{"slug":"website-credibility","title":"Is This a Legitimate Website? How to Check, and How Law Firms Prove It","seoTitle":"Is This a Legitimate Website? A 12-Step Check (2026)","description":"Is a website legit? Read the real host name, check ICANN Lookup and Safe Browsing, spot fake reviews, and verify any lawyer or settlement with the court or bar.","banner":"/images/blog-content/website-credibility/hero.jpg","ogImage":"/images/og/website-credibility-og.jpg","url":"https://www.masstortmarketingagency.com/blogs/website-credibility","published":"2026-10-22","modified":"2026-10-22","author":{"name":"Tarun","role":"Founder, Mass Tort Marketing Agency"},"keywords":["is this a legitimate website","website credibility","how to check if a website is legit","how to tell if a website is fake","is this website safe","website credibility checklist","how to make a website trustworthy","how to tell if a law firm is legitimate","how to verify a lawyer","is this settlement legit"],"blocks":[{"type":"quote","text":"**Quick answer.** To check if a website is legitimate, read the real host name in the address bar, confirm a real organization runs it using an address and phone number you can verify elsewhere, and test the address with [Google's Safe Browsing Site Status tool](https://transparencyreport.google.com/safe-browsing/search) and a blocklist checker. HTTPS only proves the connection is encrypted: [nearly all phishing sites use HTTPS](https://blog.chromium.org/2023/05/an-update-on-lock-icon.html). For a lawyer, use the state bar's attorney search. For a settlement, confirm the court case, and treat any fee to file a claim as a red flag."},{"type":"paragraph","text":"**Key takeaways**"},{"type":"list","ordered":false,"items":["HTTPS and the padlock prove encryption, not honesty. Chrome's team found [only 11% of study participants](https://blog.chromium.org/2023/05/an-update-on-lock-icon.html) correctly understood the lock icon, and Chrome replaced it with a \"tune\" icon in 2023.","Credibility is a perception made of trustworthiness and expertise ([Fogg and Tseng's definition, restated in the 2002 Stanford report](https://advocacy.consumerreports.org/wp-content/uploads/2013/05/stanfordPTL.pdf)). Legitimacy, meaning a real and accountable operator, is a separate question you can check.","The free checks that matter: the host name, [ICANN Lookup](https://lookup.icann.org/en) (RDAP replaced WHOIS for generic domains on 28 January 2025), Safe Browsing Site Status, [URLVoid](https://www.urlvoid.com/) and [BBB Scam Tracker](https://www.bbb.org/scamtracker). None of them guarantees a site is safe.","To verify a lawyer, use the state bar's search and call the number the bar lists ([State Bar of California guidance](https://www.calbar.ca.gov/public/concerns-about-attorney/avoid-legal-services-fraud)).","Crypto-scam victims reported losing [over $9.9 million](https://www.ic3.gov/PSA/2024/PSA240624) to fictitious law firms between February 2023 and February 2024, per the FBI.","The often-quoted \"48% judge by design\" figure has no traced source. The 2002 Stanford study found design look in 46.1% of comments, a different measure.","Law firm sites must also follow the FTC's fake-review rule ([16 CFR Part 465, effective October 21, 2024](https://www.federalregister.gov/documents/2024/08/22/2024-18519/trade-regulation-rule-on-the-use-of-consumer-reviews-and-testimonials)) and state advertising rules, which change: New York [dropped its \"Attorney Advertising\" label requirement](https://nysba.org/wp-content/uploads/2026/08/The-Amendments-to-the-Advertising-Rules.pdf) on June 1, 2026."]},{"type":"paragraph","text":"People rarely ask \"is this a legitimate website?\" in the abstract. They ask it about a specific link: an online shop with prices that look too good, a text saying they qualify for a settlement, an email from a \"law firm\" offering to recover crypto they already lost. This guide gives the method first, in an order you can follow with the link still open in another tab, and then turns it around for the businesses on the receiving end of those checks. The method works for any site. The legal checks (lawyers, settlements and class actions) get full treatment here because most guides skip them."},{"type":"paragraph","text":"Mass Tort Marketing Agency builds claimant acquisition and intake for personal injury and mass tort firms ([who we are](/about)). We are not a URL checker, so every tool named in this guide belongs to someone else and is linked so you can use it directly. The second half shows plaintiff firms what their websites, reviews and intake lines must show to pass the same checks their prospective clients run."},{"type":"paragraph","text":"The guide runs in this order: the 12-step test; what credibility means and what the research says; each check in depth; the lawyer and settlement checks; the owner's side, with nine trust elements and the advertising and review rules; technical and intake trust; a mirror-audit scorecard; sources; and a FAQ. Rules and tool features are described as of October 2026, and nothing here is legal advice."},{"type":"heading","level":2,"text":"How to check if a website is legit: the 12-step test"},{"type":"paragraph","text":"To check if a website is legitimate, work outward from the address bar: confirm the real host name and connection, prove a real and reachable organization stands behind the site, check its reputation in places it does not control, and verify any license or case claim at its source."},{"type":"paragraph","text":"The 12 steps below run from the fastest checks to the slowest. Most scams fail in the first three."},{"type":"list","ordered":true,"items":["Read the host: the part of the address between `//` and the next `/`.","Look for lookalikes: swapped letters, extra words, odd characters or a different ending.","Check the connection: a \"Not secure\" label or a full-page red warning is a stop sign.","Look up the registration in ICANN Lookup and note when the domain was created.","Find a street address and confirm it exists outside the website.","Call a phone number you found independently, not only the one on the page.","Read the privacy, terms and refund pages, and note how the site asks you to pay.","Open Chrome's \"About this page\" panel and search the name with \"scam\" and \"reviews\".","Read reviews on other sites and look for patterns, not just the star average.","Run the address through Google Safe Browsing Site Status and a blocklist checker such as URLVoid.","Search BBB Scam Tracker and complaint records for the name, phone number and website.","Verify licenses, case numbers and claim deadlines at the source: the state bar, the court or the official claim site."]},{"type":"image","src":"/images/blog-content/website-credibility/01-twelve-step-legitimacy-check.jpg","alt":"Cheat sheet of 12 website legitimacy checks grouped into four stages: address, organization, reputation and source","caption":"The 12-step test runs from the fastest checks to the slowest. Any stop sign along the way is enough to end it."},{"type":"heading","level":3,"text":"Steps 1 to 3: read the address and the connection"},{"type":"paragraph","text":"The host name comes first because it is the one thing a lookalike site cannot copy. Logos, photos, testimonials, attorney bios and even the full text of a real site can be lifted in minutes, but the scammer cannot make their server answer to the real organization's domain."},{"type":"paragraph","text":"The internet standard for web addresses, [RFC 3986](https://www.rfc-editor.org/rfc/rfc3986.txt), defines the host's position: it follows the double slash and ends at the next slash, question mark or number sign. So `example.com.example.net/claims` is a page on example.net, whatever the first words say. The section on reading URLs below covers the other address tricks in depth."},{"type":"paragraph","text":"Lookalikes come in a few shapes: a zero in place of an \"o\", the letters \"rn\" standing in for \"m\", an added word such as \"claims\" or \"settlement\" bolted onto a real brand, or a different ending. Some use characters from other alphabets; the [Chromium project's explanation of homograph attacks](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md) shows how a Cyrillic \"а\" can pass for a Latin \"a\"."},{"type":"paragraph","text":"Then check the connection. [Chrome's help page on site security](https://support.google.com/chrome/answer/95617) describes three states: Default (Secure), Info or Not secure, and Not secure or Dangerous. It also advises that even on secure sites you should \"check the site name in the address bar.\" A full-page red warning means the site has been flagged as unsafe by Google Safe Browsing. HTTPS by itself proves only that the connection is encrypted; the HTTPS section below explains why that is a low bar."},{"type":"heading","level":3,"text":"Steps 4 to 7: confirm a real, reachable organization"},{"type":"paragraph","text":"A legitimate site has an operator you can find, reach and hold to account outside the site itself. Steps 4 to 7 test that."},{"type":"paragraph","text":"Start with registration. [ICANN announced that RDAP](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en) became the definitive source for generic top-level domain registration data on 28 January 2025, replacing the sunsetted WHOIS services, and anyone can query it free at ICANN Lookup. Note the creation date. A domain registered a few weeks ago behind a site that claims 30 years in practice is a mismatch worth asking about. Redacted owner names, on the other hand, are normal now; the registration-data section later in this guide explains why."},{"type":"paragraph","text":"Next, the address. The Stanford web credibility guidelines say the easiest way to show a real organization stands behind a site is \"by listing a physical address.\" Check that address on a map and in street view. You are looking for an office that fits the claim, not a mailbox store, a residence or an empty lot."},{"type":"paragraph","text":"Then the phone. Call a number you found independently: from a state bar listing, a court notice, a bill or a card you already hold. A scammer controls every number printed on their own page. The State Bar of California gives exactly this advice for lawyers: contact the attorney \"using the information on the State Bar website.\""},{"type":"paragraph","text":"Finally, read the policies and the payment page. Missing, copied or contradictory privacy, terms and refund pages are a warning. So is the payment method. The FBI's [2025 warning about fake law firms](https://www.ic3.gov/PSA/2025/PSA250813) lists requests for payment \"in cryptocurrency or prepaid gift cards\" as a red flag, and the State Bar of California warns about requests to pay \"in cash, wire money directly to them, or use an encrypted service like WhatsApp.\""},{"type":"heading","level":3,"text":"Steps 8 to 10: check its reputation somewhere else"},{"type":"paragraph","text":"What a site says about itself counts for little; what other places say about it counts for more. Steps 8 to 10 move the check off the site."},{"type":"paragraph","text":"In Chrome, click the site-information icon to the left of the address. Its \"About this page\" panel can show web results about the source, the site's description \"In their own words\", and when Google first indexed the site. A site that claims a long history but was first indexed last month deserves a closer look."},{"type":"paragraph","text":"Then search the organization's name with \"scam\", \"reviews\" and \"complaints\". It takes seconds and often surfaces forum threads, news coverage or regulator warnings that the site will never mention."},{"type":"paragraph","text":"Reviews on third-party platforms help, but read them for patterns rather than the star average. Warning patterns include bursts of five-star reviews posted on the same few days, near-identical wording across reviewers, and reviewer accounts with no other history. One angry review is ordinary; ten reviews describing the same request for an upfront fee is a pattern."},{"type":"paragraph","text":"Last, run the address through Safe Browsing Site Status, which according to [Google's Safe Browsing site](https://safebrowsing.google.com/) helps protect over five billion devices every day, and through URLVoid, which says it checks a site against \"30+ blocklist engines and online website reputation services.\" Note URLVoid's own warning that \"Data submitted here is shared with security companies.\" A clean result means the site has not been reported yet. It does not mean the site is safe, and the checkers comparison later in this guide sets out each tool's limits."},{"type":"heading","level":3,"text":"Steps 11 and 12: verify every claim at the source"},{"type":"paragraph","text":"The final two steps take every claim the site makes back to whoever is supposed to have issued it. Scammers can describe a license, a court case or a deadline; they cannot add themselves to the official record."},{"type":"paragraph","text":"BBB Scam Tracker lets you \"Report a scam. Search scams.\" and searches by \"Phone number, website, email, business name or scam ID.\" Search all of them, because scammers rotate names faster than phone numbers."},{"type":"paragraph","text":"For licenses, go to the issuer. The State Bar of California tells consumers to \"use the State Bar's Attorney Search feature to confirm their credentials,\" and every state bar runs a similar search. For a class action settlement, go to the court record: under [Federal Rule of Civil Procedure 23(e)](https://www.law.cornell.edu/rules/frcp/rule_23), class claims \"may be settled, voluntarily dismissed, or compromised only with the court's approval,\" so a real class settlement has a case name, a court and an approval order you can find."},{"type":"paragraph","text":"Money requests are the clearest test. The [FTC's guidance on refund and recovery scams](https://consumer.ftc.gov/articles/refund-and-recovery-scams) is blunt: \"Government agencies and legitimate organizations will never ask for money to help you get a refund.\" The legal part of this guide covers the full lawyer, settlement and class notice checks."},{"type":"heading","level":3,"text":"The 60-second version, and the findings that end the check"},{"type":"paragraph","text":"If you only have a minute, run three quick checks. First, read the host name and make sure it is the organization's real domain. Second, look for a full-page warning or paste the address into Safe Browsing Site Status. Third, search the organization's name with the word \"scam\". If all three come back clean and nothing on the page asks for money or sensitive data, you can continue with the slower checks before you commit."},{"type":"paragraph","text":"Some findings make the remaining steps unnecessary. Any one of the following is enough to stop."},{"type":"table","header":["Finding","What it means","What to do"],"rows":[["Full-page red warning in Chrome","Safe Browsing has flagged the site","Leave; do not click through"],["Host does not match the organization's name","You may be on a lookalike","Type the known address yourself"],["\"Not secure\" on a page asking for personal data","Data would travel unencrypted","Do not enter anything"],["Asked to pay by crypto, gift card or wire","A red flag in FBI and State Bar warnings","Stop and report"],["Asked to pay to get a refund or file a claim","Legitimate organizations don't","Stop and report"],["The \"lawyer\" is not on the state bar's search, or details don't match","The person may not be licensed","Do not engage"],["Pressure to act within minutes","A tactic, not a deadline","Slow down and verify"]]},{"type":"paragraph","text":"No single green signal proves a site is legitimate, while any one of these stop signs is enough to walk away."},{"type":"heading","level":2,"text":"What website credibility means, and what it doesn't"},{"type":"paragraph","text":"Website credibility is how believable a site seems to the people using it. Researchers define it as a perception built from two things, trustworthiness and expertise, which is why a site can look credible and still be a scam, or be legitimate and still look untrustworthy."},{"type":"paragraph","text":"That gap between how a site looks and what it is runs through the rest of this guide. Visitors need ways to test the second; businesses need to close the gap from their side."},{"type":"heading","level":3,"text":"Credibility is a perception: trustworthiness plus expertise"},{"type":"paragraph","text":"The most cited definition makes credibility a judgment, not a feature. The 2002 Stanford report, restating Fogg and Tseng (1999), puts it this way: \"credibility is a perceived quality. It is not a property of a Web site.\" Credibility, in that report, is believability."},{"type":"paragraph","text":"It has two components. Trustworthiness is \"the goodness or morality of the source,\" described in terms such as well intentioned, truthful and unbiased. Expertise is the \"perceived knowledge of the source,\" described as knowledgeable, reputable and competent. A site needs both: an honest site that seems clueless loses the visitor, and so does a knowledgeable site that seems to be selling something it does not disclose."},{"type":"paragraph","text":"The practical consequence cuts both ways. Because credibility lives in the visitor's head, a legitimate business improves it by making true signals visible: real names, a real address, current content, verifiable credentials. A scammer can borrow it by copying those same signals. That is why this guide separates credibility, which you feel, from legitimacy, which you check."},{"type":"heading","level":3,"text":"Credible, legitimate, safe and secure are four questions"},{"type":"paragraph","text":"People use \"legit\", \"safe\", \"secure\" and \"credible\" as if they meant the same thing, partly because browsers and checker tools blur them. A green result from a tool, a padlock or a lock-shaped icon gets read as a general seal of approval. Each word answers a different question, and each check answers only one of them."},{"type":"table","header":["Question","What it asks","How to check","Where it can mislead"],"rows":[["Credible","Does it seem believable?","Your reading of content, design and sources","Scams can look polished"],["Legitimate","Is a real, accountable organization behind it?","Address, phone, registration, licenses","A real business can be badly run"],["Safe","Will visiting or paying harm you?","Browser warnings, Safe Browsing, blocklists","\"Not reported yet\" is not \"safe\""],["Secure","Is the connection encrypted?","HTTPS and the browser's connection icon","Phishing sites use HTTPS"]]},{"type":"paragraph","text":"Two examples show how far apart the answers can be. A phishing page copied from a bank's login screen is secure: it loads over HTTPS, and Chrome's own team has written that nearly all phishing sites do. It is not legitimate, because the bank does not run it. Now take a small law firm with a dated site, a few typos and an attorney photo from 2012. The firm may be fully licensed and in good standing, so it is legitimate, but the site is less credible, and many visitors will leave before they find out."},{"type":"paragraph","text":"This guide follows one rule from here on: check legitimacy and safety with evidence, and treat credibility as the impression the business is responsible for creating."},{"type":"heading","level":3,"text":"Prominence and interpretation: why some signals go unseen"},{"type":"paragraph","text":"A trust signal only works if the visitor notices it and reads it the way the business intended. Fogg's Prominence-Interpretation Theory, summarized in the 2002 report, says a person \"(1) notices something (Prominence) and (2) makes a judgment about it (Interpretation). If one or the other does not happen, then there is no credibility assessment.\" The report compresses this into a formula: \"Prominence X Interpretation = Credibility Impact.\""},{"type":"paragraph","text":"Multiplication is the point. A zero on either side gives zero. Picture a bar admission number printed in 9-point gray type in a footer. It is true and verifiable, but nobody sees it, so its prominence is near zero and it adds nothing. Now picture a large review badge that links nowhere. Everyone sees it, but a careful visitor interprets an unclickable badge as decoration or worse, so the impact can turn negative."},{"type":"paragraph","text":"The lesson applies to both readers. Visitors judge what they notice, so they should go looking for the evidence a page buries. Businesses should put their strongest proof where it will be seen, and make it checkable when it is."},{"type":"heading","level":3,"text":"Why legal and claims websites face the hardest scrutiny"},{"type":"paragraph","text":"Legal and claims sites deal with money, health and legal rights, which puts them in the category Google holds to its highest standard. Google's [guidance on creating helpful content](https://developers.google.com/search/docs/fundamentals/creating-helpful-content) says its systems \"give even more weight to content that aligns with strong E-E-A-T for topics that could significantly impact the health, financial stability, or safety of people,\" and calls these \"Your Money or Your Life\" topics, or YMYL."},{"type":"paragraph","text":"The September 11, 2025 edition of Google's [Search Quality Rater Guidelines](https://static.googleusercontent.com/media/guidelines.raterhub.com/en//searchqualityevaluatorguidelines.pdf) lists YMYL types including Health or Safety, Financial Security, and Government, Civics and Society, and states that \"Pages on clear YMYL topics require the most scrutiny.\" An injury claim, a lawsuit or a settlement payout touches all three."},{"type":"paragraph","text":"The human side is sharper still. Claimants often arrive after an injury, a denied insurance claim or an earlier scam, and the FBI has warned that people who already lost money to crypto fraud were targeted again by fictitious law firms. These visitors have good reasons to distrust what they see. One clarification for site owners: Google says E-E-A-T \"itself isn't a specific ranking factor,\" so it describes what Google's systems reward rather than a score you can buy. For [plain-English definitions of E-E-A-T and YMYL](/glossary), see the glossary; the search side is covered later in this guide."},{"type":"heading","level":3,"text":"Website credibility for students: the CRAAP test"},{"type":"paragraph","text":"Students checking a source for a paper have a different question: is this information reliable enough to cite? The standard tool is the [CRAAP Test from California State University, Chico's Meriam Library](https://library.csuchico.edu/sites/default/files/craap-test.pdf), which scores a source on Currency, Relevance, Authority, Accuracy and Purpose."},{"type":"paragraph","text":"Two of its prompts carry over well to any website check: \"Are the links functional?\" and \"Does the URL reveal anything about the author or source?\", with .com, .edu, .gov, .org and .net given as examples. Treat that second prompt with care. A .org or .com ending says little about who wrote a page, because anyone can register those domains; the section on domain endings explains which ones are actually restricted."},{"type":"paragraph","text":"For a fuller walkthrough aimed at academic research, Purdue OWL's guide to [evaluating digital sources](https://owl.purdue.edu/owl/research_and_citation/conducting_research/evaluating_sources_of_information/evaluating_digital_sources.html) is a good next step. The rest of this guide treats websites as businesses that ask for your trust, your data or your money."},{"type":"heading","level":2,"text":"What research says about how people judge websites"},{"type":"paragraph","text":"The best-known study, run by Stanford with Consumer WebWatch in 2002, found that a site's visual \"design look\" came up in 46.1% of people's credibility comments, more than any other theme, and later work found that first aesthetic impressions form within a fraction of a second. The research is old and often misquoted, and it is still useful if you read what it actually measured."},{"type":"heading","level":3,"text":"The 2002 Stanford study of 2,684 people"},{"type":"paragraph","text":"The study is [*How Do People Evaluate a Web Site's Credibility? Results from a Large Study*](https://advocacy.consumerreports.org/wp-content/uploads/2013/05/stanfordPTL.pdf), by B.J. Fogg, Cathy Soohoo and David Danielson of the Stanford Persuasive Technology Lab, Leslie Marable of Consumer WebWatch, and Julianne Stanford and Ellen R. Tauber of Sliced Bread Design. It ran from June 15 to August 15, 2002, was released on October 29, 2002 and was updated on November 11, 2002."},{"type":"paragraph","text":"The method was simple and large for its time. In total, 2,684 people each evaluated the credibility of two live websites drawn from one of 10 categories: e-commerce, entertainment, finance, health, news, nonprofit, opinion or review, search engines, sports and travel. The pool covered 100 sites. The researchers then analyzed the comments people wrote, 2,440 in all, and coded each comment by the themes it mentioned."},{"type":"paragraph","text":"The headline finding: \"design look\" was mentioned most often, in 46.1% of the comments. The executive summary describes this as nearly half of consumers assessing credibility \"based in part on the appeal of the overall visual design of a site, including layout, typography, font size and color schemes.\" That is a share of free-text comments, which can mention several themes at once. It is not a survey ranking design as the \"number one factor.\""},{"type":"table","header":["Rank","Theme","Share of comments"],"rows":[["1","Design look","46.1%"],["2","Information design/structure","28.5%"],["3","Information focus","25.1%"],["4","Company motive","15.5%"],["5","Information usefulness","14.8%"],["6","Information accuracy","14.3%"],["7","Name recognition and reputation","14.1%"],["8","Advertising","13.8%"],["9","Information bias","11.6%"],["10","Writing tone","9.0%"]]},{"type":"image","src":"/images/blog-content/website-credibility/02-stanford-credibility-themes.jpg","alt":"Bar chart of the eight most-mentioned credibility themes in the 2002 Stanford study, led by design look at 46.1%","caption":"Share of 2,440 participant comments that mentioned each theme (Fogg et al., 2002). It measures what people noticed, not a ranked survey."},{"type":"paragraph","text":"Design mattered more in some categories than others. Design-look comments ran higher for finance (54.6%), search engines (52.6%), travel (50.5%) and e-commerce (46.2%), and lower for health (41.8%), news (39.6%) and nonprofit (39.4%). A parallel study of 15 health and finance experts found the experts \"far less concerned about the surface aspects\" and more concerned with the \"breadth, depth, and quality of a site's information.\" Ordinary visitors and experts judge differently, and most of a law firm's visitors are not experts."},{"type":"heading","level":3,"text":"What people say matters versus what they notice"},{"type":"paragraph","text":"The same report documents a gap between what people say they check and what they actually notice. An earlier Consumer WebWatch poll, *A Matter of Trust* (April 16, 2002), surveyed 1,500 U.S. adult internet users, who \"claimed that certain elements were vital to a Web site's credibility (e.g., having a privacy policy).\" In the observed study, people \"mentioned privacy policies in less than 1 percent of their comments.\""},{"type":"paragraph","text":"Other accountability signals scored low too. Identity of the site operator came up in 8.8% of comments, customer service in 6.4% and sponsorships in 2.3%."},{"type":"paragraph","text":"There is a lesson here for each side. A business should not count on a policy page nobody opens to carry its trust; the signals that work are the ones people notice on the pages they actually read. A visitor should deliberately run the checks they would otherwise skip, such as who operates the site and how to reach them, because instinct tends to skip them too."},{"type":"heading","level":3,"text":"Stanford's 10 credibility guidelines, 24 years on"},{"type":"paragraph","text":"The [Stanford Guidelines for Web Credibility](https://credibility.stanford.edu/guidelines/index.html) are \"10 guidelines … based on three years of research that included over 4,500 people,\" cited as Fogg, B.J. (May 2002), with a footer reading \"Updated June, 2002.\" The headings, verbatim:"},{"type":"list","ordered":true,"items":["Make it easy to verify the accuracy of the information on your site.","Show that there's a real organization behind your site.","Highlight the expertise in your organization and in the content and services you provide.","Show that honest and trustworthy people stand behind your site.","Make it easy to contact you.","Design your site so it looks professional (or is appropriate for your purpose).","Make your site easy to use — and useful.","Update your site's content often (at least show it's been reviewed recently).","Use restraint with any promotional content (e.g., ads, offers).","Avoid errors of all types, no matter how small they seem."]},{"type":"paragraph","text":"Guidelines 2, 5 and 10 read as if they were written for today's claimant landing pages. The commentary on guideline 2 says \"The easiest way to do this is by listing a physical address,\" and the one on guideline 10 says \"Typographical errors and broken links hurt a site's credibility more than most people imagine.\" Guideline 1's note that links to evidence help \"even if people don't follow these links\" still explains why sourced pages feel more trustworthy. Guideline 8's \"at least show it's been reviewed recently\" anticipates the visible review dates now common on legal and medical pages, and guideline 9's \"Avoid pop-up ads\" still holds."},{"type":"paragraph","text":"What has aged is the context. The guidelines predate HTTPS becoming normal: according to [Chrome's 2023 post on the lock icon](https://blog.chromium.org/2023/05/an-update-on-lock-icon.html), as late as 2013 only 14% of the Alexa Top 1M sites supported HTTPS, and by 2023 over 95% of page loads in Chrome on Windows used it. The lab has moved on too; its successor, the [Stanford Behavior Design Lab](https://behaviordesign.stanford.edu/), says \"our work has moved away from\" persuasive technology. Read the guidelines as historical research with durable advice, and note that the 4,500 figure describes a three-year programme, not a single study."},{"type":"heading","level":3,"text":"First impressions: 17 to 50 milliseconds, then 10 to 20 seconds"},{"type":"paragraph","text":"Visitors form an aesthetic impression of a page almost instantly, and then decide within seconds whether to stay. A [2012 Google Research post by Javier Bargas-Avila](https://research.google/blog/users-love-simple-and-familiar-designs-why-websites-need-to-make-a-great-first-impression/) reports that aesthetic judgments form \"within incredibly short timeframes between 17 and 50 milliseconds,\" while \"the average blink of an eye takes 100 to 400 milliseconds.\" Users preferred simple designs with low visual complexity and familiar ones with high prototypicality. The study measured how beautiful people found a page, not whether they believed it, so it is evidence about first impressions rather than credibility verdicts."},{"type":"paragraph","text":"The second window is longer. In [Nielsen Norman Group's analysis of how long users stay on web pages](https://www.nngroup.com/articles/how-long-do-users-stay-on-web-pages/), Jakob Nielsen wrote in 2011 that \"Users often leave Web pages in 10–20 seconds, but pages with a clear value proposition can hold people's attention for much longer,\" drawing on Microsoft Research data from Chao Liu and colleagues covering 205,873 pages."},{"type":"paragraph","text":"For a law firm page, the implication is concrete. The firm's name, what it handles and how to reach a real person need to be visible in that first window, above anything decorative. A visitor who has to scroll to learn who runs the site has often already left."},{"type":"heading","level":3,"text":"Nielsen Norman Group's four trust factors"},{"type":"paragraph","text":"Nielsen Norman Group's [four credibility factors](https://www.nngroup.com/articles/trustworthy-design/) have held up for more than 25 years. Aurora Harley's 2016 article notes that \"In 1999 Jakob Nielsen listed 4 ways in which a website can communicate trustworthiness: design quality, up-front disclosure, comprehensive and current content, and connection to the rest of the web,\" and that a 2016 study run in Singapore \"observed that these very same factors continue to influence users.\""},{"type":"paragraph","text":"Two findings from that study are worth keeping. \"Typos, broken links, and other mistakes quickly degrade credibility,\" and \"When sites omitted basic information, they were almost immediately ruled out of consideration.\" One participant rejected a cleaning service's site after 35 seconds because it did not state its rate."},{"type":"paragraph","text":"Each factor maps to a later part of this guide: design quality to the owner's checklist, up-front disclosure to the advertising and review rules, current content to the visible review dates and technical trust section, and connection to the rest of the web to the off-site reputation checks."},{"type":"heading","level":3,"text":"Why the 48% and 75% design statistics don't hold up"},{"type":"paragraph","text":"Two design statistics travel widely without a traceable source. The rankings.io post [*The 9 Elements of a Trustworthy Website*](https://rankings.io/blog/9-elements-of-a-trustworthy-website/) (byline Chris Dreyer, shown date May 22, 2025) quotes bluecorona.com: \"48% of people cited a website's design as the number one factor in deciding the credibility of a business.\" No primary study behind that figure was traced. The nearest primary source is the 2002 Stanford result above, where design look appeared in 46.1% of comments, which is a different number, a different measure and data from 2002."},{"type":"paragraph","text":"The claim that \"75% of users judge a company's credibility by its website design\" appears in AI answers and agency blogs, and no primary source for it was located; the Stanford guidelines page contains no such figure. The same goes for \"94% of first impressions are design-related.\""},{"type":"paragraph","text":"My advice for readers and writers alike: when a statistic has no date, no sample and no link to the study, leave it out. The research that does hold up is useful enough without inflation. With the definitions and the evidence in place, the next sections take each check in turn, starting with how to read a web address."},{"type":"heading","level":2,"text":"How to read a URL and spot lookalike domains"},{"type":"paragraph","text":"The host name is the only part of a web address that tells you whose site you are on, and it sits between the `//` and the next single slash. Most lookalike tricks work by putting a familiar brand somewhere other than the end of the host, where a quick reader assumes it belongs."},{"type":"image","src":"/images/blog-content/website-credibility/03-address-bar-anatomy.jpg","alt":"Annotated generic browser address bar marking the scheme, subdomain, registered domain, path and where the real host ends","caption":"The site you are on is the host between // and the next slash. Text before an @ sign or after that slash is not the host."},{"type":"paragraph","text":"Reading an address correctly takes about five seconds once you know the rule. It is also the one check that works the same on every device, in every browser and for every kind of site, from a store to a settlement page. The sections below show the rule, the common ways scammers bend it, and the habits that defeat them."},{"type":"heading","level":3,"text":"Find the real host between the // and the next /"},{"type":"paragraph","text":"The internet standard that defines web addresses, [RFC 3986 (January 2005)](https://www.rfc-editor.org/rfc/rfc3986.txt), says the part that names the server \"is preceded by a double slash ('//') and is terminated by the next slash ('/'), question mark ('?'), or number sign ('#') character.\" The same standard allows optional user information before an `@` sign, which means anything to the left of an `@` is not the host at all."},{"type":"paragraph","text":"In practice, that gives you three moves. Start reading right after `//`. Stop at the first `/`, `?` or `#`. If there is an `@` in what you just read, throw away everything before it. What remains is the host."},{"type":"paragraph","text":"Then read the host from right to left. The ending comes first (`.com`). The registered name sits just to its left (`example`). Together, `example.com` identifies who controls the site. Anything further left, such as `www` or `login`, is a subdomain, and only the owner of `example.com` can create those. The five patterns below cover almost every address you will see."},{"type":"table","header":["Address as written","Real host","What is going on"],"rows":[["`https://www.example.com/contact`","`www.example.com`","Normal; `/contact` is a page on the site"],["`https://example.com.example.net/login`","`example.com.example.net`","A site on example.net using \"example.com\" as a subdomain"],["`https://example.com@example.net/`","`example.net`","Text before `@` is not the host"],["`https://example.net/example.com/claim`","`example.net`","The brand appears only in the path"],["`https://example.com/bank/account.example.org`","`example.com`","Text after the first slash is path, so this is example.com"]]},{"type":"paragraph","text":"Not every popular guide gets the last row right. [Chase's consumer guide on checking whether a website is legit](https://www.chase.com/personal/credit-cards/education/basics/how-to-check-if-a-website-is-legit) uses the example `chase.com/bank/account.chase.org` and says the \"last domain in the address (chase.org) is incorrect.\" Under RFC 3986, the host in that example is chase.com, because everything after the first slash is a path on that site. The dangerous patterns are the subdomain form (`chase.com.example.org`, whose host ends in example.org) and the `@` form (`chase.com@example.org`, whose host is example.org)."},{"type":"heading","level":3,"text":"Lookalike letters, swapped characters and homograph attacks"},{"type":"paragraph","text":"A lookalike domain is a real, registered address chosen because it reads like a trusted one at a glance. The common tricks are simple. A zero stands in for the letter \"o\". A capital \"I\" or the digit \"1\" replaces a lowercase \"l\". The letters \"rn\" sit side by side and pass for an \"m\" in many fonts. A letter is dropped or doubled, a hyphen is added, or a reassuring word such as \"claims\", \"support\" or \"settlement\" is attached to a familiar name."},{"type":"paragraph","text":"Homograph attacks go one step further by using characters from other alphabets. The [Chromium project's documentation on internationalized domain names](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md) explains that \"the Latin 'a' looks a lot like the Cyrillic 'а', so someone could register http://ebаy.com (using Cyrillic 'а'),\" and calls these \"homograph attacks.\" To counter them, browsers \"display some domains in punycode (looks like xn--...).\" If an address you expected to be familiar suddenly shows `xn--` followed by a jumble of letters, the browser is telling you the name contains characters that are not what they seem. Since Chrome 51, that display policy ignores your browser's language settings, so the protection applies the same way for everyone."},{"type":"paragraph","text":"The defenses are habits, not tools. Type addresses you already know, or use a bookmark you saved yourself. On a phone, zoom in on the address bar before you trust it, because small screens hide swapped characters. Be most careful with links that arrive by text message or email, since that is where a lookalike does its work: you never had to type it, so you never had to read it."},{"type":"heading","level":3,"text":"Subdomains, @ signs and paths that borrow a brand"},{"type":"paragraph","text":"There are three ways to put a trusted name in an address without owning it. The subdomain form puts the brand on the left of someone else's domain, as in `example.com.example.net`. The `@` form puts the brand in front of an `@` sign, as in `example.com@example.net`, where the browser ignores it. The path form puts the brand after the first slash, as in `example.net/example.com/claim`, where it is only a folder name."},{"type":"paragraph","text":"All three work for the same reason. People read left to right and stop as soon as they see the name they expected. The habit that defeats them is reading the host from right to left: find the ending, then the word just before it, and ask whether that pair is the organization you meant to visit."},{"type":"paragraph","text":"An `@` sign inside a web address is uncommon on ordinary websites. If you see one in a link you were sent, treat it as a reason to stop and type the address yourself."},{"type":"heading","level":3,"text":"What a domain ending does and doesn't tell you"},{"type":"paragraph","text":"Only one common ending is restricted and verified in the United States. According to [CISA's get.gov eligibility page](https://get.gov/domains/eligibility/), \".Gov domains … are only available to U.S.-based government organizations, and they're free,\" and CISA manages the .gov space. The same page states plainly that \"Anyone can register a .com, .org, or .us domain for a fee.\""},{"type":"paragraph","text":"That has three practical consequences. A .org ending does not prove a nonprofit. A .com ending proves nothing about a company's size, age or honesty. An unusual ending is a reason to run more checks, never proof of a scam on its own, because legitimate businesses use newer endings too."},{"type":"paragraph","text":"The one place the ending carries real weight is government. If a page says it is a federal or state agency, or that it administers a government program, a .gov host is a strong signal. A site that claims to be an agency on any other ending is a stop sign. Settlements run by private administrators are different: they use ordinary endings, and the settlement section below covers how to confirm them through the court."},{"type":"heading","level":3,"text":"Redirects and shortened links"},{"type":"paragraph","text":"Redirects are normal, and their presence alone tells you little. [Google's documentation on site moves](https://developers.google.com/search/docs/crawling-indexing/site-move-with-url-changes) treats \"URL changes from HTTP to HTTPS\" as an ordinary move handled with redirects, and businesses redirect old domains to new ones all the time. The warning sign is ending up on an unrelated host. Check the address after the page finishes loading, not only the link you clicked, and apply the right-to-left reading to the final address."},{"type":"paragraph","text":"[Truecaller's link checker page](https://www.truecaller.com/link-checker-tool) claims that \"legitimate websites don't redirect their users usually.\" That is overstated. A redirect from `http://example.com` to `https://www.example.com` is routine. A redirect from a link that looked like `example.com` to a page on `example.net` is the pattern that should stop you."},{"type":"paragraph","text":"Shortened links hide the destination entirely until you click. For anything that involves money, a login or personal details, avoid opening a short link. Go to the organization's site by typing its address, or ask the sender for the full link and read it before you open it."},{"type":"heading","level":2,"text":"HTTPS and the padlock: what they prove and don't"},{"type":"paragraph","text":"HTTPS proves that the connection between your browser and the site is encrypted, so others on the network cannot read or alter what you send. It does not prove who runs the site or whether they are honest, and Chrome's security team says nearly all phishing sites use HTTPS."},{"type":"image","src":"/images/blog-content/website-credibility/04-what-https-proves.jpg","alt":"Two-column graphic contrasting what HTTPS proves, an encrypted connection, with what it does not prove about a business","caption":"HTTPS protects data in transit. Chrome's security team says nearly all phishing sites use it, so it says nothing about honesty."},{"type":"paragraph","text":"For years, consumers were taught to look for the padlock and relax. That advice now points in the wrong direction. The browser symbols changed, nearly every site uses encryption, and the scammers who rely on lookalike domains have encryption too. The four sections below cover what HTTPS does, what the current Chrome symbols mean, what the certificate types are, and where Chrome's handling of unencrypted sites is heading."},{"type":"heading","level":3,"text":"HTTPS means encrypted, not honest"},{"type":"paragraph","text":"Chrome's own team has said this directly. In [Chrome's May 2023 post on the lock icon](https://blog.chromium.org/2023/05/an-update-on-lock-icon.html), the security team wrote that \"the lock icon does not indicate website trustworthiness.\" It cited research from 2021 that \"showed that only 11% of study participants correctly understood the precise meaning of the lock icon.\" And it noted that \"nearly all phishing sites use HTTPS, and therefore also display the lock icon.\""},{"type":"paragraph","text":"[Chrome Help's page on secure connections](https://support.google.com/chrome/answer/95617) gives the same warning in plain terms: \"Even on secure sites, be careful with your personal information. To make sure you're on the correct site, check the site name in the address bar.\" Truecaller's link-checker page makes the same point in its own words, stating that \"HTTPS means your connection to the website is encrypted. It does not mean the website is honest.\""},{"type":"paragraph","text":"The reason is simple. A certificate proves control of a domain, and certificates are easy to get. The [Let's Encrypt FAQ](https://letsencrypt.org/docs/faq/) says, \"We do not charge a fee for our certificates.\" Anyone who registers a lookalike domain can put HTTPS on it easily and at no cost. So the common advice that HTTPS means it is safe to type card or bank details is wrong. HTTPS means your data reaches the site privately. Whether the site deserves your data is a separate question, and the address, contact and reputation checks answer it."},{"type":"heading","level":3,"text":"Chrome's address-bar icons since the lock was retired"},{"type":"paragraph","text":"Chrome stopped showing the closed padlock in September 2023. The same lock-icon post announced that Chrome \"will be replacing the lock icon in Chrome's address bar with a new 'tune' icon,\" scheduled for Chrome 117 in early September 2023. On iPhones and iPads, where the lock was not tappable, Google said \"we will be removing it entirely.\" Chrome said it would \"continue to mark plaintext HTTP as insecure.\""},{"type":"paragraph","text":"Chrome Help now describes three states. Here is what each means and what to do."},{"type":"table","header":["Chrome symbol","What it means","What to do"],"rows":[["Default (Secure)","The connection is encrypted","Still check the site name in the address bar"],["Info or Not secure","The connection is not private","Do not enter passwords, card numbers or personal details"],["Not secure or Dangerous","A serious problem with the connection or the site","Leave the site"]]},{"type":"paragraph","text":"A \"full-page red warning screen\" is the strongest signal of all. Chrome Help says it means \"the site is flagged as unsafe by Google Safe Browsing.\" Close the tab rather than clicking through."},{"type":"paragraph","text":"Selecting the site-information icon to the left of the address opens Chrome's \"About this page\" panel. That panel can help with reputation, and the checkers section below explains how. For now, the rule is short: stop looking for a closed padlock, because Chrome no longer shows one, and its absence does not mean a problem."},{"type":"heading","level":3,"text":"Certificate types: DV, OV, IV and EV"},{"type":"paragraph","text":"Certificates differ in how much the issuer checks before issuing them. The industry rules that certificate authorities follow, the [CA/Browser Forum's TLS Baseline Requirements](https://github.com/cabforum/servercert/blob/main/docs/BR.md), name four validation types: Domain Validated (DV), Individual Validated (IV), Organization Validated (OV) and Extended Validation (EV)."},{"type":"table","header":["Type","What the issuer checks","Free from Let's Encrypt?","What a visitor sees"],"rows":[["DV","Control of the domain","Yes","No distinct indicator in Chrome's help"],["IV","An individual's identity plus the domain","No","No distinct indicator in Chrome's help"],["OV","An organization's identity plus the domain","No","No distinct indicator in Chrome's help"],["EV","Extended checks on an organization","No","No distinct indicator in Chrome's help"]]},{"type":"paragraph","text":"The Let's Encrypt FAQ says it \"offers Domain Validation (DV) certificates\" and does \"not offer Organization Validation (OV) or Extended Validation (EV).\" Its default certificates \"are valid for 90 days.\" Chrome's help page lists only the three states in the table above, so do not expect to see a company name or a colored bar for any certificate type. Older guides that promise one describe browsers that no longer behave that way."},{"type":"paragraph","text":"The practical point is about lookalikes. A DV certificate on a lookalike domain is perfectly valid. A valid certificate tells you the encrypted connection matches the host in the address bar. It does not tell you that the host is the one you meant to visit. That is why reading the host comes before anything the browser says about security."},{"type":"heading","level":3,"text":"\"Not secure\" labels and Chrome's HTTPS-by-default plan"},{"type":"paragraph","text":"Chrome has pushed unencrypted sites toward warnings in three dated steps. In February 2018, Chrome's [announcement that \"a secure web is here to stay\"](https://blog.chromium.org/2018/02/a-secure-web-is-here-to-stay.html) said: \"Beginning in July 2018 with the release of Chrome 68, Chrome will mark all HTTP sites as 'not secure'.\" By 2023, the lock-icon post reported that \"over 95% of page loads in Chrome on Windows are over a secure channel using HTTPS,\" compared with 2013, when \"only 14% of the Alexa Top 1M sites supported HTTPS.\""},{"type":"paragraph","text":"The third step is a change to Chrome's defaults. In [Google's October 28, 2025 post, \"HTTPS by default\"](https://security.googleblog.com/2025/10/https-by-default.html), the company wrote that \"with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable 'Always Use Secure Connections'. This means Chrome will ask for the user's permission before the first access to any public site without HTTPS.\" The setting first launched \"in 2022 as an opt-in option.\" Before the broad change, Google said that \"in Chrome 147, releasing in April 2026,\" it would enable the public-sites version \"for the over 1 billion users who have opted-in to Enhanced Safe Browsing.\" Chrome will not warn repeatedly about an insecure site a user visits regularly."},{"type":"paragraph","text":"As of October 2026, [Chromium Dash lists Chrome 154's stable date](https://chromiumdash.appspot.com/fetch_milestone_schedule?mstone=154) as September 22, 2026. Whether the default actually changed in that release was not confirmed on a primary Google page, so the accurate statement is that Google announced the plan. The warning, as described, applies to public sites only."},{"type":"paragraph","text":"The same 2025 post gives the current dated HTTPS figures, measured on public sites. On Windows, HTTPS rose from 95% to 98%. Android and Mac were over 99%. Linux went from 84% to nearly 97%. Those are the numbers to use, with their source and date. Undated claims that 10% or 14% of traffic still lacks HTTPS do not match Chrome's own figures."},{"type":"paragraph","text":"For visitors, the meaning is straightforward. A browser warning before a page loads is a reason to stop and check the address. What the change means for site owners is covered later in this guide."},{"type":"heading","level":2,"text":"Domain age, registration data and RDAP lookups"},{"type":"paragraph","text":"ICANN Lookup shows a domain's public registration data for free, and since 28 January 2025 that data comes through RDAP, which replaced WHOIS for generic domains. Use it to compare when a domain was created with how long the business claims to have existed."},{"type":"paragraph","text":"A registration lookup will rarely name the owner. Its value is the dates and the registrar, which either fit the story a site tells about itself or contradict it."},{"type":"heading","level":3,"text":"How to look up a domain with ICANN Lookup"},{"type":"paragraph","text":"The lookup takes under a minute."},{"type":"list","ordered":true,"items":["Open [ICANN Lookup](https://lookup.icann.org/en) in your browser.","Find the host using the right-to-left method above, then type only the registered name. For `www.example.com` or `login.example.com`, type `example.com`.","Run the search and read the record that comes back.","Note the registrar, the key dates (especially when the domain was created and when it expires) and the domain's status.","Compare those dates with what the site says about itself, such as \"serving clients since\" a given year."]},{"type":"paragraph","text":"The background matters because older guides still tell you to \"run a WHOIS.\" In its [January 27, 2025 announcement on launching RDAP and sunsetting WHOIS](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en), ICANN said that \"As of 28 January 2025, the Registration Data Access Protocol (RDAP) will be the definitive source for delivering generic top-level domain name (gTLD) registration information in place of sunsetted WHOIS services.\" RDAP \"has been offered by ICANN-accredited registrars and gTLDs since 2019.\" Non-public data can be requested through ICANN's Registration Data Request Service (RDRS) by people with a legitimate purpose. The announcement covers generic endings such as .com; for country-code endings, results may differ."},{"type":"heading","level":3,"text":"Why hidden owner details are normal now"},{"type":"paragraph","text":"A redacted owner name is the default, not a red flag. ICANN's [Registration Data Policy, in effect for registries and registrars since 21 August 2025](https://www.icann.org/en/announcements/details/icann-registration-data-policy-now-in-effect-for-contracted-parties-21-08-2025-en), provides \"a consistent framework for how domain name registration data is managed in line with privacy regulations.\" Most records you look up will hide the registrant's name and contact details, for honest businesses and scammers alike."},{"type":"paragraph","text":"Some checker tools still score hidden ownership as suspicious. Ignore that part of the score. What still matters is the information that remains visible: a creation date that contradicts the site's story, a status showing the domain is about to expire, or a registration made a few days before a wave of texts or emails pointing to it."},{"type":"heading","level":3,"text":"Domain age is a clue, not a verdict"},{"type":"paragraph","text":"No authoritative age threshold separates safe domains from scams. New businesses have new domains. So do new campaign sites, product launches and landing pages for a single case type. A young domain alone proves nothing."},{"type":"paragraph","text":"The useful test is consistency. A firm that claims 20 years in practice but whose only website was registered last month has some explaining to do. A legitimate firm in that position can usually show an older main site that links to the new one, under the same name, with the same people and the same phone number. If the only evidence of a long history is the new site's own claim, keep checking."},{"type":"paragraph","text":"This cuts both ways for site owners. A law firm launching [tort-specific landing pages built around trust signals](/services/web-design) on a new domain should link them from its main site and name the same attorneys, so visitors who run this lookup can confirm the connection instead of doubting it."},{"type":"heading","level":2,"text":"Free website legitimacy checkers compared"},{"type":"paragraph","text":"The most reliable free checks are the ones built into your browser and Google's Safe Browsing Site Status, backed up by a registration lookup and a scam-report search. Each checker sees only part of the picture, and a clean result usually means nobody has reported the site yet."},{"type":"table","header":["Check","What it looks at","Run by","Cost","Main limit"],"rows":[["Safe Browsing Site Status","Whether Google currently flags the site as unsafe","Google","Free","Only threats Google has found"],["Browser warnings","Visits checked against lists of dangerous or reported sites","Chrome, Safari, Edge","Free, built in","Can be turned off; Safari's is not available everywhere"],["Chrome \"About this page\"","What the web says about the source; when Google first indexed it","Google","Free","Information, not a verdict"],["ICANN Lookup","Domain registration data via RDAP","ICANN","Free","Owner details usually redacted"],["URLVoid","30+ blocklist and reputation engines","NoVirusThanks (site footer)","Free","Blocklists only; submissions shared with security companies"],["BBB Scam Tracker","Consumer scam reports by phone, website, email, name or ID","BBB","Free","Only what people have reported"],["Vendor scam checkers (Truecaller, HasTrust, ScamAdviser)","Varies by vendor","Each vendor","Free, per each vendor's page","Accuracy not independently verified"]]},{"type":"paragraph","text":"All of these were free as of October 2026; confirm features on each tool's own page, because they change. Run two or three checks together, not one, and treat the first serious warning as decisive."},{"type":"heading","level":3,"text":"Google Safe Browsing and your browser's built-in warnings"},{"type":"paragraph","text":"[Google Safe Browsing](https://safebrowsing.google.com/) says it \"helps protect over five billion devices every day\" and that \"Since 2006, Safe Browsing has warned users\" about dangerous sites. Its public [Site Status tool in the Google Transparency Report](https://transparencyreport.google.com/safe-browsing/search) lets you paste an address and see whether Google currently flags it. The same site links to a \"Report phishing\" form."},{"type":"paragraph","text":"In Chrome, [Chrome Help's Safe Browsing page](https://support.google.com/chrome/answer/9890866) lists three levels: Enhanced protection, Standard protection (\"on by default\") and No protection (\"not recommended\"). You change them under More > Settings > Privacy and security > Security. Enhanced protection also \"Warns you if you use a password that's been compromised in a data breach.\" When Chrome shows a full-page red warning, Chrome Help says the site has been flagged by Safe Browsing."},{"type":"paragraph","text":"Other browsers have their own lists. In Edge, [Microsoft Defender SmartScreen](https://support.microsoft.com/en-us/microsoft-edge/how-can-smartscreen-help-protect-me-in-microsoft-edge-1c9a874a-6826-be5e-45b1-67fa445a74c8) \"checks the sites you visit against a dynamic list of reported phishing and malicious software sites.\" Safari has a Fraudulent Website Warning, covered in the phone section below. Keep whichever protection your browser offers turned on."},{"type":"heading","level":3,"text":"Blocklist aggregators and scam-report sites"},{"type":"paragraph","text":"An aggregator asks many lists at once. [URLVoid](https://www.urlvoid.com/) says it analyzes a site \"through 30+ blocklist engines and online website reputation services,\" and its footer reads \"© 2010-2026 NoVirusThanks.\" In practice, a site listed by several engines is a stop sign. A site listed by none may simply be new."},{"type":"paragraph","text":"Vendor checkers describe themselves in their own terms. Truecaller's link checker claims to be \"Trusted by 500 million+ users.\" [HasTrust's scam checker](https://hastrust.com/scam-checker) says it accepts links, full messages, sender emails, IBANs, phone numbers and screenshots, and claims a screenshot is \"Read locally in your browser — the image never leaves your device.\" [ScamAdviser](https://www.scamadviser.com/) is another free scam-check site. None of these vendors' accuracy has been independently verified, so treat their results as one input."},{"type":"paragraph","text":"Mind what you paste. URLVoid states that \"Data submitted here is shared with security companies.\" Never paste a full message that contains your name, account number or other personal details into a checker unless its page explains how that data is handled. A vendor statement like HasTrust's local-screenshot claim is the kind of explanation to look for, though it remains the vendor's own claim."},{"type":"heading","level":3,"text":"BBB Scam Tracker and what accreditation means"},{"type":"paragraph","text":"[BBB Scam Tracker](https://www.bbb.org/scamtracker) invites visitors to \"Report a scam. Search scams.\" You can search by \"Phone number, website, email, business name or scam ID,\" and a heatmap shows reported scams across the US and Canada. Searching the phone number from a suspicious text often turns up reports that a website search misses."},{"type":"paragraph","text":"Accreditation is a separate thing. [BBB's Accreditation Standards](https://www.bbb.org/bbb-accreditation-standards) list eight standards, from \"Build trust\" and \"Advertise honestly\" to \"Safeguard privacy\" and \"Embody integrity.\" Applicants must have been actively selling \"for at least six months\" and must maintain \"at least a B rating,\" and \"BBB charges a fee for BBB Accreditation.\""},{"type":"paragraph","text":"Two conclusions follow. A missing accreditation is not a red flag, because many legitimate businesses never pay for it. A BBB badge that does not link to a live BBB profile is a red flag, because anyone can copy an image."},{"type":"heading","level":3,"text":"How to check a website on your phone"},{"type":"paragraph","text":"Phones hide more of the address, so the settings and the host-reading habit matter more. On iPhone, [Apple's iPhone User Guide](https://support.apple.com/guide/iphone/browse-the-web-securely-iphb01fc3c85/ios) says to \"Go to the Settings app on your iPhone. Tap Apps, then tap Safari,\" where turning on **Fraudulent Website Warning** means \"Safari displays a warning if you're visiting a suspected phishing website.\" Apple notes it is \"Not available in all countries or regions.\""},{"type":"paragraph","text":"If you use Chrome on an iPhone, remember that Google removed the lock icon there entirely in 2023. The host name in the address bar is your check. Chrome's Safe Browsing level is set on phones through the same Privacy and security settings described above; turn it on before you open links from texts."},{"type":"paragraph","text":"On any phone, zoom in on the address when it matters. Lookalike characters that are obvious on a laptop are easy to miss at small sizes."},{"type":"heading","level":3,"text":"What no checker can tell you"},{"type":"paragraph","text":"No checker can tell you whether a business will deliver what it promises, whether a person is licensed, or whether a settlement exists. Those answers live with the business's real-world records, the state bar and the court, not with a blocklist."},{"type":"paragraph","text":"New scam sites are often unreported at first. [wikiHow's guide to checking whether a website is legit](https://www.wikihow.com/Check-if-a-Website-Is-Legitimate) notes that a clean checker result may mean \"it just hasn't been reported yet.\" A green result is the absence of evidence, nothing more."},{"type":"paragraph","text":"The working rule: tools can confirm a stop sign. Only the identity and source checks, meaning the address, a phone you looked up yourself, a license and a court record, can confirm that a site is legitimate."},{"type":"heading","level":2,"text":"Red flags in reviews, contact pages and payments"},{"type":"paragraph","text":"The strongest red flags are ones a scammer cannot easily fake: reviews that look manufactured, contact details that lead nowhere, and requests to pay in ways that cannot be reversed. This section covers what to look for in each and what to do if you have already shared information."},{"type":"paragraph","text":"These checks need no tools. They rely on reading carefully and comparing what a site says with what you can find elsewhere."},{"type":"heading","level":3,"text":"Review patterns that suggest fake feedback"},{"type":"paragraph","text":"Manufactured reviews tend to share a few patterns. Watch for a burst of five-star reviews within a few days after a long silence. Watch for generic praise (\"great service, highly recommend\") with no detail about what the business actually did. The same wording appearing on different platforms is a warning sign, as are reviewers who have written only one review, ever. Reviews that describe a different business, a different city or a service the company does not offer suggest copied text. A business site that shows only glowing testimonials, with no link to an outside review platform, gives you nothing to verify."},{"type":"paragraph","text":"The rules are on your side. The FTC's [rule on consumer reviews and testimonials, 16 CFR Part 465](https://www.federalregister.gov/documents/2024/08/22/2024-18519/trade-regulation-rule-on-the-use-of-consumer-reviews-and-testimonials), took effect October 21, 2024 and bans fake reviews. [Google Maps' content policy](https://support.google.com/contributionpolicy/answer/7400114) bans \"Reviews or ratings that have been paid for, directly or in kind.\" The details of both rules are covered later in this guide."},{"type":"heading","level":3,"text":"Contact details you can verify yourself"},{"type":"paragraph","text":"Real contact details are the hardest thing for a scam site to fake well. The [Stanford Web Credibility guidelines](https://credibility.stanford.edu/guidelines/index.html) recommend showing there is a real organization behind a site and note, \"The easiest way to do this is by listing a physical address.\" Google's [search quality rater guidelines](https://static.googleusercontent.com/media/guidelines.raterhub.com/en//searchqualityevaluatorguidelines.pdf) say that \"Contact information and customer service information are extremely important for websites that handle money, such as stores, banks, credit card companies.\""},{"type":"paragraph","text":"Verifiable means you can confirm it without the site's help:"},{"type":"list","ordered":false,"items":["A street address that appears on a map and in other directories. Google's [Business Profile guidelines](https://support.google.com/business/answer/3038177) state that \"P.O. boxes or mailboxes located at remote locations aren't acceptable.\"","A phone number that is answered with the business name.","An email address at the site's own domain rather than a free mailbox.","The same name, address and phone on the business's other profiles."]},{"type":"paragraph","text":"A contact form with no address and no phone is weak evidence. Call the number from a directory listing, not the one in the message that sent you there."},{"type":"heading","level":3,"text":"Social profiles that lead nowhere"},{"type":"paragraph","text":"Social icons are easy to add and easy to fake. Click them. Icons that link back to the home page, to nothing, or to a profile created last week are a warning sign. A profile with thousands of followers but no comments, shares or replies is another."},{"type":"paragraph","text":"Inflated numbers should raise suspicion rather than reassure you. Under [16 CFR 465.8 in the eCFR](https://www.ecfr.gov/current/title-16/part-465), it is illegal to sell, buy or procure \"fake indicators of social media influence,\" such as bot followers or views, for a commercial purpose."},{"type":"heading","level":3,"text":"Payment requests and pressure that signal a scam"},{"type":"paragraph","text":"The way a site asks you to pay is often the clearest signal. If you are deciding whether a store is legit to buy from, a site with no returns or refund policy, prices far below every other seller, or a checkout that accepts only irreversible payment deserves the full checks before you pay."},{"type":"paragraph","text":"Law enforcement and regulators have named the payment red flags. The FBI's [August 2025 IC3 public service announcement](https://www.ic3.gov/PSA/2025/PSA250813) warns about payment requested \"in cryptocurrency or prepaid gift cards\" and about scammers moving victims into WhatsApp group chats. The [State Bar of California](https://www.calbar.ca.gov/public/concerns-about-attorney/avoid-legal-services-fraud) tells consumers to be wary of anyone who wants payment \"in cash, wire money directly to them, or use an encrypted service like WhatsApp.\" A [June 2024 IC3 announcement](https://www.ic3.gov/PSA/2024/PSA240624) describes fake \"lawyers\" asking for \"a portion of initial fees up front\" and for \"back taxes and other fees\" before money is released, and states that \"Law enforcement does not charge victims a fee for investigating crimes.\""},{"type":"paragraph","text":"Pressure is the companion signal. Countdown timers, \"today only\" offers and threats that you will lose a claim if you do not act now are designed to stop you from checking. A legitimate business can wait a day while you verify it. A sensible rule: the less reversible the payment method, the more verification it needs first."},{"type":"heading","level":3,"text":"What to do if you already entered your details"},{"type":"paragraph","text":"Act quickly and in this order."},{"type":"list","ordered":true,"items":["Call your bank or card issuer using the number printed on your card, not a number from the site or message.","Change the password on that account and anywhere you reused it, and turn on two-step verification.","In Chrome, turn on Enhanced protection, which warns when you use a password exposed in a data breach.","Report the site to Google through Safe Browsing's \"Report phishing\" form, or in Edge through \"Settings and more > Help and feedback > Report unsafe website.\"","Report the scam to the FTC at [ReportFraud.ftc.gov](https://reportfraud.ftc.gov/) and to the FBI's Internet Crime Complaint Center at [ic3.gov](https://www.ic3.gov/PSA/2025/PSA250813)."]},{"type":"paragraph","text":"Expect a second approach. The FTC's [guidance on refund and recovery scams](https://consumer.ftc.gov/articles/refund-and-recovery-scams) says to \"Never pay upfront for a refund or help with a refund\" and warns that scammers \"buy lists of people who've paid scammers.\" Anyone who contacts you offering to recover your money for a fee, especially someone claiming to be a lawyer, should be checked with the methods in the next section, which covers how to verify a lawyer and spot a fake law firm."},{"type":"heading","level":2,"text":"Is this law firm legit? How to verify a lawyer"},{"type":"paragraph","text":"To verify a lawyer, look them up on the attorney search of the state bar or licensing agency where they say they practice, confirm the license is active, and contact them using the details the bar lists rather than the ones in the message you received. The State Bar of California gives exactly this advice in its guide to [avoiding legal services fraud](https://www.calbar.ca.gov/public/concerns-about-attorney/avoid-legal-services-fraud)."},{"type":"image","src":"/images/blog-content/website-credibility/05-is-this-lawyer-real.jpg","alt":"Decision tree for verifying a lawyer: state bar search, active license, calling the listed number, and payment red flags","caption":"Start at the state bar, not the firm's website. A request to pay by crypto, gift card or wire ends the process, per FBI and State Bar of California guidance."},{"type":"heading","level":3,"text":"Step 1: find the license on the state bar's website"},{"type":"paragraph","text":"Start with the official licensing body, and reach it by searching for the state bar's name yourself. Never use a link inside the message that asked you to trust the firm, because a fake firm can send you to a fake bar page as easily as to a fake firm page."},{"type":"paragraph","text":"California is a useful model. The State Bar of California says it licenses, regulates and disciplines [approximately 260,000 attorneys](https://www.calbar.ca.gov/public/concerns-about-attorney), and it tells the public to use its [Attorney Search](https://apps.calbar.ca.gov/attorney/LicenseeSearch/QuickSearch) to confirm a lawyer's credentials. Most states have a comparable lookup on the state bar's or licensing agency's official site, though the name of the tool and the details it shows vary by state."},{"type":"paragraph","text":"When you find the record, compare three things with what you were told:"},{"type":"list","ordered":false,"items":["**The exact name.** Scammers borrow real names, so a match alone proves little. A mismatch in spelling or middle initial is worth a second look.","**The license status.** You want an active license. Look for any note about suspension, inactive status or discipline.","**The address and phone on record.** Write them down. You will use them in Step 2."]},{"type":"heading","level":3,"text":"Step 2: contact the lawyer through details the bar lists"},{"type":"paragraph","text":"Call or email the lawyer using the contact information on the bar record, not the number in the text, letter or ad. The State Bar of California explains why: attorneys are required to keep their contact information with the bar up to date, and it advises the public to [contact them using the information on the State Bar website](https://www.calbar.ca.gov/public/concerns-about-attorney/avoid-legal-services-fraud). A scammer controls every phone number, email address and link in the message they sent. They do not control the bar's database."},{"type":"paragraph","text":"The call itself is simple:"},{"type":"list","ordered":true,"items":["Dial the number from the bar record.","Ask for the lawyer by name.","Ask whether they, or their firm, sent the message you received or are handling your matter."]},{"type":"paragraph","text":"If the bar record and the firm's website disagree on the address, phone number or firm name, treat it as a stop sign until the lawyer resolves it through the bar-listed channel."},{"type":"heading","level":3,"text":"Step 3: check the firm's footprint outside its website"},{"type":"paragraph","text":"A website is the one thing a scammer fully controls, so the evidence that matters lives elsewhere. Google's own guidance to its search quality raters says that [reputation research is especially important for detecting untrustworthy websites](https://static.googleusercontent.com/media/guidelines.raterhub.com/en//searchqualityevaluatorguidelines.pdf) and can expose scams and fraud. You can run the same kind of research in a few minutes."},{"type":"list","ordered":false,"items":["**The Google Business Profile.** Google's [Business Profile guidelines](https://support.google.com/business/answer/3038177) say a profile's name should reflect the business's real-world name as used on its storefront, website and stationery, that P.O. boxes or remote mailboxes aren't acceptable addresses, and that there should be only one profile per business. Individual practitioners, including lawyers, have separate rules. A firm profile with a mailbox address or a name stuffed with keywords deserves a closer look.","**The domain's registration date.** Look the firm's domain up on [ICANN Lookup](https://lookup.icann.org/en). A firm that claims 30 years of practice on a domain registered last month is not proof of fraud, since firms rebrand, but it is a question to ask.","**A plain search.** Search the firm's name and the lawyer's name, each with the word \"scam\" or \"complaint\", and read what comes back.","**Consistency.** The address and phone should match across the bar record, the website and the Business Profile."]},{"type":"paragraph","text":"Claimants also look at directory profiles such as Avvo, Martindale-Hubbell and Super Lawyers. Treat them as one more source to cross-check, not as a license check."},{"type":"heading","level":3,"text":"Fake law firms and impersonated attorneys"},{"type":"paragraph","text":"Fake law firms are a documented, growing fraud type, and some impersonate real lawyers by name. In a June 2024 public service announcement, the FBI's Internet Crime Complaint Center reported that between February 2023 and February 2024, cryptocurrency scam victims who were further exploited by [fictitious law firms reported losses totaling over $9.9 million](https://www.ic3.gov/PSA/2024/PSA240624). The \"lawyers\" claimed to work with the FBI, the CFPB or another agency, asked victims to verify their identity with personal or banking details, and demanded part of the fees up front plus \"back taxes and other fees.\" The FBI added that some victims contacted the fraudsters through fake websites \"which appear legitimate.\""},{"type":"paragraph","text":"An [August 2025 FBI update](https://www.ic3.gov/PSA/2025/PSA250813) went further. It listed the impersonation of actual lawyers and legitimate law firms, and fake documents bearing a real firm's insignia or letterhead, as red flags. It also named the reputational harm done to the real lawyers whose names are used. The State Bar of California warns that AI and deepfakes now make it easier for bad actors to reach victims through deceptive websites, social media, texts and emails, and that crime rings sometimes impersonate an actual lawyer or firm, take payment for \"legal services\" and disappear ([State Bar of California](https://www.calbar.ca.gov/public/concerns-about-attorney/avoid-legal-services-fraud))."},{"type":"paragraph","text":"The table pulls the published red flags together, with what a licensed firm does instead."},{"type":"table","header":["Red flag","Source","What a licensed firm does instead"],"rows":[["Claims to partner with the FBI, CFPB or another agency","IC3 2024, 2025","Nothing: no law firm is an authorized government partner"],["Wants fees up front or \"back taxes\" before money is released","IC3 2024","Puts fee terms in a written agreement you review first"],["Asks for crypto, gift cards, cash or wire","IC3 2025, State Bar of California","Uses traceable payment methods"],["Moves you to WhatsApp or another encrypted chat","IC3 2025, State Bar of California","Talks through channels tied to its listed details"],["Won't show a license or appear on video","IC3 2025","Gives a name and license you can check with the bar"],["Cites agencies you can't find, such as the \"INTFTC\"","IC3 2025","Names real courts and agencies you can verify"]]},{"type":"heading","level":3,"text":"Recovery scams: when a \"law firm\" finds you first"},{"type":"paragraph","text":"A recovery scam targets people who have already lost money, and it often arrives dressed as a law firm. The FTC's guide to [refund and recovery scams](https://consumer.ftc.gov/articles/refund-and-recovery-scams) explains that scammers buy lists of people who have paid scammers before, that a recovery scammer may claim to be from a law firm and ask for a retainer fee, and that government agencies and legitimate organizations will never ask for money to help you get a refund. Its core advice is short: never pay upfront for a refund or for help getting one."},{"type":"paragraph","text":"The pattern to watch is a sequence of three events:"},{"type":"list","ordered":true,"items":["You lose money to a scam, an investment, a fake store or a fraudulent charge.","Someone contacts you without being asked, and they already know about the loss.","They ask for a fee, a \"retainer\", taxes or identity documents before anything is recovered."]},{"type":"paragraph","text":"When all three line up, stop and verify through the bar search before you reply."},{"type":"paragraph","text":"If you have already paid or shared details, report it. The FBI asks victims to contact their local FBI field office and to file a complaint with the Internet Crime Complaint Center at [ic3.gov](https://www.ic3.gov/PSA/2025/PSA250813)."},{"type":"heading","level":3,"text":"Questions to ask before you sign anything"},{"type":"paragraph","text":"These eight questions are a practical screen you can copy and use on any call with a firm, especially one that contacted you first. They are not legal advice, and a good answer to each does not make a firm right for your case. A bad or evasive answer, though, is often enough to walk away."},{"type":"list","ordered":true,"items":["What is your full name, and in which state are you licensed? (Then check the bar's search yourself.)","Who at the firm will handle my matter day to day, and how do I reach them?","How did you get my contact information?","How are you paid, and will I ever owe anything before my case resolves? Can I read the fee agreement before I sign?","If this is a settlement or lawsuit, which court is it in, and what is the case number?","Will you ever ask me to pay by crypto, gift card, cash or wire? (The answer should be no, per the [FBI](https://www.ic3.gov/PSA/2025/PSA250813) and the State Bar of California.)","Can we meet on video, and can you show me your license? (The FBI's 2025 PSA says that if this cannot be readily provided, assume they are not legitimate.)","What happens after I sign, and when will I next hear from you?"]},{"type":"paragraph","text":"A legitimate firm answers all eight without pressure."},{"type":"heading","level":2,"text":"Is this settlement or class action legit?"},{"type":"paragraph","text":"A real class action settlement is approved by a court, has a case name and number you can look up, and sends a notice that explains the class, the claims and your right to opt out. If anyone asks you to pay to file a claim or to release your money, treat it as a scam until proven otherwise."},{"type":"heading","level":3,"text":"What a real class action notice must tell you"},{"type":"paragraph","text":"In federal court, the notice for the most common type of money-damages class action is directed by the judge, and its contents are set by rule. Under [Federal Rule of Civil Procedure 23(c)(2)(B)](https://www.law.cornell.edu/rules/frcp/rule_23), the court must direct to class members \"the best notice that is practicable\", sent by United States mail, electronic means or other appropriate means. The notice must state, in plain, easily understood language:"},{"type":"list","ordered":false,"items":["the nature of the action;","the definition of the class certified;","the class claims, issues or defenses;","that a class member may enter an appearance through an attorney if the member so desires;","that the court will exclude from the class any member who requests exclusion;","the time and manner for requesting exclusion;","the binding effect of a class judgment on members."]},{"type":"paragraph","text":"A real notice tells you how to opt out and by when; a message that only says \"claim your money\" is missing what the rule requires. And because the court directs the notice, its wording and the claim site address it prints can be checked against the court record."},{"type":"paragraph","text":"This is the federal rule; state-court class actions follow their own rules, so treat the list as a guide rather than a strict test."},{"type":"heading","level":3,"text":"Court approval, case numbers and official claim sites"},{"type":"paragraph","text":"A class settlement is not final until a judge approves it. [Rule 23(e)](https://www.law.cornell.edu/rules/frcp/rule_23) says class claims may be settled, voluntarily dismissed or compromised only with the court's approval, and that the court may approve a binding settlement only after a hearing and only on finding that it is \"fair, reasonable, and adequate.\" Every real settlement therefore has a court, a case name, a case number and an approval process you can trace."},{"type":"paragraph","text":"To verify one:"},{"type":"list","ordered":true,"items":["Find the case name and number in the notice.","Look the case up on the court's own website or docket, reached by searching for the court yourself.","Reach the claim site by typing the web address printed in the notice. Do not click a link in a text, an email or an ad.","Compare the host name in your browser's address bar with the address in the notice, letter for letter."]},{"type":"table","header":["What to confirm","Where to confirm it","Red flag"],"rows":[["Case name and number","The notice, then the court's own records","No case number, or the court has no such case"],["Court approval","The court's approval order","A \"settlement\" with no court mentioned"],["Notice contents","The required items in Rule 23(c)(2)(B)","No way to opt out or object"],["Official claim site","The address printed in the notice; type it yourself","A lookalike host, or a site reached from an ad or text"],["Cost to file","Official warnings say you don't pay","Any fee to file, process or release payment"],["Who contacts you","Mail, email or other notice the court directed","Unsolicited calls asking for bank or card details"]]},{"type":"heading","level":3,"text":"Mass torts and MDLs work differently from class actions"},{"type":"paragraph","text":"Many injury and product cases are not class actions at all. They are mass torts, where each claimant files an individual case. When many such cases share common questions of fact, federal law lets them be combined for part of the process. Under [28 U.S.C. § 1407](https://www.law.cornell.edu/uscode/text/28/1407), civil actions pending in different districts that involve one or more common questions of fact may be transferred to one district for coordinated or consolidated pretrial proceedings. The Judicial Panel on Multidistrict Litigation makes those transfers, and each action is sent back to its original court at or before the end of pretrial proceedings unless it has already ended."},{"type":"paragraph","text":"The practical point for a claimant is that each person keeps an individual case, usually with their own lawyer. There is often no class notice to check, and no single claim website for the public. Verification therefore falls on two things: the lawyer, whom you check through the bar search above, and the multidistrict litigation itself, which is a public proceeding with a court and a docket."},{"type":"paragraph","text":"For background, this guide explains [how mass tort settlements actually pay claimants](/resources/mass-tort-settlement-guide). Payment in a mass tort normally runs through the claimant's own attorney, not through a stranger's website."},{"type":"heading","level":3,"text":"Fake settlement and claim websites"},{"type":"paragraph","text":"Scammers copy the names of real, well-publicized settlements, so a familiar case name is not evidence that a site is genuine. Two reported examples show the pattern."},{"type":"paragraph","text":"In 2019, News4Jax [reported that the FTC warned consumers about fake websites](https://www.news4jax.com/consumer/2019/07/30/ftc-beware-of-fake-equifax-settlement-websites/) resembling the official Equifax data breach settlement claims site, quoting the FTC: \"consumers will never have to pay to file a claim for these benefits.\" The lookalike sites traded on a settlement that had been in the news for weeks."},{"type":"paragraph","text":"In January 2024, the Military Officers Association of America, republishing Military Times, [reported a Navy and Department of Justice fraud alert](https://www.moaa.org/content/publications-and-media/news-articles/2024-news-articles/health-care-and-earned-benefits/navy-issues-fraud-alert-for-camp-lejeune-contamination-claims/) for Camp Lejeune Justice Act claimants. According to that report, the government \"will never request money or payment from a filer\", and filers who have a lawyer are contacted only through their attorney. For background on the case itself, see this overview of [the Camp Lejeune water contamination litigation](/blogs/camp-lejeune-water-contamination-lawsuit); check any current deadline or status on an official government page, not on a site you reached from an ad."},{"type":"heading","level":3,"text":"The rule that catches most fakes: you don't pay to claim"},{"type":"paragraph","text":"One rule catches most settlement and recovery fakes: legitimate claim processes do not charge you to file a claim or to release money you are owed. The official warnings line up on this point. The FTC says legitimate organizations will never ask for money to help you get a refund ([FTC](https://consumer.ftc.gov/articles/refund-and-recovery-scams)). The FTC's Equifax warning, as reported, said consumers would never have to pay to file a claim. The Camp Lejeune alert, as reported, said the government will never request payment from a filer. And the FBI notes that [law enforcement does not charge victims a fee](https://www.ic3.gov/PSA/2024/PSA240624) for investigating crimes."},{"type":"paragraph","text":"The scam's logic explains why the rule works. An upfront \"processing\", \"filing\", \"tax\" or \"release\" fee is the scammer's entire profit. The promised payout never existed, so the fee is the only money that moves."},{"type":"paragraph","text":"This is different from a lawyer's fee agreement. A lawyer you hire will explain in writing how they are paid, and you can read it, ask questions, take time, and sign or decline. What separates the two is transparency and timing: a real agreement is a document you review before you commit, while a scam fee is a demand that stands between you and money you are told is already yours."},{"type":"heading","level":2,"text":"Why claimants doubt mass tort and injury ads"},{"type":"paragraph","text":"Claimants have heard so much about scams that an ad promising compensation can sound like one. In 2025 the FTC received [3 million fraud reports with $15.9 billion in reported losses](https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-testifies-joint-economic-committee-agencys-efforts-combat-fraud), and a mass tort ad reaches the same public that scammers target."},{"type":"heading","level":3,"text":"The fraud numbers behind claimant skepticism"},{"type":"paragraph","text":"The scale of reported fraud in the US is large and rising, which is why a cautious reader treats unexpected offers of money as suspect. The dated figures:"},{"type":"list","ordered":false,"items":["**FTC, 2025.** The FTC received 3 million fraud reports from consumers, who reported $15.9 billion in losses. That included more than 1 million reports about imposter scams, with more than $3.5 billion lost, and investment scams caused the largest losses at $7.9 billion ([FTC, March 25, 2026](https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-testifies-joint-economic-committee-agencys-efforts-combat-fraud)).","**FBI IC3, 2025.** The [IC3 2025 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) counted 1,008,597 complaints and $20.877 billion in reported losses, a 26% increase in losses from 2024, with an average loss of $20,699 and almost 3,000 complaints per day.","**The trend.** IC3's reported losses rose from $12.5 billion in 2023 to $16.6 billion in 2024 and $20.877 billion in 2025.","**The most common types.** Phishing and spoofing was the most reported crime type, with 191,561 complaints. Government impersonation drew 32,424 complaints and $797,943,193 in losses.","**Older adults.** People aged 60 and over filed 201,266 complaints with $7.7 billion in losses."]},{"type":"paragraph","text":"The two agencies count differently: the FTC tallies consumer reports, and IC3 tallies complaints filed with the FBI. Some people report to both, so the figures should not be added together."},{"type":"paragraph","text":"Why this matters for ads is reasoned rather than measured. Mass tort and injury campaigns often reach the same public these reports describe, including adults over 60, and many of those people have been warned, by family, banks and the news, that an unexpected offer of money is how scams begin."},{"type":"heading","level":3,"text":"How a compensation ad reads to someone scammed before"},{"type":"paragraph","text":"A person who has lost money once has probably already heard \"you may be entitled to compensation\" from a scammer. Recovery scammers buy lists of past victims ([FTC](https://consumer.ftc.gov/articles/refund-and-recovery-scams)), and fictitious law firms present themselves as the way back to lost money ([FBI](https://www.ic3.gov/PSA/2024/PSA240624)). To that reader, a legitimate injury ad and a recovery scam can open with almost the same sentence."},{"type":"paragraph","text":"The cues that push a legitimate ad toward \"scam\" in a skeptical reader's mind are familiar:"},{"type":"list","ordered":false,"items":["no firm name, or a generic brand such as a \"claims center\" or \"settlement helpline\";","a phone number with no attorney attached to it;","\"free money\" or \"cash payout\" language instead of a description of the case;","urgency with no explanation, such as \"only 24 hours left\";","a form that asks for health, financial or identity details before saying who will see them."]},{"type":"paragraph","text":"The reverse is just as concrete. A skeptic relaxes when they can verify quickly: a named firm they can search, a named lawyer they can find on the bar's site, a phone number that matches the bar record and the firm's Business Profile, a plain description of the litigation, and no request for money."},{"type":"heading","level":3,"text":"What reassures a claimant before the first call"},{"type":"paragraph","text":"Claimants are reassured by things they can check, placed where they will see them before they call or submit a form. Mass Tort Marketing Agency builds landing pages and runs intake for plaintiff firms, and this is the order it uses on campaign pages:"},{"type":"list","ordered":true,"items":["**The firm's real name and the responsible attorney** on the ad and on the page. Most of the profession already requires the name piece: the ABA's [comment to Model Rule 7.2](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_7_2_advertising/comment_on_rule_7_2/) says any communication about a lawyer's services must include the name of, and contact information for, the lawyer or firm, and New York's amended Rule 7.1(d) requires the [name and contact information of at least one lawyer or law firm](https://nysba.org/wp-content/uploads/2026/08/NYSBA-NY-Rules-of-Professional-Conduct-August-10-2026.pdf) responsible for the content.","**A license the visitor can look up,** with the state named, so the bar search takes seconds.","**A plain statement of what happens after they submit,** including who will call, from what kind of number, and roughly when.","**A privacy note next to the fields** that ask for health or contact details, saying who sees the information and why.","**No request for payment of any kind,** and fee terms stated only as the firm's actual agreement states them.","**The same name, number and attorney** on the ad, the page, the call and the retainer."]},{"type":"paragraph","text":"Item 6 is where many campaigns break. A claimant who clicks an ad for one name, lands on a page with a second name and gets a call from a third has just watched the pattern every scam warning describes. For the operational side, see [how to screen and sign claimants at scale](/blogs/mass-tort-intake-guide)."},{"type":"heading","level":3,"text":"Why trust shows up in cost per signed retainer"},{"type":"paragraph","text":"Distrust rarely shows up as a complaint. It shows up as forms abandoned halfway, callbacks that go unanswered, hang-ups when the intake specialist asks for date of birth or medical history, and retainers sent but never signed."},{"type":"paragraph","text":"The result is that the cost of each signed case rises even when the cost per lead looks normal. Our [cost per signed retainer benchmarks](/blogs/cost-per-signed-retainer-2026) explain how firms measure that funnel end to end."},{"type":"paragraph","text":"The fixes are usually the visible, checkable details from the list above, plus a first call that behaves the way a real firm behaves. The intake and scorecard sections below show how to audit your own pages and measure whether visitors trust them."},{"type":"heading","level":2,"text":"How to vet a legal marketing vendor's legitimacy"},{"type":"paragraph","text":"A firm buying marketing or leads should run the same legitimacy checks on the vendor that claimants run on the firm, plus one more: whether the arrangement fits the attorney advertising rules. Under ABA Model Rule 7.2 a lawyer may pay for advertising and for lead generation, but not for a recommendation."},{"type":"heading","level":3,"text":"What the ABA Model Rules let a firm pay for"},{"type":"paragraph","text":"The ABA's comments to Model Rule 7.2 draw a clear line between paying for marketing, which is allowed, and paying for recommendations, which is not. [Comment [3]](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_7_2_advertising/comment_on_rule_7_2/) says lawyers may pay for on-line directory listings, domain-name registrations, sponsorship fees and Internet-based advertisements, and may compensate vendors engaged to provide marketing or client development services, including website designers."},{"type":"paragraph","text":"Comment [5] covers lead generation directly. It says: \"A lawyer may pay others for generating client leads, such as Internet-based client leads, as long as the lead generator does not recommend the lawyer, any payment to the lead generator is consistent with Rules 1.5(e) (division of fees) and 5.4 (professional independence of the lawyer), and the lead generator's communications are consistent with Rule 7.1.\" It adds that a lawyer must not pay a lead generator that implies it has analyzed a person's legal problems when deciding which lawyer gets the referral, and it points to Rules 5.3 and 8.4(a)."},{"type":"paragraph","text":"The rule itself, [Model Rule 7.2(b)](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_7_2_advertising/), says a lawyer shall not compensate, give or promise anything of value to a person for recommending the lawyer's services, with exceptions that include the reasonable costs of permitted advertisements, legal service plan or qualified lawyer-referral charges, the purchase of a law practice, non-exclusive reciprocal referral agreements and nominal gifts."},{"type":"paragraph","text":"And every communication the vendor makes is measured against [Model Rule 7.1](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_7_1_communication_concerning_a_lawyer_s_services/): \"A lawyer shall not make a false or misleading communication about the lawyer or the lawyer's services. A communication is false or misleading if it contains a material misrepresentation of fact or law, or omits a fact necessary to make the statement considered as a whole not materially misleading.\""},{"type":"paragraph","text":"States adopt their own versions of these rules, and some differ in ways that matter, so confirm your arrangement with your state bar or ethics counsel. This is not legal advice."},{"type":"heading","level":3,"text":"Run the 12 checks on the vendor's own website"},{"type":"paragraph","text":"Apply the same legitimacy test to the vendor that a claimant applies to a firm. Specifically:"},{"type":"list","ordered":false,"items":["**Real host and HTTPS.** The domain in the address bar should match the company's name, with no lookalike spelling.","**Registration date against claimed history.** Look the domain up on [ICANN Lookup](https://lookup.icann.org/en). A vendor that claims a decade in mass torts on a domain registered this year has something to explain.","**A street address** you can find on a map, not just a contact form.","**Named people** with roles, whose profiles exist outside the vendor's own site.","**Case studies you can verify,** with enough detail, such as the tort, the period and the measure, to ask follow-up questions.","**Reviews that link to independent platforms** rather than quotes on the vendor's own pages.","**Policies that name the company,** including a privacy policy and terms that identify the legal entity."]},{"type":"paragraph","text":"A vendor that hides who runs it is asking the firm to put its license behind people it cannot identify. That is a poor trade at any price."},{"type":"paragraph","text":"The same tests apply to us. Mass Tort Marketing Agency publishes [the people behind our campaigns](/team), [case studies](/case-studies) and [how we qualify and price leads](/process), and firms should check them the same way."},{"type":"heading","level":3,"text":"Questions that separate real vendors from resellers"},{"type":"paragraph","text":"The questions below are the ones I recommend asking any marketing agency or lead vendor before a contract. Real vendors answer them in writing. Resellers, who buy traffic or leads from someone else and pass them on, often cannot."},{"type":"list","ordered":true,"items":["**Where do the leads come from?** Ask whether they come from the vendor's own media and landing pages or from resold traffic, and get the answer in the contract.","**Can I see the exact landing page, ad and consent language each lead saw?** You need this to judge whether the communication fits Rule 7.1 and your state's rules.","**Does the consent language name my firm?** This is good practice for clean, defensible consent, even though the FCC's one-to-one consent rule [was vacated by the 11th Circuit on January 24, 2025](https://media.ca11.uscourts.gov/opinions/pub/files/202410277.pdf) and is not a current requirement.","**Are the leads exclusive to my firm?** If not, ask how many firms receive each one.","**What are the return window and disqualification criteria?** Get both in writing, with the exact reasons a lead can be returned.","**How and how often are dispositions reported?** You want a regular, field-level report of what happened to each lead.","**What data fields are delivered, and how are call recordings kept?** Ask about retention, access and who owns the records."]},{"type":"paragraph","text":"For a longer list, see [21 questions to ask before you hire a mass tort marketing agency](/blogs/questions-to-ask-mass-tort-marketing-agency), and for the structural difference between the two models, [how an agency differs from a lead vendor](/mass-tort-marketing-vs-legal-lead-vendors)."},{"type":"heading","level":3,"text":"Red flags in lead-generation offers"},{"type":"paragraph","text":"Some offers fail the rules before you ever see a lead. Watch for these:"},{"type":"list","ordered":false,"items":["**Ads that \"recommend\" a lawyer** or imply someone analyzed the person's case to pick the right firm. Comment [5] to Rule 7.2 bars paying a lead generator whose communications do that ([ABA comment](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_7_2_advertising/comment_on_rule_7_2/)).","**Guaranteed signed cases or settlement values** in the vendor's consumer-facing ads. Promises like these can make the communication misleading under Rule 7.1, and the firm answers for it.","**Fake or bought reviews of the vendor,** or an \"independent\" review site the vendor controls. The FTC's rule at [16 CFR Part 465](https://www.ecfr.gov/current/title-16/part-465) bars writing, selling or buying fake reviews and testimonials (465.2) and misrepresenting that a site the business controls provides independent reviews or opinions (465.6).","**No access to the source pages or consent records.** If you cannot see what the claimant saw, you cannot defend it.","**No named people or physical address** anywhere on the vendor's site or contract.","**A recently registered domain** from a vendor claiming long experience, checked on ICANN Lookup."]},{"type":"paragraph","text":"Checking leads does not stop once the contract is signed. [Lead verification and claimant screening](/services/mass-tort-lead-verification) is the step that confirms each lead after it arrives, so problems surface before intake spends time on them."},{"type":"paragraph","text":"Everything so far has been the visitor's side of the screen. The rest of this guide turns those same checks into requirements for a law firm's own website."},{"type":"heading","level":2,"text":"What makes a law firm website credible: 9 elements"},{"type":"paragraph","text":"A credible law firm website makes every check a visitor might run easy to pass: a domain that matches the firm, a connection that is always secure, real people with licenses anyone can check, reviews that are genuine, and copy that is accurate and current. The nine elements below follow the structure of rankings.io's widely read list, rebuilt with primary sources and the rules that apply to lawyers."},{"type":"image","src":"/images/blog-content/website-credibility/06-credible-law-firm-homepage.jpg","alt":"Annotated wireframe of a generic law firm homepage marking nine credibility elements, from the domain to named attorneys","caption":"The nine elements on one generic homepage. Each callout answers a check that a skeptical visitor runs."},{"type":"paragraph","text":"The list keeps the nine headings from [rankings.io's \"The 9 Elements of a Trustworthy Website\"](https://rankings.io/blog/9-elements-of-a-trustworthy-website/) by Chris Dreyer, shown as dated May 22, 2025. It departs from that post in four places. That post says the \"S\" in HTTPS indicates \"that it's safe to enter personal and financial data\"; this list does not treat HTTPS as proof of safety. That post suggests a certificate \"for a few dollars per month\"; this list notes that certificates are available free. It names two legacy seal brands; this list names none. And it calls an advertorial \"basically an ad disguised as copy\"; this list treats that format as something a law firm should avoid."},{"type":"heading","level":3,"text":"1. A domain name that matches the firm"},{"type":"paragraph","text":"For a lawyer, the domain is not only a technical address. It is a communication about the firm. The [New York Rules of Professional Conduct](https://nysba.org/wp-content/uploads/2026/08/NYSBA-NY-Rules-of-Professional-Conduct-August-10-2026.pdf), Rule 7.1, Comment [5], says a firm's \"name, trade name, domain name, web site, social media pages, office sign, business cards, letterhead, and professional designations are communications concerning a lawyer's services and must not be false, deceptive, or misleading.\" Other states phrase it differently, but the principle travels: the address itself can mislead."},{"type":"paragraph","text":"Practical rules I recommend:"},{"type":"list","ordered":false,"items":["Use the firm's real name or a close, readable form of it. A claimant who sees the firm's name on a TV ad should be able to guess the domain.","Avoid domains that imply something the firm is not: an agency, a court, a \"claims center\", a settlement administrator or a government program.","Register the obvious misspellings and the other common endings, and redirect them to the main site. Lookalike domains are how impersonators work, and [Google's Search Quality Rater Guidelines](https://static.googleusercontent.com/media/guidelines.raterhub.com/en//searchqualityevaluatorguidelines.pdf) list a \"URL that mimics another site's name\" as deceptive.","Keep one primary domain. If a campaign needs its own landing site, link it from the main site and name the firm on every page so a visitor can trace it back."]},{"type":"paragraph","text":"A domain like `smithinjurylaw.example.com` passes the test because it says who runs it. A domain like `national-claims-center.example.net` fails it for a firm, because it hides the firm behind a name that sounds official. For the full build process, see [how to plan and build a law firm website](/blogs/law-firm-website-development)."},{"type":"heading","level":3,"text":"2. HTTPS that renews itself before it expires"},{"type":"paragraph","text":"Browsers label plain HTTP pages \"Not secure\", and Google has announced that Chrome will ask before loading public HTTP sites (the HTTPS section earlier in this guide covers that history). So HTTPS is a baseline. Three common claims about it are wrong, though, and they matter when you brief a developer or evaluate a vendor."},{"type":"paragraph","text":"First, HTTPS is not proof of safety. Chrome's security team wrote in its [2023 post on the lock icon](https://blog.chromium.org/2023/05/an-update-on-lock-icon.html) that \"nearly all phishing sites use HTTPS\" and that the lock \"does not indicate website trustworthiness.\" Second, it is not a major ranking lever. When Google announced it in 2014, it called HTTPS [\"only a very lightweight signal—affecting fewer than 1% of global queries\"](https://developers.google.com/search/blog/2014/08/https-as-ranking-signal), carrying less weight than content quality. Third, certificates need not cost anything. [Let's Encrypt](https://letsencrypt.org/about/) says \"Anyone who owns a domain name can use Let's Encrypt to obtain a trusted certificate at zero cost,\" and its [FAQ](https://letsencrypt.org/docs/faq/) notes that hosting companies that integrate it may \"charge a nominal fee.\""},{"type":"paragraph","text":"What changed in 2026 is certificate lifetime. The CA/Browser Forum passed [Ballot SC-081v3](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/) with 25 certificate issuers voting yes, none voting no and five abstaining, and all four certificate consumers (Apple, Google, Microsoft and Mozilla) voting yes. The [TLS Baseline Requirements](https://github.com/cabforum/servercert/blob/main/docs/BR.md), section 6.3.2, now set this schedule:"},{"type":"table","header":["Issued on or after","Issued before","Maximum validity"],"rows":[["(earlier)","March 15, 2026","398 days"],["March 15, 2026","March 15, 2027","200 days"],["March 15, 2027","March 15, 2029","100 days"],["March 15, 2029","(no end date)","47 days"]]},{"type":"paragraph","text":"The same dates cut how long a certificate authority may reuse proof that you control the domain: 200 days, then 100, then 10 days from March 15, 2029."},{"type":"paragraph","text":"Let's Encrypt is moving faster than the ceiling. Its [December 2, 2025 announcement](https://letsencrypt.org/2025/12/02/from-90-to-45) set May 13, 2026 for its opt-in `tlsserver` profile to move to 45-day certificates, February 10, 2027 for the default `classic` profile to move to 64 days, and February 16, 2028 for `classic` to reach 45 days. Its own advice: \"Manually renewing certificates is not recommended.\""},{"type":"paragraph","text":"The conclusion for a firm is simple. Automate renewal through your host or your certificate tooling, set up an alert that warns someone well before expiry, and check that every subdomain (intake forms, landing pages, client portals) is covered. When every subdomain serves HTTPS, send the `Strict-Transport-Security` header defined in [RFC 6797](https://www.rfc-editor.org/rfc/rfc6797), which lets a site declare it is \"accessible only via secure connections.\" An expired certificate replaces your homepage with a browser security warning, which is about the worst first impression a claimant can get."},{"type":"heading","level":3,"text":"3. Professional design that survives the first glance"},{"type":"paragraph","text":"Design is the first thing people react to, though not the thing experts weigh most. In the 2002 [Stanford and Consumer WebWatch study](https://advocacy.consumerreports.org/wp-content/uploads/2013/05/stanfordPTL.pdf), \"design look\" came up in 46.1% of participants' credibility comments, and in 54.6% of comments on finance sites. The same report found that experts in a field were \"far less concerned about the surface aspects\" and more focused on the \"breadth, depth, and quality of a site's information.\" [Google Research](https://research.google/blog/users-love-simple-and-familiar-designs-why-websites-need-to-make-a-great-first-impression/) found aesthetic judgments form in 17 to 50 milliseconds and that people prefer simple, familiar layouts."},{"type":"paragraph","text":"For a plaintiff firm, that means the design has one job in the first second: not giving a reason to leave. Concrete checks for the first screen on a phone:"},{"type":"list","ordered":false,"items":["The firm's name, what it handles and where it practices are visible without scrolling.","There is one obvious way to reach a person: a tap-to-call number or a short form.","Photos show the firm's real attorneys and office, not stock images of handshakes and gavels.","Body text is at least comfortably readable, with strong contrast against the background.","The logo stays sharp at small sizes and does not blur on high-density screens.","The header, menu and footer look and behave the same on every page.","Nothing moves, flashes or covers the content before the visitor has read a line."]},{"type":"paragraph","text":"rankings.io's checklist of text, logo, header, footer and menu is a good start; the version above turns each item into something you can confirm on a phone in under a minute. For real-world references, see [examples of law firm websites that get the first screen right](/blogs/best-law-firm-websites) and [landing pages designed for claimant trust](/services/web-design)."},{"type":"heading","level":3,"text":"4. Reviews and testimonials that are real and permitted"},{"type":"paragraph","text":"Reviews carry the most weight where the firm cannot edit them. That means the firm's Google Business Profile and other independent platforms first, with excerpts on the website that link to the source so a visitor can confirm each one is real and in context."},{"type":"paragraph","text":"What to do, in practice:"},{"type":"list","ordered":false,"items":["Ask every client for an honest review, the same way, at the same point in the matter. Google's [policy on fake engagement](https://support.google.com/contributionpolicy/answer/7400114) forbids businesses to \"selectively solicit positive reviews from customers,\" so the request cannot go only to happy clients.","Offer nothing in exchange: no gift cards, discounts or raffle entries.","Never write, edit, buy or ghost-draft a review, and do not have staff or relatives post them. The [FTC's rule at 16 CFR Part 465](https://www.ecfr.gov/current/title-16/part-465) covers all of these.","Never hide negative reviews while implying the page shows all of them."]},{"type":"paragraph","text":"Respond to reviews carefully. A reply that confirms someone was a client or discusses the case can expose client information, so check your state's ethics guidance before replying to a negative review, and keep replies general. The rules section below covers the FTC, Google and state bar requirements in detail."},{"type":"heading","level":3,"text":"5. Clean copy with no typos, broken links or stale pages"},{"type":"paragraph","text":"Small errors cost more than owners expect. The [Stanford Guidelines for Web Credibility](https://credibility.stanford.edu/guidelines/index.html) put it bluntly in guideline 10: \"Typographical errors and broken links hurt a site's credibility more than most people imagine.\" [Nielsen Norman Group](https://www.nngroup.com/articles/trustworthy-design/) reached the same view: \"Typos, broken links, and other mistakes quickly degrade credibility.\""},{"type":"paragraph","text":"For a firm, stale content is the bigger risk. A practice page about litigation that settled years ago, or a tort page still saying \"now accepting claims\" after the window closed, tells a claimant nobody is minding the site. Stanford's guideline 8 asks sites to \"Update your site's content often (at least show it's been reviewed recently).\" I recommend a dated \"Last reviewed\" line on every practice and tort page, a calendar reminder to re-check them, and a clear note or removal when a litigation has closed."},{"type":"paragraph","text":"A pre-publish checklist that catches most problems:"},{"type":"list","ordered":false,"items":["Run a spell-check, then have a person who did not write the page proofread it.","Click every link, including phone and email links, on desktop and phone.","Give every statistic a date and a source.","Match each attorney's name and admissions to the state bar record.","Show when the page was last reviewed."]},{"type":"paragraph","text":"Run a link crawler monthly as well, because links break after publication when other sites move. For a step-by-step method, see [finding and fixing broken links](/blogs/link-not-working)."},{"type":"heading","level":3,"text":"6. Citations to primary sources"},{"type":"paragraph","text":"Stanford's first guideline is \"Make it easy to verify the accuracy of the information on your site,\" and its commentary notes that links to evidence help \"even if people don't follow these links.\" NN/g lists \"connection to the rest of the web\" as one of its four trust factors. A cited claim signals that the firm is willing to be checked."},{"type":"paragraph","text":"For a plaintiff firm, cite the rule-maker rather than a summary of it:"},{"type":"list","ordered":false,"items":["the court order or the MDL docket, rather than a news homepage;","the statute or regulation itself, rather than another firm's blog post about it;","the agency recall, warning or safety communication, rather than a press article quoting it;","the study, rather than a marketing site that paraphrased it."]},{"type":"paragraph","text":"Put a date next to every number, because numbers in mass torts change. Case counts, settlement status and filing deadlines move monthly, and an undated figure is either wrong or about to be. A short \"Sources\" list at the bottom of long pages makes the practice visible. This guide follows the same approach in its sources section, with the date each source was checked."},{"type":"heading","level":3,"text":"7. Restraint with ads, pop-ups and chatbots"},{"type":"paragraph","text":"People notice ads and interruptions, and they rarely count in a site's favor. \"Advertising\" appeared in 13.8% of comments in the 2002 Stanford study. Stanford's guideline 9 reads: \"If you must have ads, clearly distinguish the sponsored content from your own. Avoid pop-up ads.\""},{"type":"paragraph","text":"On law firm sites the usual offenders are not banner ads. They are a full-screen pop-up that covers the page on arrival, a chat window that opens on its own and starts typing, an exit-intent overlay, and a countdown timer suggesting a claim deadline is minutes away. Each reads as pressure. A claimant already worried about being scammed takes pressure as a warning sign, so I recommend letting the page load clean, keeping the call and form options visible, and letting the visitor start the conversation."},{"type":"paragraph","text":"AI chat needs extra care. [ABA Formal Opinion 512](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (July 29, 2024) addresses lawyers' use of generative AI tools and cites a Florida Bar ethics opinion on AI chatbots under that state's advertising rule. My advice is to label any AI assistant plainly as automated, keep it to scheduling and general information, and route legal questions to a person. Sponsored content has the same problem in a different form, and it gets its own section below."},{"type":"heading","level":3,"text":"8. Social profiles that match the site"},{"type":"paragraph","text":"Claimants often check a firm's Facebook page, LinkedIn or YouTube channel before calling. Every profile should show the same firm name, logo, address, phone number and attorneys as the website. Google asks the same consistency of [Business Profile names](https://support.google.com/business/answer/3038177), which should match \"your business's real-world name, as used consistently on your storefront, website, stationery, and as known to customers.\""},{"type":"paragraph","text":"Link both ways: the site's footer to each active profile, and each profile back to the site. Remove icons for accounts the firm abandoned, because a link to a profile last updated years ago suggests a firm that may have closed. Being active on one or two platforms where your clients actually spend time beats empty profiles everywhere."},{"type":"paragraph","text":"Never buy followers, likes or views. The FTC rule at 16 CFR 465.8 bars buying or selling \"fake indicators of social media influence\" for a commercial purpose, and inflated numbers on a small firm's page are easy to spot anyway."},{"type":"heading","level":3,"text":"9. Real people with credentials anyone can check"},{"type":"paragraph","text":"rankings.io's \"be human\" element is right, and for a law firm it can be made verifiable. Google's rater guidelines treat \"AI generated content with made up 'author' profiles\" and false claims of credentials as deceptive. Google's [guidance on helpful content](https://developers.google.com/search/docs/fundamentals/creating-helpful-content) says it \"strongly encourage[s] adding accurate authorship information, such as bylines to content where readers might expect it.\""},{"type":"paragraph","text":"An attorney bio that a claimant can check should include:"},{"type":"list","ordered":false,"items":["the full name exactly as it appears in the state bar record;","every state of admission, so a reader can look each one up;","law school and year, plus any other education that matters to the practice;","a real, recent photo;","the case types the lawyer actually handles, in plain words."]},{"type":"paragraph","text":"Claims about skill and experience should be ones you can prove. Florida's rules treat a characterization of a lawyer's \"skills, experience, reputation, or record\" as inherently misleading \"unless the characterization is objectively verifiable\" (more on that below), and New York's Comment [5] covers professional designations. Every page and ad also needs a responsible lawyer's name and contact details: New York's amended Rule 7.1(d) requires \"the name and contact information of at least one lawyer or law firm responsible for its content,\" and the [comment to ABA Model Rule 7.2](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_7_2_advertising/comment_on_rule_7_2/) says contact information means \"a website address, a telephone number, an email address or a physical office location.\""},{"type":"heading","level":2,"text":"Reviews, testimonials and attorney advertising rules"},{"type":"paragraph","text":"Three sets of rules govern a law firm's reviews and testimonials: the FTC's 2024 rule on fake reviews, Google's stricter policy for reviews on Maps and Business Profiles, and each state's attorney advertising rules. A firm can follow all three by collecting only genuine reviews, offering nothing in exchange, showing them unfiltered and qualifying any statement about results."},{"type":"heading","level":3,"text":"The FTC rule on fake reviews and testimonials"},{"type":"paragraph","text":"The FTC's [Trade Regulation Rule on the Use of Consumer Reviews and Testimonials](https://www.federalregister.gov/documents/2024/08/22/2024-18519/trade-regulation-rule-on-the-use-of-consumer-reviews-and-testimonials) was published on August 22, 2024 and took effect October 21, 2024. The Commission voted 5-0, and its [announcement](https://www.ftc.gov/news-events/news/press-releases/2024/08/federal-trade-commission-announces-final-rule-banning-fake-reviews-testimonials) said the rule covers reviews by \"someone who does not exist, such as AI-generated fake reviews,\" and lets the agency \"seek civil penalties against knowing violators.\""},{"type":"paragraph","text":"In plain words, the rule bars a business from:"},{"type":"list","ordered":false,"items":["writing, creating or selling reviews that misrepresent who wrote them or their experience, or buying or posting ones it \"knew or should have known\" were fake (465.2);","getting such reviews from its \"officers, managers, employees, or agents, or any of their immediate relatives\" for third-party platforms (465.2(c));","offering compensation or incentives \"conditioned expressly or by implication on\" a review \"expressing a particular sentiment, whether positive or negative\" (465.4);","presenting a site it controls as one that \"provides independent reviews or opinions\" (465.6);","using \"unfounded or groundless legal threat[s]\" or intimidation to remove a review, or suppressing negative reviews while implying it shows \"most or all the reviews submitted\" (465.7);","buying or selling fake indicators of social media influence (465.8)."]},{"type":"paragraph","text":"As of October 2026, the [maximum civil penalty](https://www.ecfr.gov/current/title-16/section-1.98) is $53,088 per violation for penalties assessed after January 17, 2025, a figure adjusted for inflation. The rule applies to businesses generally, including law firms. It does not ban asking clients for reviews."},{"type":"heading","level":3,"text":"Google's review policy is stricter than the FTC's"},{"type":"paragraph","text":"The FTC bans incentives tied to positive or negative sentiment. Google bans incentives of any kind. Its fake-engagement policy says contributions \"should reflect a genuine experience,\" that reviews may not be \"paid for, directly or in kind,\" and that businesses may not offer \"incentives – such as payment, discounts, free goods and/or services – in exchange for posting any review.\" It also bars merchants from asking for specific content and from discouraging negative reviews or selectively asking only satisfied clients."},{"type":"paragraph","text":"What Google allows is narrow and clear: businesses may \"Solicit or encourage the posting of content that does represent a genuine experience, without offering incentives.\" The practical result for a firm: no gift cards, discounts or raffles for reviews of any sentiment on Google, and the same request goes to every client, including the one whose case did not go as hoped."},{"type":"table","header":["Rule","Who it binds","What it prohibits","Source"],"rows":[["16 CFR Part 465 (effective Oct 21, 2024)","Businesses, including law firms","Fake or AI reviews, sentiment-based incentives, controlled \"independent\" sites, suppression","FTC"],["Google Maps fake-engagement policy","Anyone posting or soliciting Google reviews","Any incentive, selective solicitation, discouraging negatives","Google"],["FTC Endorsement Guides (16 CFR Part 255)","Advertisers and endorsers","Undisclosed material connections","FTC"],["ABA Model Rule 7.1 and state versions","Lawyers","False or misleading communications","ABA, states"],["ABA Model Rule 7.2(b)","Lawyers","Giving anything of value for a recommendation","ABA"],["Florida Rule 4-7.13(b)(9)","Florida lawyers","Testimonials drafted by the lawyer, paid for, unrepresentative or lacking the disclaimer","Florida Bar"]]},{"type":"heading","level":3,"text":"Endorsements, paid promoters and disclosure"},{"type":"paragraph","text":"The FTC's Endorsement Guides, revised July 26, 2023, reach further than reviews. Under [16 CFR 255.5](https://www.ecfr.gov/current/title-16/section-255.5), a connection between an endorser and a seller that \"might materially affect the weight or credibility of the endorsement,\" and that the audience would not expect, \"must be disclosed clearly and conspicuously.\""},{"type":"paragraph","text":"For a firm, that covers referral partners who praise the firm, paid spokespeople in ads, influencer posts about the firm, and staff who promote it on their own accounts. Each needs a plain disclosure of the relationship placed where the audience will see it, not in a profile bio. Reviews from staff or their relatives on third-party platforms raise a separate problem under 465.2(c), and the simplest policy is that employees do not review their employer."},{"type":"heading","level":3,"text":"Testimonials and past results under state bar rules"},{"type":"paragraph","text":"Every state has a version of the core standard in [ABA Model Rule 7.1](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_7_1_communication_concerning_a_lawyer_s_services/): \"A lawyer shall not make a false or misleading communication about the lawyer or the lawyer's services.\" How states apply it to testimonials and results varies widely. Rules differ by state, and this guide reviewed only New York and Florida, so confirm your own obligations with your state bar or ethics counsel. Nothing here is legal advice."},{"type":"paragraph","text":"New York rewrote its rules effective June 1, 2026. According to [NYSBA commentary by Marjorie E. Gross](https://nysba.org/wp-content/uploads/2026/08/The-Amendments-to-the-Advertising-Rules.pdf), the state essentially adopted the ABA's 2018 advertising rules; the \"Attorney Advertising\" label requirement \"has been eliminated,\" and so has the mandatory \"Prior results do not guarantee a similar outcome\" statement, though she says lawyers may still want to use it. Every communication must now name a responsible lawyer or firm. Comment [3] warns that truthful results \"may be misleading if presented so as to lead a reasonable person to form an unjustified expectation,\" and that \"an appropriate disclaimer or qualifying language may preclude a finding\" of that."},{"type":"paragraph","text":"Florida is stricter. The [Rules Regulating The Florida Bar](https://www-media.floridabar.org/uploads/2026/10/2027_04-OCT-Chapter-4-RRTFB.pdf) say websites \"are treated the same as other advertising media.\" Rule 4-7.13(b)(9) treats testimonials as misleading when they are \"written or drafted by the lawyer,\" given for something of value, unrepresentative of what clients generally experience, or missing \"the disclaimer that the prospective client may not obtain the same or similar results.\" Past results must be \"objectively verifiable.\" Website content is exempt from filing for review under Rule 4-7.20(g), but the content rules still apply. For how this fits campaign compliance, see [attorney advertising and TCPA compliance standards](/mass-tort-marketing-compliance)."},{"type":"heading","level":3,"text":"Awards, badges and \"as seen on\" logos"},{"type":"paragraph","text":"A badge is a claim, and it should be treated like one. Show only awards the firm can document, describe each one accurately, and link each badge to its live verification page so a visitor can confirm it. Rating services describe their own methods, and a firm should repeat those descriptions as the service's claims. For example, [Super Lawyers says](https://www.superlawyers.com/about/) it was \"Founded in 1991,\" uses a \"Patented selection process,\" selects \"5% of attorneys\" and evaluates them \"on 12 indicators of peer recognition and professional achievement.\" Florida's objectively-verifiable standard for characterizations applies to how an award is described, too."},{"type":"paragraph","text":"Security and trust seals work the same way: use one only if it links to a live verification page. The seal market has changed since older guides were written; [TrustedSite](https://www.trustedsite.com/), for example, now markets \"earned trust badges\" and an \"earned certification program.\" I would not count on any seal to lift conversions, because no independent figure supports that. And never show \"as seen on\" media logos without linking the actual coverage. A logo strip with no links is the kind of unverifiable claim that both Google's raters and Rule 7.1 are concerned with."},{"type":"heading","level":3,"text":"Why disguised advertorials are off-limits for lawyers"},{"type":"paragraph","text":"The FTC's [Enforcement Policy Statement on Deceptively Formatted Advertisements](https://www.govinfo.gov/content/pkg/FR-2016-04-18/html/2016-08813.htm) (December 22, 2015) says advertising that is not identifiable as advertising is deceptive if it misleads consumers \"into believing [it is] independent, impartial, or not from the sponsoring advertiser itself.\" The Commission noted it has challenged \"'advertorials' that appeared as news stories or feature articles.\""},{"type":"paragraph","text":"The rankings.io post describes an advertorial as \"basically an ad disguised as copy\" and suggests writing favorable posts about a partner business. For a law firm, that approach runs into the FTC statement and also into Rule 7.1's bar on misleading communications. Where something of value changes hands for a recommendation, it can also conflict with [ABA Model Rule 7.2(b)](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_7_2_advertising/), which bars giving \"anything of value to a person for recommending the lawyer's services,\" with five narrow exceptions such as the reasonable cost of advertising."},{"type":"paragraph","text":"The fix is straightforward. Label sponsored content as sponsored, disclose any relationship with a partner, and keep partner or paid content out of the firm's editorial blog and practice pages."},{"type":"heading","level":2,"text":"About, disclaimer and fee pages that prove you're real"},{"type":"paragraph","text":"The pages that carry the most trust on a law firm site are the dull ones: About, Contact, attorney bios, the disclaimer near the form and a plain explanation of fees and next steps. Stanford's guidelines put \"a real organization\", \"honest and trustworthy people\" and easy contact near the top of the list."},{"type":"heading","level":3,"text":"About, contact and attorney bio pages"},{"type":"paragraph","text":"Stanford's guidelines 2 to 5 ask a site to show there is a real organization behind it, highlight its expertise, show that honest people stand behind it and make contact easy. On guideline 2 the commentary is direct: \"The easiest way to do this is by listing a physical address.\" Google's rater guidelines add that \"Contact information and customer service information are extremely important for websites that handle money,\" and a firm handling claims and settlement funds falls squarely in that spirit."},{"type":"paragraph","text":"A checklist for the About and Contact pages:"},{"type":"list","ordered":false,"items":["A street address for each office, with an embedded map.","A phone number that is answered with the firm's name.","An email address at the firm's own domain, not a free webmail account.","Office hours and the languages staff speak.","Every attorney listed by name with states of admission, each linking to a full bio (the bio details are in element 9 above).","A short page explaining how the firm handles a case, from first call to resolution, including whether cases are referred to or co-counseled with other firms."]},{"type":"heading","level":3,"text":"Disclaimers and inquiries from prospective clients"},{"type":"paragraph","text":"Website disclaimers only help if people read them. According to an [ABA Journal summary by ABA associate ethics counsel Eileen Libby](https://www.abajournal.com/magazine/article/websites_may_trigger_unforseen_ethics_obligations_to_clients/), ABA Formal Opinion 10-457, \"Lawyer Websites\" (August 5, 2010), says disclaimers \"will be effective only if reasonably understandable,\" which \"requires a clear warning in a readable format whose meaning can be understood by a reasonable person.\" The opinion also addresses inquiries submitted through websites in light of Rule 1.18 on duties to prospective clients."},{"type":"paragraph","text":"So place the notice where it does its job. A line such as \"Submitting this form does not create an attorney-client relationship; please don't send confidential details until we confirm we can help\" belongs next to the submit button, in readable type, and not only in a gray footer. The Stanford report's prominence-interpretation theory explains why: a notice has no effect unless a person first notices it."},{"type":"paragraph","text":"Results disclaimers are a separate question. In New York they became optional on June 1, 2026 but can still help qualify results. In Florida, testimonials must carry one."},{"type":"heading","level":3,"text":"Fees and what happens after someone submits a form"},{"type":"paragraph","text":"Missing basics push people away fast. NN/g found that sites that left out basic information \"were almost immediately ruled out,\" and one participant abandoned a cleaning-service site after 35 seconds because it did not state its rate. A claimant weighing whether to call a lawyer has the same reflex."},{"type":"paragraph","text":"For a contingency practice, explain in plain words how the firm is paid, exactly as the firm's own agreement says, and what case costs exist and who pays them if there is no recovery. Do not quote industry-average percentages; state your own terms or invite the reader to ask for the agreement."},{"type":"paragraph","text":"Then add a short \"What happens next\" panel beside the form:"},{"type":"list","ordered":false,"items":["who will call (an intake specialist or an attorney);","how soon, during and outside office hours;","what questions they will ask;","what the claimant should have ready, such as dates, medical providers or product details."]},{"type":"paragraph","text":"That panel answers the anxious question behind every form submission. For the screening side of this process, see [what a structured claimant intake covers](/mass-tort-intake)."},{"type":"heading","level":3,"text":"Privacy, accessibility and Spanish-language pages"},{"type":"paragraph","text":"People seldom bring up privacy policies; in the 2002 Stanford study they came up in \"less than 1 percent\" of comments, though people said such policies were vital. Claimants still expect one, and a firm collecting injury and medical details should state plainly what it collects through forms, calls and chat, who sees it, and how long it is kept. Have counsel confirm which state privacy laws apply to the firm."},{"type":"paragraph","text":"On accessibility, [42 U.S.C. § 12181(7)(F)](https://www.law.cornell.edu/uscode/text/42/12181) lists the \"office of an accountant or lawyer\" among public accommodations under ADA Title III. The Department of Justice's [web accessibility guidance](https://www.ada.gov/resources/web-guidance/) (March 18, 2022) says it \"does not have a regulation setting out detailed standards\" for businesses open to the public, which \"have flexibility in how they comply,\" and it names WCAG and the Section 508 Standards as \"helpful guidance.\" The WCAG 2.1 Level AA deadlines in DOJ's [2024 Title II rule](https://www.ada.gov/resources/2024-03-08-web-rule/), moved by an April 2026 interim final rule to April 26, 2027 and April 26, 2028, apply to state and local governments, not to private law firms. Using WCAG as the working standard is still the sensible choice."},{"type":"paragraph","text":"Language access is a trust signal of its own. If many of your claimants speak Spanish, a properly translated page with a named Spanish-speaking contact tells them they will be understood on the first call, which in my view matters more than any badge. These on-page signals are only half the picture, though; the other half sits off the page and under the hood."},{"type":"heading","level":2,"text":"Off-site and technical trust signals for law firms"},{"type":"paragraph","text":"Much of a firm's credibility is decided off the page: in what Google's systems and raters look for, in whether the firm's name, address and phone match everywhere, in whether its emails can be spoofed and in how fast its pages load. None of these replaces genuine expertise, but each one removes a reason to doubt the firm."},{"type":"heading","level":3,"text":"What Google says about E-E-A-T and trust"},{"type":"paragraph","text":"Google's guidance on [creating helpful, reliable, people-first content](https://developers.google.com/search/docs/fundamentals/creating-helpful-content) says its systems look for \"experience, expertise, authoritativeness, and trustworthiness, or what we call E-E-A-T. Of these aspects, trust is most important.\" The [Search Quality Rater Guidelines](https://static.googleusercontent.com/media/guidelines.raterhub.com/en//searchqualityevaluatorguidelines.pdf) (September 11, 2025) explain why with a blunt example: \"a financial scam is untrustworthy, even if the content creator is a highly experienced and expert scammer.\""},{"type":"paragraph","text":"Two clarifications keep this in proportion. Google says \"E-E-A-T itself isn't a specific ranking factor,\" and that rater data \"is not used directly in our ranking algorithms.\" What the guidelines do say is that \"pages on clear YMYL topics require the most scrutiny,\" and injury and legal pages sit squarely in that group."},{"type":"paragraph","text":"The practical meaning for a firm is simple. The signals that pass a claimant's checks (real people, a real address, accurate content, a clean reputation) are the same ones Google's guidelines describe, so one body of work serves both audiences. For the content side, see the guide to [E-E-A-T for legal content](/blogs/mass-tort-law-firm-seo)."},{"type":"heading","level":3,"text":"One name, address and phone number everywhere"},{"type":"paragraph","text":"Google's [Business Profile guidelines](https://support.google.com/business/answer/3038177) require a name that reflects \"your business's real-world name, as used consistently on your storefront, website, stationery, and as known to customers.\" The same rules give lawyers who practice as individuals their own separate guidelines, rule out P.O. boxes as addresses, and state that \"there should only be one profile per business.\""},{"type":"paragraph","text":"Consistency matters because checking reputation is routine. The rater guidelines say \"reputation research is required for all PQ rating tasks,\" and a careful claimant does the same thing informally."},{"type":"paragraph","text":"My recommendation is to pick one canonical version of the firm's name, street address and main phone number, then make every listing match it exactly: the website footer, the Business Profile, state bar records, directories and social profiles. The profiles claimants commonly look at include Google reviews, the BBB, Avvo, Martindale, Super Lawyers and the state bar's attorney search. Audit them before launching a paid campaign, because an ad sends people straight to whichever mismatch they find first."},{"type":"heading","level":3,"text":"Structured data that says who you are"},{"type":"paragraph","text":"Google's documentation on [Organization structured data](https://developers.google.com/search/docs/appearance/structured-data/organization) says home-page markup \"can help Google better understand your organization's administrative details and disambiguate your organization in search results.\" It also notes \"there are no required properties,\" and its own example includes `sameAs`, `logo`, `email`, `telephone` and `address`."},{"type":"paragraph","text":"For a law firm, the right type is [LegalService](https://schema.org/LegalService), which schema.org describes as \"a business that provides legally-oriented services, advice and representation, e.g. law firms.\" The older [Attorney](https://schema.org/Attorney) type carries the note \"This type is deprecated - LegalService is more inclusive and less ambiguous.\""},{"type":"paragraph","text":"Practical advice for the markup itself:"},{"type":"list","ordered":false,"items":["Use `LegalService` on the home page with the same name, address and phone shown in the footer.","Add Person markup on attorney bio pages, with `sameAs` links to each lawyer's real bar and directory profiles.","Point the firm's `sameAs` at profiles it actually controls.","Do not mark services up as `Product`; Product markup is meant for products, not legal representation.","Keep every value identical to what a visitor can read on the page."]},{"type":"paragraph","text":"Markup also feeds AI answers. For more on that, read [how AI Overviews decide which law firm pages to cite](/blogs/aeo-for-personal-injury-lawyers) and the overview of [answer-first pages built for AI search](/services/ai-search-optimization)."},{"type":"heading","level":3,"text":"Email authentication: SPF, DKIM and DMARC"},{"type":"paragraph","text":"Email is where impersonation costs the most. The [FBI IC3 2025 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) recorded 24,768 Business Email Compromise complaints with $3,046,598,558 in reported losses, roughly $3.05 billion. The same report found that of more than 1,400 ransomware complaints from businesses outside the critical-infrastructure sectors, 18% came from \"Legal services,\" the most reported industry."},{"type":"paragraph","text":"The large mailbox providers now set minimum standards for anyone sending to their users. This table summarizes the [Gmail email sender guidelines](https://support.google.com/a/answer/81126) and the [Yahoo Sender Hub best practices](https://senders.yahooinc.com/best-practices/), as of October 2026."},{"type":"table","header":["Requirement","Gmail, all senders","Gmail, 5,000+ a day","Yahoo"],"rows":[["SPF or DKIM","Yes, at least one","Both required","One for all; both for bulk"],["DMARC","Not required","Required, p=none allowed","Bulk: at least p=none"],["One-click unsubscribe (marketing)","Not listed","Required","Bulk: required"],["Spam rate","Below 0.3%","Below 0.3%","Below 0.3%"]]},{"type":"paragraph","text":"Gmail's requirements have applied since February 1, 2024, and Google also asks senders to keep Postmaster Tools spam rates \"below 0.10%\" and to avoid \"ever reaching a spam rate of 0.30% or higher.\" Yahoo adds that bulk senders must \"honor unsubscribes within 2 days.\" DMARC itself is now defined in [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989), a Proposed Standard that \"obsoletes RFCs 7489 and 9091.\""},{"type":"paragraph","text":"Even a small firm that sends a few dozen emails a day should publish a DMARC record for its domain. The volume thresholds decide what Gmail demands, but DMARC is what lets receiving servers reject mail that pretends to come from the firm's domain, which is exactly what a payment-diversion scam depends on."},{"type":"heading","level":3,"text":"Page speed and Core Web Vitals"},{"type":"paragraph","text":"According to [web.dev's Web Vitals guide](https://web.dev/articles/vitals), a good experience means Largest Contentful Paint \"within 2.5 seconds,\" Interaction to Next Paint \"of 200 milliseconds or less,\" and Cumulative Layout Shift \"of 0.1 or less,\" each measured \"at the 75th percentile of page loads, segmented across mobile and desktop devices.\" INP [officially replaced First Input Delay](https://web.dev/blog/inp-cwv-march-12) as a Core Web Vital on March 12, 2024."},{"type":"paragraph","text":"Google's [Core Web Vitals documentation](https://developers.google.com/search/docs/appearance/core-web-vitals) says: \"We highly recommend site owners achieve good Core Web Vitals for success with Search and to ensure a great user experience generally.\" For a claimant on a phone, a page that jumps as it loads, or a form button that lags, reads as carelessness. More on the search side is in [SEO for personal injury lawyers](/services/personal-injury-seo) and the companion guide to [SEO for lawyers](/blogs/seo-for-lawyers)."},{"type":"heading","level":3,"text":"Protecting your firm from impersonation"},{"type":"paragraph","text":"The FTC's [Rule on Impersonation of Government and Businesses](https://www.ecfr.gov/current/title-16/part-461), 16 CFR Part 461, took effect April 1, 2024. Section 461.3 makes it a violation to \"materially and falsely pose as, directly or by implication, a business or officer thereof,\" or to \"materially misrepresent … affiliation with, including endorsement or sponsorship by, a business.\" The FBI's [August 2025 public service announcement](https://www.ic3.gov/PSA/2025/PSA250813) names \"the reputational harm of actual lawyers being impersonated\" and warns about fake documents bearing \"a legitimate law firm insignia or letterhead.\""},{"type":"paragraph","text":"Steps a firm can take now:"},{"type":"list","ordered":false,"items":["Monitor for lookalike domains built on the firm's name, including hyphenated and misspelled versions.","Look up suspicious domains with [ICANN Lookup](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en), and request non-public registration data through the Registration Data Request Service (RDRS) when you have a legitimate need.","Report phishing copies through [Google Safe Browsing's \"Report phishing\" link](https://safebrowsing.google.com/) and through Edge's [Report unsafe website option](https://support.microsoft.com/en-us/microsoft-edge/how-can-smartscreen-help-protect-me-in-microsoft-edge-1c9a874a-6826-be5e-45b1-67fa445a74c8).","Report fraud against clients to the FBI's Internet Crime Complaint Center at www.ic3.gov.","Publish a short \"how to verify it's really us\" note listing the firm's only domain, its phone numbers and the payment methods it never uses. List only methods the firm truly never uses."]},{"type":"heading","level":2,"text":"Trust at intake: forms, calls and texts"},{"type":"paragraph","text":"The moment a claimant fills in a form or answers a call is when every earlier signal is tested, so the form, the confirmation and the first conversation must carry the same name, the same attorney and the same promises as the ad. Inconsistency at intake undoes the work of the website."},{"type":"heading","level":3,"text":"The claimant landing page trust stack"},{"type":"paragraph","text":"This is the build order for a landing page, not a repeat of the claimant's checklist. Put the firm name and the responsible attorney above the form. [New York Rule 7.1(d)](https://nysba.org/wp-content/uploads/2026/08/NYSBA-NY-Rules-of-Professional-Conduct-August-10-2026.pdf) requires every communication to \"include the name and contact information of at least one lawyer or law firm responsible for its content,\" and [ABA Model Rule 7.2, Comment [12]](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_7_2_advertising/comment_on_rule_7_2/) points the same way."},{"type":"paragraph","text":"Ask only for what screening needs, and explain why before any health question. Place a one-line privacy note directly beside the fields; the [Stanford/Consumer WebWatch report](https://advocacy.consumerreports.org/wp-content/uploads/2013/05/stanfordPTL.pdf) found that a signal nobody notices has no effect. Skip countdown timers, fake scarcity and review widgets without sources. End with a confirmation page and a message from the firm's own domain that names who will call and when. For the ad side, see [trust elements that lift claimant form completion](/blogs/mass-tort-facebook-marketing)."},{"type":"heading","level":3,"text":"Consent language that matches the law today"},{"type":"paragraph","text":"The FCC's one-to-one consent rule never took effect in the form many vendors still describe. In [*Insurance Marketing Coalition Ltd. v. FCC*](https://media.ca11.uscourts.gov/opinions/pub/files/202410277.pdf), decided January 24, 2025, the 11th Circuit held that \"the FCC exceeded its statutory authority\" and vacated \"Part III.D of the 2023 Order,\" including the one-to-one restriction and the \"logically and topically associated\" requirement."},{"type":"paragraph","text":"Good practice still applies. Put plain-language consent next to the submit button, name the firm, and list the ways it will make contact: calls, texts and email. If the firm texts claimants, register its business messaging with its provider, because carriers filter unregistered traffic. For the full picture, see [current TCPA consent standards for lead forms](/mass-tort-marketing-compliance). None of this is legal advice; confirm consent wording with counsel."},{"type":"heading","level":3,"text":"The first call is a credibility test"},{"type":"paragraph","text":"Answer live when the claimant calls back. Introduce the firm and the attorney by name, never ask for payment, explain what happens next and confirm it in writing from the firm's domain. Claimants have been warned about fake law firms that ask for money, so a request for any fee on the first call undoes everything the page built."},{"type":"paragraph","text":"Caller ID that shows the firm's name, and branded calling where the carrier supports it, help an outbound callback get answered instead of ignored. Firms without staff to cover evenings and weekends can use [live intake answering for plaintiff firms](/services/intake-services), as long as the script names the firm and the attorney the same way the ad did."},{"type":"heading","level":3,"text":"Measuring whether visitors trust you"},{"type":"paragraph","text":"Trust shows up in behavior. Watch these numbers, and compare each one before and after every trust change rather than against an outside benchmark:"},{"type":"list","ordered":false,"items":["form start-to-completion rate;","abandonment at sensitive fields, such as diagnosis or date of birth;","call answer rate and callback speed;","hang-ups during screening;","review velocity on the firm's profiles;","signed retainers per qualified lead."]},{"type":"paragraph","text":"Change one element at a time, and give each change enough traffic to show a difference. The guide to [conversion rates, call tracking and attribution](/mass-tort-lead-conversion-rates) covers how to wire up the measurement."},{"type":"heading","level":2,"text":"The mirror audit: a law firm credibility scorecard"},{"type":"paragraph","text":"The mirror audit scores a law firm website against the same checks a skeptical claimant runs, 15 checks worth up to 2 points each. It is a self-assessment for setting priorities, not a benchmark against other firms, so there is no \"good\" total to hit."},{"type":"image","src":"/images/blog-content/website-credibility/07-mirror-audit.jpg","alt":"Mirror diagram pairing five checks a claimant runs with what a law firm website must show to pass each one","caption":"The mirror audit turns each visitor check into a requirement for your own site. Score every row before you fix anything."},{"type":"heading","level":3,"text":"How to score your site"},{"type":"paragraph","text":"Score the page claimants actually land on, not only the homepage. Do it from a phone as well as a desktop, since a page can pass on one and fail on the other. If you can, ask someone outside the firm to score it, since staff stop seeing problems they walk past every day. Give each row 2, 1 or 0 points and write down the date."},{"type":"table","header":["#","What a visitor checks","What your site must show","2 points","1 point","0 points"],"rows":[["1","Host","One domain in the firm's real name","Campaign sites link from it","Name matches, links missing","Misleading or unrelated domain"],["2","Connection","HTTPS everywhere, renewing automatically","Automated and monitored","HTTPS, manual renewal","Any HTTP page or expiry"],["3","Real organization","Street address matching the Business Profile","On every page, matching","On contact page only","Missing or P.O. box"],["4","Reachable","Phone answered live with the firm name","Live during stated hours","Voicemail or call center","No phone"],["5","Responsible lawyer","Named attorney and contact info","On every page and ad","Some pages","None"],["6","License","Admissions that match the bar record","Every attorney, verified","Listed, not verified","Not listed"],["7","Reviews","Genuine, sourced, unfiltered","Linked to source, all shown","Unlinked excerpts","Incentivized or filtered"],["8","Testimonials and results","Qualified and rule-compliant","Reviewed against state rules","Unreviewed","Unqualified results claims"],["9","Badges and awards","Each verifiable","All link to verification","Some unlinked","Unverifiable logos"],["10","Copy and freshness","No errors; dated reviews","Dated, checked quarterly","Clean, undated","Typos, broken links"],["11","Sources","Dated primary sources","All statistics sourced","Some sourced","Unsourced numbers"],["12","Pressure","No pop-ups, timers or uninvited chat","None; AI chat labeled","One element","Several"],["13","Fees and next steps","Plain fee and process explanation","Both explained","One explained","Neither"],["14","Form","Disclaimer, privacy note and consent beside it","All three beside the form","In the footer only","Missing"],["15","Off-site and email","Matching listings; DMARC published","Both","One","Neither"]]},{"type":"paragraph","text":"A worked example shows how the rows interact. Suppose a firm runs a campaign on a separate landing domain that is not linked from its main site (row 1 scores 1), lists its address only on the contact page (row 3 scores 1), and sends calls after 6 p.m. to voicemail (row 4 scores 1). None of those is a zero, yet a claimant who checks the host, then looks for an address, then calls at 7 p.m. meets three small doubts in a row. Scores add up on paper, but doubts compound in practice, which is why the order of fixes matters more than the total."},{"type":"heading","level":3,"text":"How to read the result"},{"type":"paragraph","text":"Fix every 0 first, starting with rows 1 to 6, because those are the checks that end a visit: a misleading domain, an expired certificate, a missing address, an unanswered phone, no named lawyer or a license nobody can confirm. Then work on the 1s, beginning with the pages that receive paid traffic, since every doubt there costs money per click. Re-score quarterly and after any redesign, and record the date each time so changes can be traced to results."},{"type":"paragraph","text":"Keep one limit in mind. A high score does not prove legitimacy to anyone; a scam site can copy many of these signals. What the score does is remove reasons to doubt a firm that is genuine, so that claimants who check find what they expect."},{"type":"paragraph","text":"Mass Tort Marketing Agency reviews claimant landing pages and intake for personal injury and mass tort firms. Firms that want a second opinion on their scorecard can [book a free strategy call](/strategy-call)."},{"type":"heading","level":2,"text":"Sources and methodology"},{"type":"paragraph","text":"**Last reviewed: October 2026.**"},{"type":"paragraph","text":"This guide was researched in October 2026 from primary sources read directly: research reports and their authors; browser makers' own documentation; standards bodies (IETF RFCs, the CA/Browser Forum, ICANN); federal agencies (FTC, FBI IC3, DOJ, CISA); court rules and statutes; and the attorney advertising rules of the ABA, New York and Florida. Statistics are given with their date and what they measure. Where a source could not be read directly (some ABA pages), the text relies on the rule's adoption in New York's rules or on the ABA Journal's summary and says so."},{"type":"paragraph","text":"Whether Chrome 154 turned on HTTPS-by-default for everyone was not confirmed on a primary page. Search results and AI answers were used only to decide which questions to answer, never as evidence. Nothing here is legal advice; attorney advertising rules vary by state."},{"type":"paragraph","text":"Key dated sources:"},{"type":"list","ordered":false,"items":["[Stanford/Consumer WebWatch, How Do People Evaluate a Web Site's Credibility? (2002)](https://advocacy.consumerreports.org/wp-content/uploads/2013/05/stanfordPTL.pdf)","[Stanford Guidelines for Web Credibility (2002)](https://credibility.stanford.edu/guidelines/index.html)","[Nielsen Norman Group, Trustworthiness in Web Design (2016)](https://www.nngroup.com/articles/trustworthy-design/)","[Chromium Blog, An Update on the Lock Icon (2023)](https://blog.chromium.org/2023/05/an-update-on-lock-icon.html)","[Google Online Security Blog, HTTPS by default (2025)](https://security.googleblog.com/2025/10/https-by-default.html)","[RFC 3986, URI Generic Syntax](https://www.rfc-editor.org/rfc/rfc3986.txt)","[CA/Browser Forum TLS Baseline Requirements v2.3.1 (October 2026)](https://github.com/cabforum/servercert/blob/main/docs/BR.md)","[ICANN, Launching RDAP; Sunsetting WHOIS (January 2025)](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en)","[ICANN, Registration Data Policy in effect (August 2025)](https://www.icann.org/en/announcements/details/icann-registration-data-policy-now-in-effect-for-contracted-parties-21-08-2025-en)","[FTC fraud testimony release (March 25, 2026)](https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-testifies-joint-economic-committee-agencys-efforts-combat-fraud)","[FBI IC3 2025 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)","[FBI IC3 PSA on fictitious law firms (June 2024)](https://www.ic3.gov/PSA/2024/PSA240624)","[FBI IC3 PSA250813 (August 2025)](https://www.ic3.gov/PSA/2025/PSA250813)","[16 CFR Part 465, FTC Consumer Reviews and Testimonials Rule (2024)](https://www.federalregister.gov/documents/2024/08/22/2024-18519/trade-regulation-rule-on-the-use-of-consumer-reviews-and-testimonials)","[Federal Rule of Civil Procedure 23](https://www.law.cornell.edu/rules/frcp/rule_23)","[New York Rules of Professional Conduct, as amended June 1, 2026](https://nysba.org/wp-content/uploads/2026/08/NYSBA-NY-Rules-of-Professional-Conduct-August-10-2026.pdf)","[Rules Regulating The Florida Bar, Chapter 4 (October 1, 2026)](https://www-media.floridabar.org/uploads/2026/10/2027_04-OCT-Chapter-4-RRTFB.pdf)"]},{"type":"paragraph","text":"The page is reviewed quarterly, and any rule or tool changes are noted in the next review."}],"faqs":[{"question":"Is there a free way to check if a website is legitimate?","answer":"Yes. Several free tools cover different questions. Google's [Safe Browsing Site Status](https://safebrowsing.google.com/) shows whether Google currently flags a site as dangerous. [URLVoid](https://www.urlvoid.com/) checks a site against 30+ blocklist engines. [ICANN Lookup](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en) shows registration details such as the creation date, and [BBB Scam Tracker](https://www.bbb.org/scamtracker) lets you search scam reports by website or phone number. Combine them with manual checks of the host, the street address and the phone number. No tool can guarantee a site is safe, because a new scam may simply not be reported yet."},{"question":"Does HTTPS or a padlock mean a website is safe?","answer":"No. HTTPS means the connection between your browser and the site is encrypted, nothing more. Chrome's security team wrote in 2023 that the lock icon \"does not indicate website trustworthiness\" and that [\"nearly all phishing sites use HTTPS\"](https://blog.chromium.org/2023/05/an-update-on-lock-icon.html). Chrome's own help page advises that even on secure sites you should [check the site name in the address bar](https://support.google.com/chrome/answer/95617) before entering personal information. Treat HTTPS as a minimum requirement for any site that collects data, and look for other evidence that a real, accountable business runs the site."},{"question":"What happened to the padlock icon in Chrome?","answer":"Chrome replaced the lock with a neutral \"tune\" icon in Chrome 117, released in early September 2023, according to the [Chromium Blog](https://blog.chromium.org/2023/05/an-update-on-lock-icon.html). Google made the change because people misread the lock as a sign that a site was trustworthy; its 2021 research found only 11% of participants understood what the icon meant. On iOS, where the lock was not tappable, Chrome removed it entirely. Chrome still marks plain HTTP pages as not secure, so the warning for an unencrypted page remains even though the lock is gone."},{"question":"How can I tell if a website is fake?","answer":"Start with the address. Under [RFC 3986](https://www.rfc-editor.org/rfc/rfc3986.txt), the real host sits between \"//\" and the next \"/\", and anything before an \"@\" sign is not the host, so `example.com.example.net` belongs to example.net. Watch for lookalike characters too; Chrome's [IDN documentation](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md) describes homograph attacks that swap Latin letters for Cyrillic ones. Then compare details with independent sources, and stop if the site asks for payment by [cryptocurrency or prepaid gift cards](https://www.ic3.gov/PSA/2024/PSA240624) or pushes you to act immediately. One clear stop sign is enough."},{"question":"What makes a website credible?","answer":"Credibility is how believable a site seems, and researchers usually break it into perceived trustworthiness and perceived expertise. The [Stanford Guidelines for Web Credibility](https://credibility.stanford.edu/guidelines/index.html), based on research with over 4,500 people, stress making information easy to verify, showing a real organization and real people, making contact easy and avoiding errors. Nielsen Norman Group's [four credibility factors](https://www.nngroup.com/articles/trustworthy-design/) are design quality, up-front disclosure, comprehensive and current content, and connection to the rest of the web. A credible site gives visitors ways to confirm its claims for themselves."},{"question":"What is the difference between a legitimate website and a safe website?","answer":"A legitimate website is run by a real, accountable operator who is who it claims to be. A safe website is one where visiting, entering details or paying will not harm you through malware, phishing or fraud. The two can come apart. A real business can have a hacked page serving malware, and a scam site can be technically clean, encrypted and free of malicious code while still taking your money. Check both: tools such as [Google Safe Browsing](https://safebrowsing.google.com/) help with safety, and address, phone and registration checks help with legitimacy."},{"question":"How do I find out who owns a website?","answer":"Use [ICANN Lookup](https://lookup.icann.org/en), which has drawn on the Registration Data Access Protocol (RDAP) since [28 January 2025](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en), when WHOIS for generic top-level domains was sunset. Expect the owner's name to be redacted in many results. ICANN's [Registration Data Policy](https://www.icann.org/en/announcements/details/icann-registration-data-policy-now-in-effect-for-contracted-parties-21-08-2025-en), in effect since August 2025, manages registration data in line with privacy rules, so redaction is normal. If you have a legitimate need, such as a legal claim, you can request non-public data through ICANN's Registration Data Request Service (RDRS)."},{"question":"Is a newly registered domain a sign of a scam?","answer":"Not by itself. No authoritative rule says a domain under a certain age is a scam, and real businesses launch new sites and campaign domains all the time. Domain age is useful as a comparison. Look up the creation date with [ICANN Lookup](https://lookup.icann.org/en) and compare it with what the site claims: a firm describing decades of experience on a domain registered last month should explain the gap, for example by linking from its long-standing main site. A mismatch is a reason for more checks, not proof of fraud."},{"question":"Are .org or .gov websites always trustworthy?","answer":"Only .gov is restricted. According to [get.gov](https://get.gov/domains/eligibility/), run by CISA, .gov domains are \"only available to U.S.-based government organizations,\" while \"anyone can register a .com, .org, or .us domain for a fee.\" A .org address therefore does not prove that a nonprofit runs the site, and scam sites can use .org as easily as .com. A genuine .gov address is strong evidence that a government body runs the site, but you still need to read the host carefully, because a lookalike such as `example.gov.example.com` is not a .gov site."},{"question":"How do I check if a website is safe on my iPhone?","answer":"Turn on Safari's built-in protection first. Apple's [iPhone User Guide](https://support.apple.com/guide/iphone/browse-the-web-securely-iphb01fc3c85/ios) says to open Settings, tap Apps, then tap Safari, and enable Fraudulent Website Warning, which shows a warning on suspected phishing sites; Apple notes it is not available in all countries or regions. Then read the address itself, because Chrome on iOS removed the lock icon entirely in 2023, according to the [Chromium Blog](https://blog.chromium.org/2023/05/an-update-on-lock-icon.html). Tap the address bar to see the full host, and check it before entering any details."},{"question":"What should I do if I entered my card details on a scam site?","answer":"Call your card issuer right away using the number printed on the back of the card, not one from the site, and ask to block the card and dispute the charges. Change any password you used on that site and anywhere you reused it. Report the site at [ReportFraud.ftc.gov](https://reportfraud.ftc.gov/) and to the FBI's [Internet Crime Complaint Center](https://www.ic3.gov/PSA/2025/PSA250813). Then be wary of anyone who offers to recover the money for a fee. The FTC warns that legitimate organizations [\"will never ask for money to help you get a refund\"](https://consumer.ftc.gov/articles/refund-and-recovery-scams)."},{"question":"Are website legitimacy checkers accurate?","answer":"They are accurate about what they report, which is whether a site appears on known lists. [URLVoid](https://www.urlvoid.com/), for example, describes itself as analyzing a site \"through 30+ blocklist engines and online website reputation services.\" That method cannot catch a scam nobody has reported yet. As wikiHow's guide puts it, a clean result may mean the site \"just hasn't been reported yet.\" Treat a warning from a checker as a strong reason to leave, and treat a clean result as one piece of evidence, to be combined with the address, registration and contact checks."},{"question":"How quickly do visitors judge a website?","answer":"Very quickly, but not always about credibility. A 2012 [Google Research study](https://research.google/blog/users-love-simple-and-familiar-designs-why-websites-need-to-make-a-great-first-impression/) found that aesthetic judgments of websites form \"between 17 and 50 milliseconds,\" and that people prefer designs that are simple and familiar. Nielsen Norman Group reported in 2011 that [users often leave web pages in 10 to 20 seconds](https://www.nngroup.com/articles/how-long-do-users-stay-on-web-pages/), while pages with a clear value proposition hold attention much longer. Judging beauty is not the same as judging trustworthiness, but a poor first impression can end a visit before the trust signals are seen."},{"question":"How do I check if a lawyer is real?","answer":"Go to the state bar, not the firm's website. Every state bar runs an attorney search; the State Bar of California, for example, advises people to [use its Attorney Search](https://www.calbar.ca.gov/public/concerns-about-attorney/avoid-legal-services-fraud) to confirm credentials, check that the license is active, and make sure the contact details match the bar's records. Then contact the lawyer using the phone number or email listed with the bar, since attorneys must keep that information current. If the person who contacted you cannot be found, or uses different contact details, stop before sharing documents or paying anything."},{"question":"Can a law firm help me recover money lost to a crypto scam?","answer":"Be very careful. The FBI reported that between February 2023 and February 2024, crypto scam victims further exploited by [fictitious law firms](https://www.ic3.gov/PSA/2024/PSA240624) lost over $9.9 million. Its red flags include claims to be an official partner of a US government agency, requests for payment in cryptocurrency or prepaid gift cards, and refusal to show a license or meet on video. The FTC says legitimate organizations [never ask for money to help you get a refund](https://consumer.ftc.gov/articles/refund-and-recovery-scams). Verify any lawyer through the state bar before you engage them or pay anything."},{"question":"How do I know if a class action settlement is legit?","answer":"A real class settlement needs a judge's approval. Under [Federal Rule of Civil Procedure 23(e)](https://www.law.cornell.edu/rules/frcp/rule_23), a class claim may be settled \"only with the court's approval,\" after a hearing and a finding that the deal is fair, reasonable and adequate. The official notice must describe the action, the class definition, the claims and your right to opt out. Look for a case name and number you can confirm on the court's docket, and reach the settlement website by typing the address printed in the notice rather than clicking a link from an ad or email."},{"question":"Do I have to pay to file a claim in a settlement?","answer":"Official warnings say no. During the 2019 Equifax settlement, News4Jax reported the FTC's warning that [\"consumers will never have to pay to file a claim\"](https://www.news4jax.com/consumer/2019/07/30/ftc-beware-of-fake-equifax-settlement-websites/) for the benefits. In 2024, MOAA reported a [Navy and DOJ fraud alert](https://www.moaa.org/content/publications-and-media/news-articles/2024-news-articles/health-care-and-earned-benefits/navy-issues-fraud-alert-for-camp-lejeune-contamination-claims/) saying the government \"will never request money or payment from a filer\" for Camp Lejeune claims. The FTC's broader advice is to [never pay upfront](https://consumer.ftc.gov/articles/refund-and-recovery-scams) for a refund or help getting one. A lawyer may charge a contingency fee from a recovery, but that is different from paying to file."},{"question":"Is a mass tort the same as a class action?","answer":"No. In a class action, one or more representatives sue on behalf of a whole class, and a settlement binds members who do not opt out. Mass tort cases usually stay individual. When many similar cases are pending in different federal districts, the Judicial Panel on Multidistrict Litigation can transfer them to one court for coordinated pretrial proceedings under [28 U.S.C. § 1407](https://www.law.cornell.edu/uscode/text/28/1407), known as an MDL. Each case keeps its own claimant, and the statute provides for remand at or before the end of pretrial proceedings unless the case was already resolved."},{"question":"Is E-E-A-T a Google ranking factor?","answer":"Not directly. Google's guidance on [helpful, reliable content](https://developers.google.com/search/docs/fundamentals/creating-helpful-content) says \"E-E-A-T itself isn't a specific ranking factor,\" although Google uses \"a mix of factors that can identify content with good E-E-A-T,\" with more weight on topics affecting health, finances or safety. The same page calls trust the most important part of E-E-A-T. Google's [rater guidelines](https://static.googleusercontent.com/media/guidelines.raterhub.com/en//searchqualityevaluatorguidelines.pdf) add that \"untrustworthy pages have low E-E-A-T no matter how Experienced, Expert, or Authoritative they may seem.\" For a law firm, that means verifiable trust signals matter more than claims of expertise."},{"question":"Can law firms post client reviews and testimonials on their website?","answer":"Yes, if they are genuine and follow the rules that apply. The FTC's rule at [16 CFR Part 465](https://www.ecfr.gov/current/title-16/part-465) bars fake reviews and testimonials, including ones that misrepresent the reviewer's experience. State bar rules add more. Florida treats a testimonial as misleading if it is, among other things, written by the lawyer or given in exchange for something of value, or lacks a disclaimer about results ([Rule 4-7.13](https://www-media.floridabar.org/uploads/2026/10/2027_04-OCT-Chapter-4-RRTFB.pdf)). New York's [Rule 7.1 comment](https://nysba.org/wp-content/uploads/2026/08/NYSBA-NY-Rules-of-Professional-Conduct-August-10-2026.pdf) warns that results can create unjustified expectations. Rules vary by state."},{"question":"Can a law firm offer a gift card for a Google review?","answer":"No. Google's [fake engagement policy](https://support.google.com/contributionpolicy/answer/7400114) bans offering incentives \"such as payment, discounts, free goods and/or services\" in exchange for posting a review. The FTC rule separately bans incentives conditioned on a review expressing a [particular sentiment](https://www.ecfr.gov/current/title-16/part-465). Lawyers face a third issue: under ABA Model Rule 7.2, a communication that vouches for a lawyer's qualities counts as a [recommendation](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_7_2_advertising/comment_on_rule_7_2/), and the rule generally bars giving anything of value for recommending a lawyer, with narrow exceptions. Confirm with your state bar before running any review program."},{"question":"Does New York still require \"Attorney Advertising\" on law firm websites?","answer":"No. According to the New York State Bar Association's [summary of the amendments](https://nysba.org/wp-content/uploads/2026/08/The-Amendments-to-the-Advertising-Rules.pdf), the requirement to label ads \"Attorney Advertising\" was eliminated effective June 1, 2026, along with the mandatory \"Prior results do not guarantee a similar outcome\" statement. The amended [Rule 7.1(d)](https://nysba.org/wp-content/uploads/2026/08/NYSBA-NY-Rules-of-Professional-Conduct-August-10-2026.pdf) still requires every communication to include the name and contact information of at least one lawyer or law firm responsible for its content. The commentary's author suggests lawyers may still want to use a results disclaimer."},{"question":"What is the CRAAP test for website credibility?","answer":"The CRAAP test is a checklist from the Meriam Library at California State University, Chico, for judging sources. It scores a page on [Currency, Relevance, Authority, Accuracy and Purpose](https://library.csuchico.edu/sites/default/files/craap-test.pdf). Its web prompts include \"Are the links functional?\" and whether the URL reveals anything about the author or source. It was built for students evaluating research sources, so it works best on articles and reports. For deciding whether a business or law firm is real, add checks the test does not cover, such as the street address, the phone and the state bar record."},{"question":"How can a law firm stop scammers from impersonating it?","answer":"Start by knowing the law is on your side: the FTC's [impersonation rule](https://www.ecfr.gov/current/title-16/part-461), effective April 1, 2024, makes it a violation to falsely pose as a business or misrepresent affiliation with one. The FBI has warned about the [reputational harm to lawyers](https://www.ic3.gov/PSA/2025/PSA250813) whose names and letterhead are copied. Monitor for lookalike domains, publish DMARC on the firm's email domain, report copycat sites through [Google Safe Browsing](https://safebrowsing.google.com/) and fraud to IC3, and post a short note listing the firm's only domain, phone numbers and the payment methods it never uses."}],"related":["law-firm-website-development","best-law-firm-seo-companies","best-law-firm-websites","seo-for-lawyers"]}