Before entering a passport number, identity detail, payment card, or login password, use this repeatable government website verification checklist to confirm that the website, form, email, or payment page is genuine.
Overview
Government services are increasingly available online, including document applications, benefit claims, public records requests, address changes, license renewals, and residency procedures. That convenience also creates opportunities for impersonation. A convincing message or search result can lead to a lookalike website that collects personal information, charges unnecessary fees, or captures account credentials.
Government website verification is not a single test. A familiar logo, professional design, or padlock icon does not prove that a page belongs to the relevant public authority. Instead, check several independent signals: how you reached the page, who operates the domain, whether the address is exact, whether the connection is secure, and whether the requested information makes sense for the service.
Use the checklist below whenever you are about to submit sensitive information. It is particularly useful before completing seasonal applications, renewing identity documents, responding to an urgent message, or paying a government-related fee.
Checklist by scenario
When starting from a search engine
- Read the full web address. Do not rely only on the page title or search result description. Look for the official domain used by the relevant national, regional, state, provincial, or local authority. Be cautious with additional words, unusual spelling, extra hyphens, and domains that place an official-sounding name before an unrelated domain.
- Open the authority's main website first. If possible, navigate from the public authority's home page to the service rather than selecting an advertisement or an unfamiliar result. The official site may link to a separate service platform, but that transition should be clear.
- Compare contact details. Check whether the phone number, office address, and service description match information published elsewhere on the authority's official website. Do not use contact details supplied only by a suspicious page.
- Save the correct starting point. Bookmark the verified service page or record the official home-page address. This reduces the chance of returning through a misleading search result later.
When following an email or text message
- Pause before clicking. Urgent language, threats of penalties, unexpected refunds, or claims that an account will be closed are reasons to verify independently, not reasons to act faster.
- Inspect the sender and links. A display name can be copied, and a shortened link can conceal its destination. On a computer, hover over a link; on a phone, use the available link preview or copy the address without opening it. Compare the destination with the official domain you already know.
- Do not reply with sensitive information. Treat requests for passwords, one-time codes, full identity numbers, or payment details as unverified until confirmed through an independent channel.
- Contact the office separately. Use a phone number or web address found through an established official source, not the message itself. If the message may be legitimate, you can still reach the service by starting from the official website.
When completing an online form
- Confirm the purpose before filling fields. Read what the form is for, which authority receives it, and whether the information requested is relevant to that purpose.
- Check the privacy and help information. An official form should provide enough context to identify the responsible authority and explain how to get assistance. Missing or copied-looking information is a warning sign.
- Minimize what you provide. Enter only information required for the stated service. Do not upload extra identity documents simply because a page presents an optional request as if it were mandatory.
- Keep a record. Save the confirmation page, reference number, submitted form, and date. Store copies securely and avoid leaving identity documents in a shared downloads folder.
When making a payment
- Verify the payment step and recipient. Confirm that the payment page was reached through the verified service and clearly identifies the responsible authority or authorized payment provider.
- Check the amount and explanation. The page should explain what the payment is for. If the charge is unexpected, unusually urgent, or inconsistent with instructions on the official service page, stop and verify it.
- Review the final screen. Check the address bar, recipient name, amount, and reference details before submitting payment. Keep the receipt and confirmation.
If you are preparing several applications, the Government Document Application Planner can help you organize requirements before you visit an online service. For public records work, compare the website with the steps in the Public Records Request Guide.
What to double-check
The domain and redirects
A secure connection protects data while it travels between your browser and the site, but it does not establish that the site is an official government service. Read the domain itself. A legitimate service may redirect to a contracted or shared platform, so a different domain is not automatically fraudulent; however, the official authority should normally explain or link to that platform. If the redirect is unexplained, passes through several unrelated domains, or ends at a page asking for unusually sensitive information, stop.
The browser warning and certificate
Do not ignore browser warnings about an invalid certificate, an unsafe connection, or a mismatched address. Close the page and start again from a verified official website. A page that displays a padlock but has an incorrect domain should still be treated as unverified.
The requested information
Consider whether the request fits the service. A birth certificate application may require identity and delivery details; a general information page should not require a full identity number or payment card. The exact requirements differ by jurisdiction, so use the relevant authority's current instructions and ask for clarification when the request does not make sense.
Accessibility and alternative routes
An official service may offer telephone, in-person, postal, or accessible alternatives. If a page is difficult to use, inaccessible, or unavailable, do not switch to an unverified third-party form simply because it appears easier. Look for the authority's accessibility statement or contact route and confirm the safe alternative.
What to do if you already submitted information
Act promptly without assuming the worst. Stop further communication with the suspicious source, change any reused password, and contact your bank or payment provider if financial details were entered. Use the relevant official identity-theft, fraud-reporting, or account-recovery channel for your jurisdiction. Keep the message, web address, screenshots, receipts, and timeline. If an account used multi-factor authentication, review recent activity and remove unfamiliar sessions or devices.
Common mistakes
- Trusting branding alone: logos, colors, seals, and formal language can be copied.
- Checking only the padlock: encryption is useful, but it does not prove who operates the website.
- Using the first search result: advertisements and lookalike pages can appear before the official source.
- Calling the number in a suspicious message: verify contact details independently first.
- Uploading more than necessary: extra documents increase exposure if the page is not genuine.
- Assuming a different domain is automatically fake: some public services use external platforms, but the connection should be explained by the official authority.
- Ignoring small address differences: a changed letter, extra word, or unfamiliar top-level domain can matter.
- Failing to save confirmation: a reference number and receipt help resolve disputes and identify what was submitted.
When to revisit
Recheck the official starting point whenever you use a service, especially before seasonal application periods, document-renewal cycles, elections, benefit deadlines, or major changes to an online account. Websites, login systems, payment providers, and application workflows can change, so an old bookmark or saved message should not be treated as permanent proof.
Use this short routine each time:
- Start from a verified official home page or a bookmark you created yourself.
- Read the complete domain and look for unexplained redirects.
- Confirm the service, responsible authority, contact details, and requested information.
- Use an independent contact route if anything feels inconsistent or urgent.
- Submit the minimum necessary information, then save the confirmation securely.
For related preparation, see the guide to verifying a government website, form, or message and the Government Benefits Documents Checklist. Treat government website verification as a normal part of using digital civic services, not as an obstacle to completing them.
