How do I pay by card online or at a fuel pump without getting scammed?

Two pages in this library cover the two places a card gets taken. Pay a shop you do not know by credit card, even if it shows a padlock is about the online shop. Turn on payment alerts: a tug on the card reader can miss a skimmer is about the machine in front of you, a fuel pump or a cash machine (ATM). Both pages begin with a check people trust, the padlock and the tug, and both say what that check cannot tell you. Both have a first step if the money has already gone, so that comes first.

If you have already paid a shop you now doubt, or typed your card number, a password or a Social Security number into it, call your bank or card company now, on the number on the back of your card, and say so. Then report it: at ReportFraud.ftc.gov in the US; to Report Fraud in England, Wales and Northern Ireland, or Police Scotland on 101 in Scotland. The guide I paid a scammer, or think I’ve been scammed has the deadlines and the words to say. If someone is threatening you, call 911 in the US or 999 in the UK. If this has you thinking about ending your life, call or text 988 in the US, or call Samaritans on 116 123 in the UK, at any hour. If you might act on it now, call 911 in the US or 999 in the UK. If you see someone fitting or removing a device on a fuel pump or cash machine, stay away from them and tell the staff or the police; call 911 in the US or 999 in the UK if it is happening now. If a charge you did not make has already appeared on your card, call the number on the back of the card now and say so.

Before you pay an online shop you do not know, read its web address letter by letter and pay by credit card if you can, because a padlock only means your connection is private, not that the shop is real. The UK government’s fraud campaign, Stop! Think Fraud, says a closed padlock, or https at the start of the address, means your connection to the site is secure, so what you enter is encrypted. It adds that neither guarantees the site is legitimate or reputable. The FBI said in a 2019 public warning that criminals are counting on people’s trust in the lock icon and https, and told people not to trust a website just because it has a lock icon or https. In 2023 the team behind a widely used browser wrote that the lock icon does not indicate that a site can be trusted, that nearly all phishing sites use https and so show the lock, and that it was replacing the lock with a settings icon, so your browser may not show a padlock at all. The padlock still has one job: Stop! Think Fraud says that if the padlock or https is missing, or the browser says the site is not secure, you should not use the site. A padlock is not a reason to trust.

Read the web address letter by letter. The NCSC (the UK’s National Cyber Security Centre) says criminals copy a real shop’s design, logos and products, and use an address that is easy to mistake for the real one, such as the real shop’s name with extra words added. Do not use a link from an ad, text or email you did not expect. The NCSC says to type the shop’s official address if you know it, or to search for its name and read the results instead of clicking the top one. The FTC says to search for the seller’s name and the website address with words like review, complaint or scam. Stop! Think Fraud lists other warning signs: a bargain price on a high-value item, a request to pay by bank transfer instead of by card or a trusted payment service, very little company information on the About us and Contact us pages, and no returns policy. It warns that artificial intelligence can now make a polished, professional-looking page, so a good layout proves nothing. At checkout, the NCSC says to fill in only the required details, to check out as a guest if you can, and not to let your browser remember your payment details.

Why a credit card, in the United States. The FTC says to pay by credit card when you can. If you are charged twice, billed for something you never got, or sent the wrong or a damaged item, you can dispute the charge with the card company, under the Fair Credit Billing Act. The FTC says to write to the card company, at the address for billing questions rather than the one for payments, and that your letter has to reach it within 60 days after the first bill that shows the mistake. The company has to acknowledge your letter within 30 days and settle the dispute within 90, and while it looks into it you can hold back the disputed amount. For a charge you did not authorise, your loss is limited to $50, and the FTC says that if only your card number was taken, not the card, you are not responsible for it at all. A debit card falls under a different rule. If someone used your card number but you still have the card, the FTC and the CFPB say you are not responsible for payments you did not make, and you must tell your bank within 60 days after it sends the statement that shows them. If the card itself was lost or stolen, your loss is limited to $50 if you tell your bank within two business days of finding out, and up to $500 if you tell it later. If you wait more than 60 days after the statement, the FTC says you could lose all the money taken. If you typed in the payment yourself and were tricked, that rule may not cover it, so tell the bank in writing anyway.

In the UK, the NCSC says to use a credit card if you have one, because many protect online purchases under the Consumer Credit Act. Citizens Advice says that if you paid by credit card for an item that cost more than 100 pounds and no more than 30,000 pounds, and you did not get what you paid for, you can ask your card provider for your money back under Section 75 of that Act. The limits apply to each item, not the whole order, and Section 75 usually does not apply if you bought through a third party, such as a marketplace or a payment service like PayPal. A debit card gives less protection, but you can ask for a chargeback, which is a voluntary scheme, and your bank may not agree. The NCSC says never to pay by direct bank transfer. In the UK, Citizens Advice says a bank should usually refund a transfer to a UK account you were tricked into; that changed in October 2024. A credit card helps only if you can pay the bill: some people warn that interest on a card balance can cost far more than any rewards are worth, and the page does not suggest opening a card for a single purchase. If you have no credit card, use the protections you do have, keep the receipt and the order confirmation number, which the FTC says can help you get your money back, and do not pay by bank transfer or gift card. The FTC says that if a seller says you can only pay with a gift card, wire transfer, payment app or cryptocurrency, it is probably a scam. The CFPB says the deposit insurance that protects a bank account generally does not cover money sitting in a payment app unless you have signed up for extra services from the app, and advises using the app to send and receive and moving money you receive into an insured bank, credit union or card account soon after.

At a fuel pump or cash machine, a tug on the card reader can catch a skimmer that is loose, but a reader that does not move may still be bad, so turn on a payment alert for every card you use, and pay by chip or tap where you can. A skimmer is a device criminals fit to a card reader to copy what is on your card. The FTC says that you will not know your information has been stolen until you get your statement or an overdraft notice, and that is why a payment alert helps. In a 2018 consumer alert, the FTC tells drivers to look at the card reader and see whether it looks different from the others at the station, and to try to wiggle it before putting in a card; if it moves, tell the attendant and use a different pump. Officials say the check has limits. Los Angeles County’s Department of Consumer and Business Affairs said in 2023 that most skimmers at cash machines and shop terminals fit over the original reader, but at fuel stations they can also be hidden inside, behind the reader. The Kansas Department of Agriculture says criminals have been breaking into pump cabinets to fit them, and that tape on a cabinet cannot stop a criminal but will show you if it was opened. The Pennsylvania State Police said in a 2022 bulletin that devices called shimmers fit inside the machine and copy information from the chip. If a reader moves, looks different, or has a loose slot, do not use it.

What helps more, from the page. Switch on a payment alert for each card: Report Fraud says that if you have online banking or an app, you should set up notifications so one arrives whenever you make a payment, “so you know when it wasn’t you”; with no app, it says to check your bank statements regularly and to report any payment you do not recognise to your bank immediately. Use tap or a phone wallet, or the chip: the Pennsylvania State Police says to use tap-to-pay or a phone wallet whenever possible, because those are very difficult for criminals to intercept, and to use the card’s magnetic stripe only as a last resort; the Kansas Department of Agriculture says a card is still open to misuse online or if it is swiped at a reader that has no chip. At a fuel pump, pay inside if you are worried; the FTC says so, and the Texas Department of Licensing and Regulation says to choose a pump close to the building and in the clerk’s line of sight, though the Kansas Department of Agriculture says thieves can also fit skimmers to cash machines and to the card reader at the counter. In the US, if you use a debit card at a pump, do not type a PIN: the FTC says to run it as a credit card instead, so the PIN is safe and the money is not taken from your account at once. The Texas Department of Licensing and Regulation goes further, saying to use a credit card or choose credit, and never to use a debit card. At a cash machine, the UK government’s fraud campaign says to stand close and cover the keypad with your wallet or your other hand, and not to let anyone distract you while you enter your PIN. The Pennsylvania State Police lists signs of tampering at a fuel pump or cash machine: components that look or feel different from most of the machine, a broken tamper-resistant seal on the fuel pump, graphics that are not aligned correctly, machines side by side that look different, and buttons that do not work correctly or are hard to press; it says that if any of these seem to be the case, do not use that machine. Report Fraud says to report a cash machine that looks unusual or tampered with to the bank as soon as possible, and Los Angeles County’s department says to tell the business and the local police about a reader that wiggles or seems loose. If a cash machine keeps your card, Report Fraud says to tell your card company straight away, ideally by mobile phone while you are still in front of the machine, and to keep your card company’s 24-hour number saved in your phone.

Two ideas do less than they sound. The Pennsylvania State Police’s bulletin says an unfamiliar Bluetooth device with a long string of random characters that is trying to connect to your phone could be a skimmer; one person who says they work in security, and that what they know comes from reading online, says most skimmers use no Bluetooth at all, and the page could not check that. A scan that finds an odd device is a reason to use another machine, and a scan that finds nothing does not clear the reader. Many people suggest writing a made-up PIN on the card; some say it does little, because a thief can use the card details without any PIN, and none of the official pages read for the page suggests it.

If a charge is not yours, call the number on the back of your card now and ask what they need from you. When a card is skimmed you usually still have it, and only its details were copied. In the US, the FTC says you are not responsible for credit card charges you did not authorise. For an ATM or debit card, it says you are not responsible if you report within 60 calendar days after your statement is sent to you; after that, you could lose all the money taken from your account, and possibly more. In the UK, Report Fraud says to report any payment you do not recognise to your bank immediately. A card that takes money straight from your account, such as a debit card, can leave your own money missing while the claim is checked; the library has a page on that, Whose money is missing while the fraud is sorted out? Then report it: in the US at ReportFraud.ftc.gov, which says it cannot resolve your individual report; in England, Wales and Northern Ireland to Report Fraud, online or on 0300 123 2040; in Scotland through 101. If your bank will not put it right, the Consumer Financial Protection Bureau takes complaints about banks in the US, and the Financial Ombudsman Service looks at them in the UK. In England and Wales, the Citizens Advice consumer helpline, 0808 223 1133, says its advisers can give advice on how to resolve a consumer problem. In Scotland, Advice Direct Scotland is on 0808 800 9060. In Northern Ireland, Consumerline is on 0300 123 6262. If you typed a password into a shop you now doubt, change it. If someone has used your Social Security number or other details, IdentityTheft.gov is where you tell the FTC and get a recovery plan.

Who this is not for. If you have already paid or typed in your details, the guide above is the page for you. If you are buying from a shop you know well, the risk is mostly a look-alike link in an ad or message, so type the address yourself. If someone you know used your card, or you shared your PIN, the steps are different; ask your bank before you assume you are covered. If the card is an EBT card for food or cash benefits, the pump page does not cover it: USDA says federal replacement of SNAP benefits stolen by skimming ended for thefts after 20 December 2024, so call the number on the back of the card, or your state’s benefits office, to report it and ask what help your state gives. Neither page covers public Wi-Fi, work computers, or selling through a payment app. Outside the US and the UK, the rules and numbers differ, and the pages do not list them.