Do not start from a link sent by someone requesting money or documents. Independently locate the institution through a trusted government directory or an already verified official website. Search advertisements and prominent search positions are not proof of official status; look closely at the complete domain.
Check for subtle spelling changes, unexpected subdomains and copied branding. HTTPS protects a connection, but does not certify the honesty or authority of the website operator. A padlock, official-looking seal or downloadable certificate is not sufficient evidence of legitimacy.
Cross-check the organisation’s name, remit and contact details against a second trusted official source when available. For a regulated firm, compare the register’s listed website and phone number, not just its name or registration number. Call or write using the independently obtained contact details to check unusual requests.
Before submitting information, read the official instructions and privacy notice. Confirm any fee through the independently verified organisation. Keep a note of the sources and date of your checks. If details conflict, pause and seek clarification through verified channels; do not let urgency replace verification.