The FiveM Pre-Checkout Safety Checklist: 6 Things to Verify Before You Pay
Six checks, under two minutes, run before you ever enter card details. The first and most important: does the store's domain actually contain tebex.io?
The FiveM Pre-Checkout Safety Checklist: 6 Things to Verify Before You Pay
Fake FiveM script stores have been running long enough that they’ve gotten good at it. They copy product images from legitimate listings, write convincing descriptions, and register domain names that look plausible at a glance. If that level of effort goes into a scam, a quick scroll through a product page isn’t enough protection. Run this checklist before you enter payment details — it takes under two minutes and it catches real scams.
1. Does the Domain Contain tebex.io? (Most Important)
This is the first thing to check and the fastest to verify. Look at the browser address bar. If the store domain contains tebex.io — either as the full domain (like cars-tebex.io) or as a subdomain (like storename.tebex.io) — that’s the strongest single trust signal available. Tebex controls that namespace. A fraudster can’t register anything.tebex.io without Tebex’s platform access.
The scam stores use lookalikes. Common patterns include swapped letters (tebax.io), wrong TLDs (tebex.store, tebex.com, tebex.net), or injected words (tebex-fivem-shop.com). None of these variations give you what the real domain does: proof the store is running on Tebex’s actual infrastructure.
2. Is the Connection HTTPS With a Valid Certificate?
Click the padlock icon in your browser. You want a valid TLS certificate issued to the correct domain. If the browser shows “Not Secure,” a certificate warning, or a cert issued to a completely different domain, close the tab. Scam stores often move fast and cut corners on SSL configuration. A legitimate store on Tebex infrastructure will always serve HTTPS — there’s no scenario where a real store legitimately runs on plain HTTP.
Also check the cert issuer. Most Tebex-hosted stores use Let’s Encrypt or Cloudflare-issued certs. That’s fine. What’s not fine is a self-signed cert, an expired cert, or a cert whose Common Name doesn’t match what’s in your address bar.
3. Does Checkout Hand Off to the Real Tebex Flow?
When you click “Add to Cart” and proceed to pay, watch the address bar. Legitimate Tebex stores hand payment off to checkout.tebex.io. That URL change is the platform processing your payment — Tebex owns the billing, not the individual store owner. If you click checkout and the address bar stays on the store’s own domain, or redirects to an unrelated payment page asking for card details directly, that’s a red flag. Real stores don’t collect card numbers themselves; Tebex’s checkout handles it.
If the store claims to accept crypto-only, direct bank transfer, or payment via Discord — walk away. That’s not how any legitimate Tebex-integrated store processes sales.
4. Is There a Reachable Support Channel?
Look for a linked Discord server, a support ticket system, or at minimum a contact email that isn’t a throwaway free address. Open the Discord link and check: does the server have actual members, pinned changelogs, and a history of messages older than a few weeks? Scam stores spin up Discord servers that look populated but have no real activity older than the domain itself.
Stores like cars-tebex.io and qb-tebex.io maintain active support channels with documented update histories. That kind of audit trail takes time to build and can’t be faked quickly. If a store’s Discord was created this week and the domain is three months old, those timelines don’t add up.
5. Are the Prices Realistic?
Script pricing in the FiveM market has settled into recognizable bands: smaller standalone scripts run a few pounds, mid-tier systems (full job scripts, housing, gangs) sit higher, and large frameworks or MLO packs with custom interiors can reach three figures. If a store is selling an advanced police MDT, a full housing script, and a drug lab system as a bundle for the price of a coffee, those are leaked or stolen assets being resold without authorisation.
Leaked scripts are a specific problem because they often contain backdoors inserted by whoever ripped them. You’re not getting a discount — you’re paying to run unknown code on your server. Asset escrow through Keymaster only works for scripts sold through legitimate Tebex stores; leaked files bypass that entirely, so you have no delivery protection and no update path.
Stores like assets-tebex.io price against the market honestly. If a competitor is at a quarter of that price for the same category of asset, something is wrong with the product, not the market.
6. Is Keymaster / Asset Escrow Delivery Documented?
For any escrow-protected resource, the product page should explain how delivery works: the asset lands in your Cfx.re Keymaster account after purchase, linked to your server’s licence key. If a product page describes delivery as “a ZIP file sent to your email” or “download link in your Discord DM,” the asset is not escrow-protected. That’s either an open-source script being sold (check if it’s free first) or a leaked paid resource.
Escrow delivery requires the seller’s store to be properly integrated with the Cfx.re system — which requires a legitimate Tebex account in good standing. Scam stores can’t offer real Keymaster delivery because they don’t have that access. If the delivery method isn’t described or doesn’t mention Keymaster, treat that as an unanswered question and ask before paying.
The 90-Second Pre-Checkout Habit
Domain: Contains tebex.io? If yes, proceed. If no, apply full checklist scrutiny.
HTTPS: Padlock present, cert valid, cert domain matches address bar.
Checkout URL: Payment hands off to checkout.tebex.io.
Support: Discord or ticket system exists and has a real history.
Price: Sits in the realistic range for the category — not suspiciously below market.
None of these checks require technical knowledge. The domain check alone filters out the majority of scam stores operating in the FiveM scene right now, because the people running them know buyers don’t look at the address bar before clicking pay. Make it a habit and you won’t have to learn this lesson the expensive way.
