Pay a shop you do not know by credit card, even if it shows a padlock

A small padlock sits beside the web address, and it feels like a stamp saying this shop is real. It is not that. It means that what you send to the site is scrambled on the way, so nobody in between can read it. It says nothing about who runs the site.

Before you pay an online shop you do not know, read its web address letter by letter and pay by credit card if you can, because a padlock only means your connection is private, not that the shop is real.

This is for a shop you have never used. If you have already paid one you now doubt, go to the section “If you have already paid”.

What the padlock does and does not tell you

The UK government’s fraud campaign, Stop! Think Fraud, says a closed padlock, or https at the start of the address, means your connection to the site is secure, so what you enter is encrypted. It adds that neither guarantees the site is legitimate or reputable. The FBI said in a 2019 public warning that criminals are counting on people’s trust in the lock icon and https, and told people not to trust a website just because it has a lock icon or https. In 2023 the team behind a widely used browser wrote that the lock icon does not indicate that a site can be trusted, that nearly all phishing sites use https and so show the lock, and that it was replacing the lock with a settings icon, so your browser may not show a padlock at all. Phishing sites are fake sites built to steal logins and card numbers.

Some people warn that a site with a look-alike address can still show the padlock and steal what you type, such as logins and card numbers. Some people add that certificates are now free to get, so the padlock does not show that a business has invested in security.

The padlock still has one job. Stop! Think Fraud says that if the padlock or https is missing, or the browser says the site is not secure, you should not use the site. In a browser that no longer shows a padlock, the sign to stop is a “Not secure” warning beside the address. A padlock is not a reason to trust.

Check the address and the shop before you pay

Read the web address letter by letter. The NCSC says criminals copy a real shop’s design, logos and products, and use an address that is easy to mistake for the real one, such as the real shop’s name with extra words added. One person says look-alikes swap a letter for a number, or put a real shop’s name inside an address that belongs to someone else.

Do not use a link from an ad, text or email you did not expect. The NCSC says to type the shop’s official address if you know it, or to search for its name and read the results instead of clicking the top one. The FTC says to search for the seller’s name and the website address with words like review, complaint or scam.

Stop! Think Fraud lists other warning signs: a bargain price on a high-value item, a request to pay by bank transfer instead of by card or a trusted payment service, very little company information on the About us and Contact us pages, and no returns policy. It also warns that artificial intelligence can now make a polished, professional-looking page, so a good layout proves nothing.

At checkout, the NCSC says to fill in only the required details, to check out as a guest if you can, and not to let your browser remember your payment details. One person warns that autofill can fill in hidden fields on a site you do not trust.

Why a credit card

In the United States

The FTC says to pay by credit card when you can. If you are charged twice, billed for something you never got, or sent the wrong or a damaged item, you can dispute the charge with the card company. The law behind that is the Fair Credit Billing Act. The FTC says to write to the card company, at the address for billing questions rather than the one for payments, and that your letter has to reach it within 60 days after the first bill that shows the mistake. The company has to acknowledge your letter within 30 days and settle the dispute within 90, and while it looks into it you can hold back the disputed amount. For a charge you did not authorise, your loss is limited to $50, and the FTC says that if only your card number was taken, not the card, you are not responsible for it at all.

That law covers credit cards and similar revolving accounts. A debit card takes money straight from your account and falls under a different rule, and the rule depends on what was taken. If someone used your card number but you still have the card, the FTC and the CFPB say you are not responsible for payments you did not make. You must tell your bank within 60 days after it sends the statement that shows them. If the card itself was lost or stolen, your loss is limited to $50 if you tell your bank within two business days of finding out, and up to $500 if you tell it later. If you wait more than 60 days after the statement, the FTC says you could lose all the money taken. If you typed in the payment yourself and were tricked, that rule may not cover it, so tell the bank in writing anyway. The guide linked below explains how.

In the UK

The NCSC says to use a credit card if you have one, because many protect online purchases under the Consumer Credit Act. Citizens Advice says that if you paid by credit card for an item that cost more than 100 pounds and no more than 30,000 pounds, and you did not get what you paid for, you can ask your card provider for your money back under Section 75 of that Act. The limits apply to each item, not the whole order, and Section 75 usually does not apply if you bought through a third party, such as a marketplace or a payment service like PayPal. A debit card gives less protection, but you can ask for a chargeback, which is a voluntary scheme, and your bank may not agree. The NCSC says never to pay by direct bank transfer. If you use a payment service, the NCSC says to check its terms for what it covers.

Some people say a credit card is safer than a debit card or a direct transfer, because the card company’s dispute process covers fraud, while money sent by direct transfer or app often cannot be recovered once it is gone. In the UK that changed in October 2024: Citizens Advice says a bank should usually refund a transfer to a UK account you were tricked into. Some people warn that a credit card helps only if you can pay the bill, because interest on a balance can cost far more than any rewards are worth. If you have no credit card, this page does not suggest opening one for a single purchase. Use the protections you do have, and do not pay by bank transfer or gift card.

Money left in a payment app

Some people warn that a payment app can freeze an account, and say to move money out as soon as it arrives. The CFPB says the deposit insurance that protects a bank account generally does not cover money that sits in a payment app unless you have signed up for extra services from the app, and that if the company fails you might not get your money back in the same guaranteed way. Its advice is to use the app to send and receive, and to move what you receive into an insured bank, credit union or card account soon after.

If you have already paid

Call your bank or card company first, on the number on the back of your card, not a number from the shop. Say that you think you were scammed, when you paid and how. In the UK, if you paid by bank transfer, ask your bank for a refund: Citizens Advice says that since October 2024 it should usually repay you for a transfer to a UK account you were tricked into. Then report it. In the US, the FTC takes reports at ReportFraud.ftc.gov. In England, Wales and Northern Ireland, the NCSC says to report it as a crime to Report Fraud, and in Scotland to Police Scotland. If you also gave a password or a Social Security number, change the password and read the guide, I paid a scammer, or think I’ve been scammed, which covers the deadlines for both countries.

Who this page is not for

If you have already paid or typed in your details, the guide above is the page for you, not this one. If you are buying from a shop you know well, the risk is mostly a look-alike link in an ad or message, so type the address yourself. It does not cover public Wi-Fi, work computers, or selling through a payment app.