How to spot a fake ESTA website
The official ESTA application costs $40.27 and lives at one address: esta.cbp.dhs.gov. Everything else charging you for an ESTA is a private company.
That is not automatically wrong — we are one of them, and we say so on every page. What matters is whether a site tells you plainly what it is.
The four-question test
Before paying anyone, ask:
- Does it say it is not the government? Not buried in a footer or a terms page — visibly, where you can see it before you pay.
- Does it show the government fee separately from its own? A single blended total is the single strongest warning sign.
- Does the total exceed $40.27? If so, the difference is a service fee. Fine if disclosed, a problem if not.
- Does it link to the official site? A legitimate operator has no reason to hide where you could go instead.
Any site failing question 1 or 2 is one to walk away from.
Specific things that should stop you
“Official” in the domain name or the page title. No private company is the
official ESTA service. There is exactly one, and it is a .gov address.
Government seals, eagles, flags, or federal blue design. Visual mimicry is deliberate. Legitimate operators do not need it.
Approval-rate claims. “99% approval rate”, “high approval rate”, “we get you approved” — nobody can influence CBP’s decision, so a site advertising success rates is either misunderstanding its own product or misleading you.
Speed claims. “Fast-track”, “priority processing”, “get your ESTA in one hour”. CBP sets processing times. No third party can change them.
Guaranteed approval. Impossible. Walk away.
Pressure tactics. Countdown timers, “3 people are applying now”, artificial scarcity on a government form that is available 24 hours a day.
Requests for card details by email or phone. Never legitimate, anywhere.
Phishing, which is a different problem
Some sites are not overpriced services but outright fraud: they take your money and your passport details and never file anything. Signs:
- The domain was registered recently, or has no contact details at all
- No registered business name, address or company number anywhere on the site
- Payment by bank transfer, cryptocurrency or gift card
- The email confirming your “ESTA” comes from a free mail address
- The “authorization” they send is a PDF they made, not a CBP record
A real ESTA is not a document. It is a record in CBP’s system, linked electronically to your passport. Airlines check it automatically. A PDF certificate proves nothing — you can verify the real thing yourself on the official site with your passport number and date of birth.
If you have already paid too much
You have options, and they are worth using.
Check whether you actually got an ESTA. Look yourself up on the official CBP site. If there is no record, you were defrauded rather than overcharged, and that changes what you do next.
Dispute the charge. If the site did not clearly disclose that it was a private service, contact your bank or card issuer. Undisclosed third-party fees for government services are a recognised category of complaint.
Report it. Consumer protection authorities in the UK and EU treat copycat government-service sites seriously, and reports are what get them shut down.
Change your passport details if you sent documents to a site you now doubt. A passport scan in the wrong hands is an identity-theft risk, not just a wasted payment. Contact your passport authority for advice.
What we do, and why we say all this
We charge a separate, clearly stated fee for checking your details before you submit. You always pay CBP the $40.27 yourself, directly. We never see or handle that payment.
Writing this page costs us customers — some readers will decide they do not need us, which is the correct conclusion for most people. We would rather that than be indistinguishable from the sites above.