Safe Online Shopping: Plain-English Steps to Stay Safe

Fake shops, too-good-to-be-true adverts and payment tricks cost shoppers money every day, and most losses could have been avoided with a few simple habits. This guide explains, in plain English, how to check a website or seller before you buy, which ways of paying give you the most protection, how to keep your shopping accounts safe, and what to do quickly if something goes wrong. It is written for individuals, families, older people and very small businesses that buy online. The advice follows the UK National Cyber Security Centre (NCSC), the US Federal Trade Commission (FTC) and Get Safe Online. For organisations that run online shops, see the Cybersecurity for Retail and Ecommerce Guide.

Key takeaways

Check the shop before you pay. Look at reviews from sources you trust, search the shop name with the word "scam" or "complaint", and watch for web addresses that are one letter different from a real retailer.
Pay by credit card when you can. In the UK, section 75 of the Consumer Credit Act 1974 makes the card company jointly responsible for single items priced over £100 and up to £30,000.
Never pay by bank transfer, gift card or cryptocurrency to a seller you do not know. These are the methods scammers ask for because the money is very hard to get back.
Protect the accounts behind your shopping. Use a different strong password for your email, shopping and payment accounts, and turn on two-step verification.
Act fast if it goes wrong. Call your bank using the number on your card, then report it: Report Fraud in England, Wales and Northern Ireland, Police Scotland on 101, or ReportFraud.ftc.gov in the US.

Check the shop before you buy

Most shopping scams start with a fake website or a fake seller on a marketplace or social media. A fake shop can look very professional. The checks below take two or three minutes.

Type the address yourself: the NCSC advises not to click unexpected links in emails, texts or adverts. Type the shop's known address into your browser, or search for it and check the results rather than clicking the top one, which may be a paid advert.
Read the web address carefully: fake shops use lookalike addresses, such as an extra word, a swapped letter or a different ending (for example ".shop" instead of ".co.uk").
Look for reviews in more than one place: the FTC warns that star ratings alone are not enough because some reviews are fake. Search the shop's name with "scam", "complaint" or "review".
Check there is a real business behind it: Get Safe Online suggests confirming the shop has a physical address and a phone number, and reading its returns and privacy policies.
Be suspicious of big discounts on famous brands: the FTC notes that brand-name items at bargain prices may be counterfeit or stolen.
Know what the padlock means: a padlock and an address starting "https" only mean your connection is encrypted (scrambled so others cannot read it). It does not prove the shop is genuine. Get Safe Online adds that the padlock should be in the browser's address bar, not drawn on the page itself.

Warning signs of a fake shop or seller

Prices far below every other shop, often with a countdown timer or "only 2 left".
The shop was advertised to you through a social media post or an unexpected email or text.
Only bank transfer, gift cards or cryptocurrency are accepted, or you are asked to pay outside the website.
No address, no phone number, or contact only through a web form or messaging app.
Poor spelling, copied photos, and returns policies that are vague or missing.
A marketplace seller who asks you to pay with PayPal "Friends and Family". Get Safe Online warns this removes PayPal's buyer protection.

Pay the safe way

How you pay decides how easily you can get your money back. This is the single most important choice you make when shopping online.

Payment method	How much protection	What to know
Credit card	Strongest	UK: section 75 covers single items priced over £100 and up to £30,000. US: the FTC says to dispute errors in writing within 60 days of the first bill that shows the problem.
Debit card	Some	No section 75 cover, but the NCSC says you may be able to get a refund through "chargeback", a process your bank runs with the card network.
PayPal, Apple Pay, Google Pay	Depends on the service	The NCSC advises checking each service's terms to see what cover it gives. Avoid "Friends and Family" payments to sellers.
Bank transfer	Very little	The NCSC says never pay by direct bank transfer to an online shop. Scammers prefer it.
Gift cards, wire transfer, cryptocurrency	Almost none	The FTC warns these are common scam payment methods. No genuine shop insists on them.

Use guest checkout: the NCSC suggests checking out as a guest unless you will shop there often, and filling in only the details that are required.
Do not let the browser or shop store your card: the NCSC advises against saving payment details in your browser or in shop accounts.
Avoid public Wi-Fi for payments: Get Safe Online recommends not paying over unsecured Wi-Fi, such as free café networks. Use your mobile data instead.
Check the total price: the FTC reminds shoppers to compare the full cost, including delivery, tax and fees, before paying.

If anyone, even someone claiming to be from your bank, tells you to move money to a "safe account", it is a scam. See the Authorised Push Payment (APP) Fraud Guide for how these scams work.

Keep your shopping accounts secure

Criminals do not always need a fake shop. If they get into your email or shopping account, they can order goods using your saved details, change the delivery address, or reset your other passwords.

Secure your email first. Your email account can reset every other password, so give it a long, unique password and turn on two-step verification.
Use a different password for every shop. The NCSC advises strong, unique passwords for shopping, banking, payment, email and social media accounts. A password manager makes this easy. See the Password Managers Explained for Everyone Guide.
Turn on two-step verification (also called two-factor authentication) on Amazon, eBay, PayPal and any shop that offers it. It asks for a code or a tap on your phone as well as your password. See the Two-Factor Authentication for Everyone Guide.
Remove saved cards you do not need from shop accounts, and close accounts with shops you no longer use.
Log out on shared devices. Get Safe Online notes that closing the browser is not always enough.
Keep your phone and computer updated so security fixes are installed.

Spot delivery and marketplace scams

Busy shopping times, such as Black Friday and Christmas, bring a rise in messages pretending to be from delivery companies or big shops.

"Missed delivery" texts: a message asking you to pay a small "redelivery fee" through a link is a common trick to collect card details. Check any delivery by going to the courier's or shop's own website or app yourself.
Fake order problems: emails saying your account is locked or an order failed often lead to fake login pages. Open the shop's app or type its address instead of clicking.
Marketplace sellers: on Facebook Marketplace and similar sites, pay through the platform's own checkout or a payment service with buyer protection, and see big items in person before paying.
Social media adverts: adverts for designer goods or electronics at huge discounts often lead to fake shops. The NCSC says you can report scam adverts to the Advertising Standards Authority.
Forward, do not reply: in the UK, forward suspicious emails to [email protected] and suspicious texts free to 7726. See the Phishing Guide for more examples.

Keep records and watch your statements

Good records make it much easier to get your money back.

Save the evidence: the FTC advises keeping the order details, the returns policy, delivery promises, every message with the seller and your payment statement. A screenshot of the product page is useful because fake shops often disappear.
Know the delivery rules: in the US, the FTC says sellers must ship within the time they promised, or within 30 days if no time was given.
Check statements every week or two: Get Safe Online recommends reviewing card and bank statements for charges you do not recognise. Banking app alerts for each payment make this quick.
Check privacy settings in shopping apps: the FTC suggests reading what data an app collects and limiting location tracking in your phone's settings.

What to do if it goes wrong

Call your bank or card company straight away using the number on the back of your card or on its official website, not a number from an email or text. Ask them to stop the card if needed and to start a section 75 claim or chargeback.
Try the seller first if the shop is real and the item is late, faulty or not as described. The FTC advises raising it with the seller, then disputing with your card company in writing if that fails.
Change passwords on any account where you typed your password into a suspicious page, starting with email, and turn on two-step verification.
Report the fraud. UK: Report Fraud (England, Wales and Northern Ireland, 0300 123 2040) or Police Scotland on 101. US: ReportFraud.ftc.gov. Report the fake website to the NCSC.
Watch for follow-up scams. People who have lost money are often contacted by "recovery" services promising to get it back for a fee. Genuine police and banks do not charge for this.
If you gave away personal details such as your date of birth or address, see the Credit Freezes and Fraud Alerts Guide and the Identity Theft Recovery Guide.

Where to get help

NCSC (UK): shopping online securely guidance, and the Suspicious Email Reporting Service ([email protected]).
Report Fraud (England, Wales, Northern Ireland): reporting and victim support, 0300 123 2040. In Scotland call Police Scotland on 101.
Citizens Advice (UK): help with getting money back for goods that did not arrive or were not as described.
Get Safe Online (UK): plain-English advice on safe shopping and payments.
FTC (US): online shopping advice, and reporting at ReportFraud.ftc.gov.
FBI IC3 (US): the Internet Crime Complaint Center for reporting online fraud.

Common failure patterns

Paying by bank transfer to save a few pounds: a seller offers a discount for paying "direct". This removes almost all protection, and fake shops use it on purpose.
Trusting the padlock: people see "https" and assume the shop is real. Scam sites use https too.
Clicking the advert or the text link: buying through a link in a social media advert or a delivery text, rather than going to the shop directly.
Reusing one password everywhere: when one shop is breached, criminals try the same email and password on other shops and on your email account.
Waiting too long: card disputes have time limits, such as the FTC's 60-day window in the US, and the sooner the bank knows, the better your chances.
Moving off the platform: agreeing to pay a marketplace seller by message or "Friends and Family" loses the platform's buyer protection.

Practitioner checklist

Use this simple checklist each time you buy from a shop you have not used before.

I went to the shop by typing its address or searching, not by clicking an advert or message.
I checked the web address spelling and read reviews from more than one source.
The shop has a real address, a phone number and a clear returns policy.
I am paying by credit card, or a payment service with buyer protection, never by bank transfer, gift card or cryptocurrency.
I am using guest checkout or I did not save my card details.
My email and shopping accounts have unique passwords and two-step verification turned on.
I saved the order confirmation, a screenshot of the product page and the returns policy.
I will check my statement for this payment and know to call my bank straight away if anything looks wrong.

Safe Online Shopping Guide: Plain-English Steps to Stay Safe