How to Tell if a Website Is Safe Before Entering Your Details

Every month, Kenyans lose money to fake versions of ecitizen.go.ke, itax.kra.go.ke, and banking portals. The scams work because the fake sites look almost identical to real ones. Telling whether a website is safe requires checking four specific things before you enter any login details, payment information, or personal data.

Check the Web Address Carefully

The URL is your first line of defense. Scammers register domains that look similar to legitimate ones at a glance. The Kenya Revenue Authority's actual tax portal is itax.kra.go.ke — not itax-kra.go.ke or itaxkra.go.ke or any variation with extra characters or different extensions.

Look at the part after "https://" and before the first slash. That's the domain. For government sites, you'll see .go.ke. For banks like Safaricom's M-Pesa portal, check that the domain matches exactly what appears on their official app or physical materials. Write down the correct address from a trusted source — your bank statement, official letter, or the official mobile app — before clicking any link in an email or text message.

Hover your mouse over links in emails before clicking. Most email clients show you the actual URL without clicking. If the link says "Click here for KRA" but the URL preview shows something different, that's a red flag.

Look for HTTPS and the Lock Icon

Every legitimate financial or government website uses HTTPS encryption, which you'll see as "https://" at the start of the address. The lock icon appears in your browser's address bar — usually on the left side. Click it to see the certificate details.

HTTPS means data sent between your device and the website is encrypted. Without it, someone on the same WiFi network could intercept passwords and card details. However, HTTPS alone isn't enough. Scammers can also obtain HTTPS certificates for fake sites.

When you click the lock icon, you can view the certificate. For real government sites, the certificate will show it's issued to the actual government agency. For banks, it will show the bank's official name. If the certificate belongs to someone else or a generic company, the site is fake.

Verify Contact Information and Security Features

Real Kenyan government portals include contact details and privacy statements. The KRA website displays its office address, email, and phone numbers. Fake sites either omit this entirely or display information that doesn't match official records.

Check for two-factor authentication options. Legitimate banking and government portals offer 2FA — usually through SMS or an authenticator app. If a site claims to handle your money or taxes but doesn't mention 2FA, it's likely fake.

Look for a privacy policy and terms of service. Legitimate sites have detailed versions. Scam sites often have vague or absent policies, or policies copied directly from other websites.

When in Doubt, Contact the Official Source

If you're unsure about a website, don't enter your details. Instead, call the organization's official phone number — the one from your bank statement or their official app, not from the website you're questioning. Ask if the website address is correct. This takes two minutes and prevents most scams.

For complex verification or if you need help checking whether a portal is legitimate, find a verified Kenyan expert on Kaziiko who can walk you through it.

Never trust emails or SMS messages that ask you to "verify your account" or "update your details." Banks and government agencies don't request sensitive information via email. If you receive such a message, contact the organization directly using a number you trust.

Frequently Asked Questions

How can I check if a KRA or government website is real?

Verify the exact web address matches what's on official government communications or the official mobile app. Check for the HTTPS lock icon and click it to see the certificate — it should be issued to the Kenya government agency. Call the agency's official phone number to confirm the website address if you're unsure.

Is HTTPS enough to know a site is safe?

No. HTTPS encrypts your data but doesn't prove the site is legitimate. Scammers can get HTTPS certificates for fake websites. Always verify the certificate details and the exact web address before entering sensitive information.

What should I do if I already entered my details on a fake website?

Contact your bank or the affected organization immediately. Change your password from a different device. If financial details were entered, request your bank freeze your accounts temporarily and monitor them for unauthorized transactions. Report the fake website to the organization and to Kenya's Communications Authority.

Can I trust links sent in emails or SMS?

No. Scammers commonly send emails and SMS messages with fake links. Instead of clicking, go directly to the official website by typing the address into your browser or using the official app. This prevents phishing attacks.