Here's what nobody tells you about fake websites: they don't look fake.
That's the part people get wrong going in. Most of us have some mental image of a scam website — broken English, flashing banners, a design that looks like it was built in 2009. And sure, those still exist. But the ones doing real damage in Nigeria right now don't look like that at all. They look like professional business websites, because in most cases, they are professional business websites. Someone paid a developer, or used a template, or cloned an existing site pixel for pixel. The scam isn't in the design. It's in everything the design is hiding.
We got pulled into this conversation last year when a client called us, not about their own website, but about one that looked almost exactly like it. A "sister company" had appeared online, offering the same services at slightly better prices, with a logo close enough that most people wouldn't clock the difference on a phone screen. It had a contact form, a WhatsApp number, testimonials, even a blog. It was collecting deposits from people who thought they were dealing with our client. We're not naming it here because the domain's since been taken down, but the point stands — it took our client weeks to notice it existed, and it took the people who'd already paid into it a lot longer to realize something was wrong.
Why "It Looks Professional" Isn't a Safety Check Anymore
For a long time, the advice people gave was "check if the site looks legitimate." That advice is now close to useless, and it's worth being blunt about why: building something that looks legitimate has never been cheaper or faster. A convincing website template costs almost nothing. Product photos can be lifted from anywhere. Testimonials can be written in five minutes. None of that requires the sophistication people assume a "real scam operation" needs. It requires a domain name, a weekend, and a target list.
So the visual layer — the thing most people actually look at — tells you almost nothing anymore. What tells you something is underneath the visual layer, in places most visitors never think to check.
What Actually Distinguishes a Real Business Site From a Fake One
The domain's age and history. A business that's been operating for five years should have a domain that's been registered for roughly that long. You can check this with a free WHOIS lookup — search "WHOIS lookup" and paste in the domain. If a company claims a decade of history and their domain was registered eight months ago, that's not proof of a scam on its own, but it's a question worth asking before you send anyone money.
How the payment actually happens. This is the single biggest tell, and it's the one we'd weight most heavily. Legitimate Nigerian businesses selling anything of real value are almost always set up with a proper payment gateway — Paystack, Flutterwave, Remita, or similar — where your money goes through a processor, not straight into someone's personal account. If a website's "checkout" is just a bank account number pasted into a WhatsApp message, or an account name that doesn't match the business name on the site, that's a serious flag. Real companies register business accounts. Scammers use personal ones because they're faster to open and harder to trace back once emptied.
Whether the business exists anywhere else. A real Nigerian business of any size should show up somewhere beyond its own website — on Google Business Profile with actual reviews (not five reviews all posted the same week), on the CAC public search if it's registered, in conversations or mentions outside the site itself. If a company only exists on the one page it's trying to get you to transact on, and nowhere else on the internet, that absence is itself information.
The urgency built into the page. Countdown timers, "only 3 slots left," "offer expires tonight" — these show up on real marketing pages too, so this one's less clean-cut than the others. But when urgency is paired with a request for upfront payment before any other contact or verification, it's doing a specific job: getting you to act before you check anything else on this list. Legitimate urgency ("early bird pricing ends Friday") doesn't usually require you to skip due diligence. Scam urgency depends on it.
Contact information that doesn't hold up. Call the number. Not to ask about the product — just to see who picks up, and whether their answer matches the business on the website. A number that goes straight to voicemail, or a WhatsApp account with no profile photo and a chat history that started three weeks ago, tells you something different than a business line that's answered professionally and matches the company name.
The Layer Most People Skip: Checking Before You're Already Invested
Here's the honest part of this. Almost everyone reading a list like this thinks they'll remember to do it "when it matters." In practice, the checking happens after the money's gone, when someone's trying to figure out what went wrong and finally runs the WHOIS lookup they should have run twenty minutes earlier. This isn't a failure of intelligence. It's how urgency and trust signals are designed to work — they're built to get you past the point where you'd normally pause.
So the practical version of this advice isn't "be more careful." It's: build one habit — before you send money to any business you haven't dealt with before, spend three minutes checking the domain age, the payment method, and whether the business exists anywhere else online. Three minutes. That's genuinely the entire cost of the check we're describing, and it catches the overwhelming majority of what's currently working on people in Nigeria.
If You're a Business Owner Reading This From the Other Side
There's a second layer to this that's worth naming, because it isn't just customers who are exposed — it's the real businesses being impersonated. If your business has any visibility online, someone can clone your site, your logo, your customer list if it's ever leaked, and start collecting money as you. This isn't hypothetical or rare; it's a known pattern for any brand with enough recognition to be worth stealing. The defenses are straightforward but often skipped: register your domain and any obvious variants of it, keep your Google Business Profile active and verified, make your payment process visibly tied to a registered business account rather than informal transfers, and if you ever discover an impersonating site, report it to the registrar and to Google directly rather than assuming it'll resolve itself.
None of this makes fake websites disappear. What it does is shift the odds. A scammer optimizing for speed and low effort will move on to an easier target the moment real friction shows up — a WHOIS check, a call that doesn't get answered the way they'd hoped, a payment method that doesn't let them disappear cleanly. You don't need to catch every scam site that exists. You need to be slightly harder to catch than the person next to you.
