Home / Checks / Source check

Official source checklist

Work through this once, carefully, on a day when nothing is urgent. Each item has a how-to and the red flag it is designed to catch. When you finish, you will have one verified route in — which is worth more than any amount of vigilance later.

Runs in your browser. Nothing you type is sent anywhere, stored, or logged — there is no server behind this page.

Seven checks0 of 7 done

1. I read the domain right to left and it is the registrable name I expectedHow: find the last dot before the first slash. The name immediately left of it is the real owner. Red flag: the brand appears as a subdomain, as in brand.com.something-else.net, or in a hyphenated name like brand-support.help. 2. I checked the domain character by character for substitutionsHow: read it slowly, or paste it into a plain text editor in a monospaced font. Red flag: a lowercase l where an uppercase I belongs, rn instead of m, or a browser showing an xn-- prefix, which means non-Latin characters. 3. I did not arrive here from a search advert, a message, or a social postHow: type the address yourself this once, or use a link from official documentation you already trusted. Red flag: you clicked a sponsored search result, a link someone sent, or a link in a reply under a post about the platform. 4. I have saved a bookmark and I will use only that from now onHow: bookmark the page now, while you have verified it. Red flag: you plan to keep searching for the site each time. That is the route attackers can buy. 5. The app store listing shows the developer name the official site says it shouldHow: read the publisher line under the app name, then compare it against what the platform's own website states. Red flag: a publisher name you cannot verify, a listing only a few months old, or a few hundred recent five-star reviews on a supposedly major app. 6. I found the support channel from inside the app, and saved itHow: open support from within the official app or site and note how it works. Red flag: any support contact obtained from a search result, a social profile, or someone who messaged you first. Real support does not open conversations. 7. I searched the legal entity in my regulator's register and warning listHow: take the entity name from the terms of service — not the brand — and search your national financial regulator's public register, then its warning list. Red flag: no entry at all, an entry for a different activity, or any appearance on a warning list.

Why these seven, and what each one is protecting against

What problem this solves

Almost every account takeover that does not involve a leaked password begins with the victim being somewhere that looked right. Not carelessness — the copies are exact, frequently serving the genuine site's own images and stylesheets. Judging by appearance is judging on the only dimension the attacker fully controls.

These seven checks all examine things the attacker cannot control: what the domain actually resolves to, who published the app, and whether a regulator has heard of the company.

How to read a domain, properly

Find the first single slash after the protocol, then work backwards to the second-to-last dot. What lies between is the registrable domain — the part somebody had to buy. Everything to the left of it is a subdomain label, and anyone who owns a domain can create unlimited subdomains with any text they like, including the name of a company they do not own.

So accounts.example.com belongs to example.com, while example.com.login-secure.net belongs to login-secure.net. The second one contains the string "example.com" and has nothing to do with it.

Why the padlock is not on this list

Because it proves nothing relevant. The padlock indicates the connection is encrypted, and certificates are free and issued in seconds to anyone controlling a domain. A fraudulent site with a padlock is a fraudulent site with working encryption. It has told you about the transport, not about the party at the other end.

The app publisher check in detail

Fake applications appear in official stores regularly and are usually removed — after a window during which people install them. They copy the name, the icon and the screenshots, because all three are trivially copyable. What is harder is the publisher account, which is why that line is the one to read.

The reliable version: open the platform's own website through your verified bookmark, find its app download links there, and follow those. Then you never search the store at all.

Why the register lookup outranks the rest

The other six confirm that you reached the site you intended. The register asks a different question: whether the company behind it is authorised to serve you. Those are independent, and a platform can be entirely genuine and entirely unauthorised at the same time.

Search the legal entity from the terms of service rather than the brand, since platforms operate through regionally-named subsidiaries. Then check the regulator's warning list as well as its register — most publish both, and the warning list is where clone firms and unauthorised operators appear.

Doing this for a support channel

Support impersonation deserves separate attention because it targets people who are already stressed and searching. The rule that closes it: support is reached from inside the app or the verified site, never from a search result, never from a social media profile, and never from someone who contacted you first. Legitimate support does not open conversations, and it never needs a password, a code, a recovery phrase, or access to your screen.

How often to repeat this

Once per platform, plus any time you are setting up a new device. The output is the bookmark and the saved support route; after that the check is replaced by a habit, which is the point. Vigilance decays and habits do not.

Last checked August 25, 2026. This is a thinking aid, not a verdict, and nothing it prints is legal or investment advice. Corrections go to the desk.