You shop online safely by confirming the seller is real, checking that the connection is encrypted, paying with a method that limits your losses, and reading your statements afterward. A padlock alone proves very little. Attackers use fake sites, fake emails and unpatched devices, so each step covers a different gap.
Why does online shopping attract attackers?
Online shopping is convenient for you and for the people who want your card details. CISA's guidance on shopping safely describes three common routes: fraudulent sites and email messages, interception of insecure transactions, and attacks on vulnerable computers. A store that does not encrypt, or a laptop that is missing patches, gives an attacker a way in without any trickery at all.
The first route is the one most people meet. In a physical shop you can see that the store is the store. Online, a page can copy a brand's logo and layout in an afternoon.
How do you tell a real seller from a fake one?
Start before you type anything into a form. CISA advises dealing with reputable, established vendors and verifying legitimacy before you supply information. It also suggests noting a vendor's phone number and physical address in case a problem comes up later.
Here is a constructed example. You search for a pair of running shoes and land on a page whose address is the brand name with one extra word and a different ending. The prices are 70 percent below everywhere else. Each of those is a reason to stop, not a reason to hurry. Type the brand's address yourself, or use a bookmark, and compare.
Be just as careful with email. CISA warns about messages that request personal information, and about attackers posing as charities around holidays and disasters. If a message says your order has a problem, open the store's site directly instead of following the link.
Does the padlock mean a site is safe?
No. An address starting with https and a closed padlock mean your data is encrypted on its way to the site. CISA notes that this is worth looking for, and also that attackers can obtain a certificate for a malicious site and some even draw a fake padlock into the page. Encryption protects the trip. It says nothing about whether the party at the other end deserves your card number.
CISA suggests reviewing the certificate's "issued to" field when you are unsure. In practice that is a second check on top of the address, not a replacement for it.
Which payment method protects you most?
CISA points out that debit cards pull money straight from your bank account, so an unauthorized charge can leave you short for other bills. It recommends considering a single credit card with a low limit for online purchases, which caps what a thief can take. The same advice applies to payment gateways: pay through one with a credit card behind it.
Shopping apps and gift cards deserve a caution of their own. CISA says there is no legal limit on your liability for money stored in a shopping app or on a gift card, and that unless the terms say otherwise you are responsible for charges made through the app. Do not leave large balances sitting there.
What about your own devices?
The third route in CISA's list is your computer. Keep the operating system, browser and apps updated, and run the protection your platform provides. A shopper who types a card number into a machine that already carries a keylogger has lost before checkout.
How to check or apply this
- Reach the store by typing its address or using a bookmark, not through an ad or an email link.
- Compare the address letter by letter. Look for added words, swapped letters and odd endings.
- Save the seller's phone number and physical address before you buy.
- Treat the padlock as a minimum. If something feels off, look at the certificate's "issued to" field.
- Pay with a low-limit credit card or a gateway backed by one. Avoid debit for online purchases.
- Check the privacy policy before handing over personal details, and keep confirmation pages.
- Compare each purchase to your statement and report any mismatch right away.
- Keep devices patched.
Quick check
Is a site with a padlock safe to buy from?
Not necessarily. The padlock shows that the connection is encrypted. Attackers can get certificates for malicious sites, so you still need to verify the seller itself.
Should I use a debit card for online purchases?
CISA advises against it where possible, because debit charges come straight out of your bank account. A credit card with a low limit limits the damage from fraud.
What should I do if my statement shows a charge I do not recognize?
Report the discrepancy to your card issuer immediately, and keep your order confirmations so you can compare them with the statement.
Sources
- CISA, Shopping Safely Online (released 1 February 2021, now archived), fetched 18 October 2026.
Last reviewed: 18 October 2026.
