with a low price and missing company details it becomes a strong signal for the buyer. What you can do:
- after a rebrand, keep the old domain with a 301 redirect, so the history under the old address leads to the new shop,
- explain on your “about us” page since when you have been trading and under what earlier name, consistent with the incorporation date on the register,
- do not buy a domain previously used by another business without checking its history in the Wayback Machine, because old content or entries on blocklists come along with the address.
Does the padlock in the browser mean the shop is safe
No. The CCPC lists “no secure payment (no padlock icon)” as a red flag, which is correct as far as it goes: a shop without HTTPS should not take payment details. The reverse does not hold. A free Let’s Encrypt certificate is issued automatically: “the ACME client proves to the Certificate Authority (CA) that the web server controls a domain” (Let’s Encrypt). Nobody checks the company, the address, or whether the shop ships anything. A scam shop gets its padlock as easily as you do, so a careful customer is only convinced by the company details, the bank account and the domain history.
On 21 October 2026 Google announced that Chrome now asks for permission before it makes an insecure HTTP connection. Earlier in the year this applied only to users of Chrome’s Enhanced Protection mode of Safe Browsing, and it is now on by default for all users (Google, 21 October 2026). Once a visitor approves a site, Chrome does not ask again until they have gone at least two weeks without visiting it. In a shop that still serves pages over HTTP, the customer sees that prompt before any of the page loads.
How to check whether product photos are stolen
Reverse image search (Google Lens, TinEye, Bing) shows where else on the web a given photo appears. A buyer uploads a product photo and sees whether it comes from the manufacturer’s catalogue, someone else’s shop or a stock library. The CCPC now also warns about “deepfake or AI-generated product photos and videos”, images that “may look perfect but don’t match real customer photos or reviews”, and about stock or AI-generated video testimonials.
A shop that uses only manufacturer photos does nothing wrong, but it does not stand out either: the same files show up in dozens of other shops, fake ones included. A few of your own photos for each bestseller (the product on your desk, the package with its shipping label, a shot from the warehouse) give the buyer proof that the goods physically exist. The same original photos help in image search results, as the post on Google Lens and optimizing images in WooCommerce explains.
How to check whether reviews of a shop are genuine
In the United Kingdom, paragraph 13 of Schedule 20 to the Digital Markets, Competition and Consumers Act 2024 puts three review practices on the list of “commercial practices which are in all circumstances considered unfair”: submitting or commissioning “a fake consumer review” or one that conceals it was incentivised, publishing consumer reviews “in a misleading way”, and publishing them “without taking such reasonable and proportionate steps as are necessary” to prevent fake or misleading reviews and remove them (legislation.gov.uk). The paragraph has been in force since 6 April 2025. In Ireland, the Consumer Rights Act 2022 inserted two items into section 55(1) of the Consumer Protection Act 2007 from 29 November 2022: point (za) bans “stating that reviews of a product are submitted by consumers who have actually used or purchased the product without taking reasonable and proportionate steps to check that the reviews originate from such consumers”, and point (zb) bans submitting or commissioning false reviews (Law Reform Commission revised Act).
Buyers also look at the pattern. The CCPC advises looking for “lots of five-star ratings with no detail, reviewers who have only ever posted one review or feedback that sounds generic or overly positive”, and tells consumers: “Don’t trust only the reviews on the website”, pointing them to independent review sites, social media and forums. A shop with a few honest three-star reviews and replies from the owner looks more credible to that buyer than a page of identical praise.
WooCommerce lets you allow reviews only from customers who bought the product and mark them with a verified owner label (WooCommerce). If you do this, say so next to the reviews in one sentence: who can leave a review and whether you publish all of them. That is the kind of reasonable step both acts ask for, and it gives the buyer a reason to trust you. If you collect reviews on an external platform, describe its verification method in the same way.
How a fake shop impersonates a real one
A clone of a real shop copies the logo, photos and descriptions, and differs in the domain and the bank account for payments. The CCPC describes scam shops that “closely mimic the look and feel of well-known Irish or EU retailers, including logos, colours and layouts”, fake “as seen on” media logos for RTÉ or The Irish Times that link to no real coverage, and drop-shipping sites that pose as Irish retailers but “often deliver poor quality goods, if they deliver at all”. The NCSC adds the lookalike domain that is easy to misread.
An honest shop is directly affected by one variant that Poland’s national CERT describes as a legitimate payment in a fake shop: the scammer buys from a real shop under their own details, and the victim of the clone unknowingly pays for that order (CERT Polska shopping guide). From your WooCommerce dashboard it looks like an ordinary paid order. Both the CCPC and the NCSC point card payers to a chargeback; if the victim uses it, the dispute can land with the merchant who accepted the payment, while the goods are already with the scammer. Signals worth setting an alert for in order handling: a delivery address that does not match the payer’s details, a parcel locker instead of an address for expensive goods, several orders from different cards to the same address.
Google treats similar practices as an egregious violation of the Merchant Center policies and states that it may not issue a warning before acting on one. Its list of examples includes “Present a false identity, business name, or contact information” and “Displaying a false or virtual physical address as your headquarters while operating entirely from an undisclosed region” (Google Merchant Center). An honest shop with a virtual office address does not break this rule as long as it does not hide where it actually operates and ships from. Still, it is worth saying so plainly on your contact page.
How to report a fake shop impersonating your business
In the United Kingdom, the NCSC accepts reports of suspicious websites and states that it “has the power to investigate and remove scam websites”; reporting is free, and you may send URLs even if you are not certain they are a scam (NCSC, report a scam website). It works with hosting companies to take malicious sites down, but it does not tell you the outcome. Scam text messages go to 7726, a free forwarding number run by most phone providers, which lets the provider investigate the sender and block it. The NCSC is not the place to report a crime: customers who lost money in England, Wales or Northern Ireland report to Report Fraud at reportfraud.police.uk or on 0300 123 2040, and in Scotland to Police Scotland on 101.
In Ireland, the CCPC’s advice to a scammed consumer is to contact the bank or card issuer at once and ask about a chargeback, report to the local Garda station or the Garda National Economic Crime Bureau, and contact the CCPC if a business is misleading consumers (CCPC, what to do if you’ve been scammed). As the impersonated business, you can use the same CCPC report channel to describe the clone.
Reporting to the authorities is one of three steps. The second is an abuse report to the hosting company and the domain registrar, whose details you will find in WHOIS and in the clone’s DNS records. Attach screenshots, the clone’s address and the address of your shop. The third is a notice for customers on your site and on social media: what your only address is and what your bank account name and number are. If someone has already paid into the clone’s account, send them to their bank first; the CCPC’s advice to scam victims is that “every minute counts”.
Checklist: the credibility test for a WooCommerce shop
The points a careful buyer checks, starting with the quickest.
| What the buyer checks | Where | What has to match in your shop |
|---|---|---|
| Company name, number, address | Footer, terms, Companies House or CRO | One version of the details everywhere and in the register |
| VAT number | HMRC’s Check a UK VAT number | The number on the site returns your company’s name and address |
| Bank account for transfers | Confirmation of Payee, EU verification of payee | The account name matches the company on the invoice |
| Domain age | WHOIS, Wayback Machine | A history consistent with what you say about the business |
| Padlock | Address bar | HTTPS is there, but it proves nothing |
| Product photos | Reverse image search | Your own photos for bestsellers |
| Reviews | Product page, independent platforms | A note on who can review and whether you publish all reviews |
| Contact | Phone, email, Street View | Someone answers, and the address is a real place |
| Returns | Terms | A clear procedure, deadline and return address |
| Clones | NCSC report, Garda, host and registrar | Your domain is the only one, clones are reported |
Consistent company details are also part of complying with consumer law. If you also sell into Poland, the WooCommerce compliance checklist covers the Polish requirements (GDPR, Omnibus, GPSR, returns). The technical protection of a shop is covered in the WordPress hardening guide. To have this list checked on your shop and the payment settings, transactional emails and footer fixed, describe the project on the WooCommerce developer page or order a WordPress security audit.
Update, . Trust badges next to the buy button help only when every badge is true for your shop. Show a money-back guarantee, free shipping or 24/7 support badge only if your terms actually offer it. A badge that promises more than the terms is a misleading claim, and a buyer who compares it with your returns policy will see the gap. An icon with no text also tells a screen-reader user nothing, so each badge needs a short written label. My plugin Badgevo is one way to set this up in WooCommerce. It shows a row of secure-checkout badges after the add-to-cart button, under a heading you write yourself. You pick from ten inline SVG badges: secure checkout, SSL encrypted, money-back guarantee, verified store, free shipping, card payment, digital wallet, 24/7 support, privacy protected and satisfaction. A short caption in the site language prints under each badge, and that caption is what screen readers announce. An optional “Show on checkout” setting adds the row under the Place order button on the classic checkout, or under the checkout form when the page uses the Checkout block.
