You open a website. Your browser doesn’t flag any warnings, the design looks perfectly legitimate, the connection is secure, and there are no obvious signs of phishing. Does that mean the site is safe? Unfortunately, many websites fall into a gray area: not quite scams you could point to and call phishing, but risky enough that interacting with them can still cost you your money or data. This post shows you how to recognize scam websites that your browser mistakes for safe ones, and how to protect your data. How gray-area websites trick users Classic phishing sites typically disguise themselves as well-known services to steal users’ money, personal information, or account details. Sites in this uncertain gray area, on the other hand, tend to work differently: they’re not outright fakes — just untrustworthy. They might charge users for services that don’t exist or don’t have the advertised quality, offer deals that look too good to be true and then quietly change the terms later, or promote shady financial schemes. What’s more, these sites don’t always break the law. Sometimes their operators deliberately look for loopholes in regulations, or bury the actual terms of service where users won’t notice them. Below, we look at the types of sites and web services that most often fall into this gray area. Subscription aggregators Among the most common types of gray-area sites are those selling cheap subscriptions to all kinds of services: streaming platforms, personality tests, online courses, you name it. The victim signs up for a subscription for next to nothing — sometimes literally a dollar — only to discover a week later that renewal costs a shockingly large amount. Technically, there was a warning, but it was buried in the microscopic print at the very bottom of the page. Sometimes scammers take it a step further: they add a line to the terms of service stating that subscription charges are non-refundable. Unsurprisingly, the user then has to jump through all kinds of hoops to cancel the subscription. Online stores The classic scam websites. The amazing deals they promote might get the buyer a knockoff, or worse — a printed photo of the item, or a tiny version of it instead of the real thing. And that’s assuming anything shows up at all given how suspiciously low the price was to begin with. Unfortunately, a bad purchase isn’t where the problems end. Scam online stores are also after personal information: to arrange delivery, the user typically has to hand over their real name, address, phone number, and email. And if the visitor goes ahead and pays for the order, an untrustworthy site can just as easily steal their card details too. Criminals then turn around and sell all of this valuable information on the dark web, or use it to send spam or launch targeted phishing attacks . Scammers running a shady online store offer items for next to nothing Online trading platforms and exchanges Crypto exchanges and websites offering investment opportunities deserve a separate mention. They all promise a fast return or a suspiciously good exchange rate, but as soon as the victim decides to invest, it becomes clear there’ll be no profit to be had. Quite the opposite, in fact: they lose everything they invested. Sometimes scammers keep the illusion going by showing the user the balance supposedly growing on their account, but when they try to withdraw their money, it turns out they first need to pay a “fee” or a “tax”, which is how the victim ends up losing even more. A scam website invites visitors to choose an investment opportunity promising suspiciously high ROI in just one or two days. Invest between US$100 and US$500, the scammers claim, and walk away with almost US$5000 in profit! Losing money isn’t the only risk here. Among the sites we’ve found, some stole private keys and crypto wallet accounts, while others redirected users to phishing pages, or hijacked their browser sessions. Remember this: if a site only accepts payment in cry…