Nearly 75% of Americans Can't Spot a Fake URL. Can You?

Think you'd recognize a fake website before handing over your password or credit card details? You might want to think again.

A new NordVPN survey found that 74% of Americans tested couldn't identify a fake website address, while an even larger 82% failed to recognize fraudulent CAPTCHA prompts.^[1]

That's despite nearly half of respondents saying they felt highly confident they could spot online fraud. Another 71% believed common sense alone was enough to protect them.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

Most Americans couldn't recognize a fake URL

NordVPN surveyed 2,010 Americans in August 2026 about their online habits and cybersecurity knowledge.

In one test, participants had to spot a fake website address with a subtle spelling change. Most missed it.

Some scammers use this trick, called typosquatting, to imitate legitimate websites. They might add an extra letter to a retailer's URL or swap a character for a similar one.

The website itself might look almost identical to the real thing, complete with familiar logos, product listings, and login forms. If you enter your password or payment details on one of these sites, that information could end up in a scammer's hands.

And don't assume a padlock icon means you're safe. It indicates that your connection to the website is encrypted, not that the website itself is legitimate.

Fake CAPTCHAs fooled even more people

The survey's CAPTCHA test went even worse: 82% of participants failed to spot the fake verification prompts.

CAPTCHAs are the familiar verification challenges that ask you to check a box, identify images, or otherwise prove you're human. Because they're so common, encountering one might not raise suspicion.

One scam, known as ClickFix, disguises malicious instructions as a routine security check. Victims are told to copy and paste commands into Windows tools to complete the verification.

Those commands can install malware that steals passwords and other personal information. If a CAPTCHA asks you to run commands on your computer, close the page.

Confidence isn't translating into safer habits

NordVPN found that 51% of respondents reused identical or similar passwords across accounts. Around half had clicked potentially harmful links without checking them first.

Meanwhile, 47% said they relied on antivirus software to protect them from nearly all online threats.

Antivirus software can block malware and dangerous websites, but it won't catch every phishing scam, especially when someone is tricked into giving away their password.

Just over half of respondents said they'd be more likely to trust a message that included their real name and recent purchase history. But scammers can get those details from data breaches, so a personalized message isn't necessarily legitimate.

How to tell if a website is fake

Taking a few precautions can reduce your chances of falling victim to such scams:

1. Check the URL. Watch for misspellings, extra characters, or unfamiliar domains, especially when clicking links in messages or ads.
2. Go directly to websites. Use bookmarks or type the address yourself instead of following unexpected links.
3. Don't trust appearances. Familiar logos, professional designs, and HTTPS don't guarantee a website is legitimate.
4. Use a password manager or passkeys. Password managers can avoid autofilling passwords on fake sites, while passkeys offer stronger protection against phishing.
5. Watch for fake CAPTCHAs. Never run computer commands, disable security tools, or download files to complete a verification.
6. Enable multifactor authentication (MFA). An extra verification step can help protect your account even if someone steals your password.

For additional protection, consider using a phishing protection tool that can help detect malicious links and websites before you interact with them.

What to do if you've entered information on a fake website

If you realize you've shared information with a fraudulent website, act quickly. Start by changing any compromised passwords through the legitimate website or app. If you've reused the same password elsewhere, change it on those accounts too.

If you shared banking or credit card information, contact your bank or card issuer immediately. They can help secure your accounts, monitor suspicious transactions, or replace compromised cards.

If you downloaded a suspicious file or followed instructions to run a command, disconnect the affected device from the internet and run a full security scan using trusted software.

You can also report the scam to the Federal Trade Commission, which collects reports of fraud and other deceptive practices.

Author Details

Thomas Kent

About the Author

Thomas Kent is a multi-disciplined reporter with over a decade of experience covering online platforms, digital trends, and consumer-facing tech. Tom focuses on digital privacy, data tracking, and user behavior, with a particular interest in how cookies, online surveillance, and platform design shape the modern internet experience. His reporting takes a research-driven, news-focused approach, translating complex technical topics into clear, accessible insights.