Online Shopping Safety Guide: 15 Tips to Shop Safely Online

To shop online safely, buy from stores you know or have checked, pay with a credit card rather than a debit card, use a unique password and two-factor authentication on every shopping account, and never click payment or delivery links in messages you did not expect. In the US, a credit card limits your liability for unauthorized charges to $50 at most, while a debit card reported late can cost you $500 or everything in the account (FTC). The 15 tips below cover the rest.

1. Beware of fake shopping websites

Fake stores copy real brands, advertise on social media, and take your card details without ever shipping anything. Even on big marketplaces such as Amazon and eBay, check who the seller is before you buy. Stolen card details and personal data can then be used for fraud and identity theft.

Common signs that a website is fake:

• The URL is suspicious. Legit online stores usually have unique names. Websites such as “prada-at-awesome-price.com” or “the-bestonlineshopping.com” sound too generic and are most likely to be operated by malicious hackers.
• Poor writing. A legit online shop uses proper grammar and vocabulary to improve the SEO and readability of its webpage. Always be suspicious of websites that have many grammatical errors in the product descriptions.
• Poor design/layout. Online stores, especially those in the fashion or electronics niche, need to be well-designed to attract customers. If a website that sells clothing or gadgets has a poor user interface, most likely it's not legit.
• Suspicious product list. Read the "About Us" page of an online shop and compare what it says to the products that they sell. If a clothing website has car accessories in its product selection, it's safer to buy somewhere else instead.
• Suspicious contact information. A legit online store usually uses a business email address (e.g. support@ebay.com) for its customer service. Suspicious websites use personal email addresses such as “ebaysupport@gmail.com”. When in doubt, read the information that is found in a website's "Contact Us" page.
• Product prices are suspiciously low. Online shoppers always find the lowest possible price for any product. This makes it easy for unsuspecting shoppers to get scammed by fake websites. If a store sells a new iPhone for $150, it is not legit.

If you are unsure, search the store's name with words like "scam" or "reviews" before you pay.

2. Check the web address, not just the padlock

HTTPS and the padlock icon mean the connection between you and the site is encrypted, so other people on the network cannot read what you type. They do not mean the store is honest: the FBI warns that scam sites use HTTPS too, so do not trust a site just because it shows a lock (FBI IC3).

Before you enter card details, check that the address bar shows the store's real domain, spelled correctly, and that it starts with https://. For example, this is what the address bar shows on Google:

Never enter payment details on a page without HTTPS, and treat a misspelled or unfamiliar domain as a reason to leave, padlock or not.

3. Use secure Internet connections

Wi-Fi is accessible nowadays, but that doesn't mean it's always safe. Connecting to an unsecured network lets a malicious hacker intercept all your Internet traffic. Everything that you input online can be tracked and stolen, especially your credit card information, personal address, and passwords.

Here are the common signs that you might be using an unsecure Wi-Fi connection:

• Open connection with no password protection. It doesn't matter how many people are using the Wi-Fi network; if it does not have a password, that means it's a nice target for even the simplest cybercriminals. Always do your online shopping in secure connections!
• It uses old WEP or WPA security. These older standards are easy to break. Prefer networks secured with WPA2 or, better, WPA3.
• The Wi-Fi router is in a public area. Cybercriminals are more likely to tamper Wi-Fi routers that are exposed in public places. Bars and restaurants that have a Wi-Fi hotspot are always full of people that connect to their network. Skilled cybercriminals can hack into open networks even if they are password-protected, so it's best to avoid online shopping while connected to public Wi-Fi.

4. Update your browser and operating system

Online shopping can be done on any device that can connect to the Internet. Keep the operating system (OS) on your phone, tablet, or computer up to date. Apps and devices that are updated to their latest versions have a higher chance of protecting your personal data whenever you shop online.

Turn on automatic updates for your operating system, browser, and apps. Security fixes arrive through these regular updates, so putting them off leaves known holes open.

Use reliable internet browsers such as Chrome, Edge, Firefox, Opera, and Safari. Whatever browser you choose, always update it to protect your search history and saved passwords.

5. Protect your card and bank accounts

Card numbers usually leak through data breaches at stores and payment processors, not through anything you did, so watch your accounts closely.

Always be on the lookout for suspicious activity when it comes to your bank account. These financial safety reminders should be kept in mind:

• Never give your card number by phone, email, or text to someone who contacted you first.
• Turn on purchase alerts in your bank or card app so you see every charge right away.
• Whenever you change your home address, notify the bank that issued your credit card as soon as possible.
• Enable two-factor authentication for payment methods if they are available.
• Keep the confirmation numbers and emails for all your online purchases.
• If you ever lose your credit card or even think that you only misplaced it, don't hesitate to lock it. It's easier to replace a lost credit card than lost money.

6. Use a VPN when browsing the Internet

If you can't avoid browsing on a public Wi-Fi network, use a Virtual Private Network (VPN) for an added layer of security. VPNs establish an encrypted connection between your computer and the Internet server. Any cybercriminals that are tapped into the public Wi-Fi will have a difficult time intercepting your data traffic. Be careful with free VPNs, which have to make money somehow, often from ads or your data, and read reviews before you pick one.

7. Keep antivirus protection turned on

Windows includes Microsoft Defender at no cost, and it runs automatically as long as you keep Windows updated. Paid suites from Avast, McAfee, and Norton add extras such as identity monitoring, a VPN, or web filtering that blocks known malicious sites; check their DealHack pages for discounts on a subscription.

8. Use a password manager to protect your personal accounts

We love to reuse the same password for multiple accounts because it's very convenient for most us. Whenever we create an account for an online store, we usually use the same password we have for our email and social media accounts. But using the same password can be dangerous.

The US Cybersecurity and Infrastructure Security Agency recommends a different password of at least 16 characters for every account, plus multifactor authentication on email and financial accounts, and a password manager to keep track of them (CISA). Options include Bitwarden, 1Password, Dashlane, and the password managers built into Apple devices and Google Chrome.

9. Keep an eye out for common hacker tricks

Having the right security programs will go a long way in improving your safety when buying things online.

But what will really take your internet shopping to the next (security) level is a good understanding of cybersecurity threats combined with a few common sense rules on what you should and should not do online.

A few habits that help:

• Avoid clicking on suspicious links especially in pop-ups or emails.
• Before using free software, search them on Google to check if they are legit.
• Report websites that are fake or have offensive content.
• Mark unwanted and suspicious emails as "spam" and never reply to them.
• Never provide more information than what is required to complete an online purchase.

Once you know the tactics that hackers usually use, you can avoid them entirely. This makes it harder for them to infiltrate your online accounts.

10. Never click on spam or phishing emails

Phishing emails and texts copy real stores and delivery companies, usually with an urgent problem: a missed delivery, a locked account, or a refund you need to claim.

The most common way for phishing emails to gather plenty of clicks is when they are attached with a fake offer for an appealing product. Impulsive shoppers are prone to click “Buy now” or "Order now". Many malware attacks begin with phishing emails.

Many people click on the "Unsubscribe" button when they don't want to receive certain emails anymore. Cybercriminals take advantage of this knowledge to create phishing emails with a fake "Unsubscribe" link.

If you come across a suspicious email, mark the email as spam. This moves it out of your inbox and helps your email provider filter similar messages. If you want to check an order, open the store's app or type its address yourself.

11. Monitor your transactions and hold on to your receipts

Shopping responsibly means that you keep a record of every product you bought online. This includes the date of purchase, price, and the website where you ordered them. Every detail counts, no matter how minor you think it may be.

Compare the cost of each product and the amount charged to your credit card for every purchase. You want to make sure that you were not overcharged for a particular order without prior knowledge.

Once you successfully place an order, keep the order confirmation number and receipt. These are usually sent to the email address that you're provided upon ordering. Receipts are important for order tracking and other possible concerns such as warranty and returns.

If you no longer need to keep some receipts, don't just leave them lying around in your house. Instead of just throwing them in the trash, shred them to leave no trace.

12. Be mindful of what personal info you share on shopping websites

Online stores only require the following to successfully process your order: payment information and shipping location.

Payment information includes your credit card number, expiry date, security code, and billing address. Be careful about saving payment methods to online store accounts because all it takes is one data leak and your finances will be in danger. Shipping location includes your street address and zip code. Some stores may also ask for your email address and phone number but these are only needed for tracking your orders.

It's best to avoid shopping at stores that ask for the following information: social security number, date of birth, and bank account number.

For extra protection, pay with a virtual card number if your bank offers one, or through PayPal, Apple Pay, or Google Pay, so the store never sees your real card number.

If you prefer not to give away the address to your home or office, you can ask the store if they allow orders to specific delivery points such as P.O. boxes. That way, you can pick up your order at a safe location and still manage to keep your privacy intact.

13. Avoid keeping too much personal information on your smartphone

These days, everybody stores a lot of important personal information on their phone, and most of us rarely take the time to secure them. These devices are now much less about calling people, and more about photos, social media and whatnot.

Increasingly, people shop online using their smartphone, but this carries its own risks. Fake online shops can infect your smartphone with malware, and then have access to information such as phone numbers, notes, photos, and even app contents.

For this reason, we recommend you keep as little information as possible on your phone, and instead rely on offline storage or cloud solutions.

14. Download reliable mobile shopping apps

Phones get malware too, most often from apps installed outside the official app stores or from links in texts.

If you prefer to shop on mobile apps instead of your computer, here are some useful tips:

• Download apps only from Google Play or the Apple App Store.
• Major retailers such as eBay, Amazon, and Walmart have their dedicated mobile apps. Download them if you want an easier shopping experience.
• Always keep your frequently used shopping apps updated to their latest versions.
• Take note of the app's permissions. If a shopping app requires your phone's contact list, messages, or microphone, don't allow access. These features are not required for online shopping.
• Read the customer reviews of a shopping app before you download it so you can be informed of its pros and cons.

15. Pay with a credit card, not a debit card

A debit card draws on your own money, so fraud empties your account while you wait for the bank to investigate. A credit card puts the bank's money at risk instead, and the law caps your liability.

Here are two major reasons why you should use credit cards for online shopping:

• Lower liability: in the US you owe nothing for unauthorized credit card charges reported before the card is used, and at most $50 after. With a debit card, you can lose up to $500 if you report after two business days, or more if you wait beyond 60 days after your statement (FTC).
• Disputes: if an item never arrives or is not as described, you can dispute the charge with your card issuer, and you do not have to pay the disputed amount while it is investigated.

What to do if you get scammed

Call your card issuer right away to dispute the charge and get a new card number, change the password on the affected account and any account that shares it, and report the scam: in the US at ReportFraud.ftc.gov, and in Canada to the Canadian Anti-Fraud Centre.