So you’ve probably been told to look for the padlock icon before entering any personal info online. And yeah, that was decent advice — once. But here’s what nobody bothered to explain: the padlock only tells you one thing.
It means your connection to that site is encrypted. That’s it. It means someone snooping on the same Wi-Fi network as you can’t read the data traveling back and forth between your device and the site. That’s genuinely useful — but it says absolutely nothing about whether the site itself is real, trustworthy, or run by people who aren’t trying to steal from you.
Scammers know that people look for the padlock. So they put it on their fake sites too. It’s not hard to get. Any website owner can get the encryption certificate that makes that lock appear — including people running phishing scams designed to steal your login or credit card info.
And it’s not a small problem. As far back as 2018, about half of all phishing sites already had the padlock — and the number has only grown since. That means the lock has become almost meaningless as a trust signal. Google actually replaced the lock icon in Chrome with a neutral symbol for this reason, arguing that the padlock gave people a false sense of security that bad actors were actively exploiting.
Think of it this way: a padlock on a front door tells you the door is locked. It doesn’t tell you who’s inside or whether they’re good people. Same idea here.
So what should you actually look for? Check that the URL matches exactly what you expected — one wrong letter in a domain name is a major red flag. Be suspicious of any site you landed on through a random link in an email or text. And when in doubt, go directly to the official site by typing the address yourself rather than clicking through.