Safe online shopping starts before checkout. For U.S. shoppers, verify the seller and exact listing, calculate the total cost, choose a payment method with protections you understand, and keep records of the transaction. HTTPS, a VPN, multifactor authentication, and a virtual card each address different risks; none proves that a seller is legitimate or guarantees a refund.

A retailer's return policy, a marketplace guarantee, PayPal's process, a card issuer's procedures, and consumer law are separate systems. The deadline or evidence for one may not apply to another.

Check the store before you buy

Before entering payment details, review the offer:

  1. Start from a trusted address. Type the retailer's known web address yourself or use its official app. Be cautious with links in advertisements, social media posts, emails, and text messages.
  2. Inspect the domain. Look for misspellings, extra words, unusual endings, and characters substituted for letters. HTTPS may encrypt the connection, but it doesn't prove that the business is legitimate.
  3. Confirm the seller. Look for a real customer-service channel, business address, shipping information, and return policy. On a marketplace, identify the individual seller as well as the platform.
  4. Calculate the total price. Include shipping, handling, delivery charges, taxes, currency-conversion fees, and other checkout fees. The FTC's online shopping guidance recommends using well-known, trustworthy comparison-shopping sites and checking the full cost.
  5. Read the deal terms. Check for required memberships, automatic renewals, minimum quantities, final-sale language, and coupons that apply only after another purchase.
  6. Check delivery promises. Save the stated delivery date and shipping method. A low price may not be worthwhile if the item arrives too late or return shipping costs more than the product.
  7. Review the payment route. A seller that insists on a wire transfer, cryptocurrency, gift card, or another difficult-to-reverse method deserves extra scrutiny.

A countdown timer or large discount isn't proof of fraud on its own. Several warning signs together - such as an unfamiliar domain, no verifiable contact information, pressure to pay immediately, and a price far below comparable offers - are a good reason to leave.

Treat reviews as evidence, not proof

Read recent, detailed reviews on more than one platform. Focus on comments about the exact model, condition, shipping, and refund experience instead of relying only on an overall star rating.

Reviews can be incomplete, copied, incentivized, or unrelated to the specific seller. Confirm the product's model number, warranty, dimensions, and included accessories from the written listing. Product photos and polished demonstrations don't replace those details.

Recognize phishing messages and fake order notices

Scammers use fake delivery updates, refund notices, account-lock warnings, and limited-time offers to send shoppers to imitation sites. The safest response is not to use the message link.

Instead:

Check the full sender address rather than only the display name. Hovering over a link can reveal its destination, but don't open it if the address looks suspicious. A padlock in the browser doesn't make a phishing page safe.

If you entered a password on a suspicious page, change it immediately from the legitimate site. Change it anywhere else you reused it, enable multifactor authentication, and review recent account activity. If you entered card or bank details, contact the financial institution using the number on your card or statement.

Choose a payment method with a recovery plan

Payment methods don't provide identical protection. The right choice depends on the seller, purchase amount, and how quickly you can act if something goes wrong.

Payment method Potential benefit Important limitation
Credit card May separate the purchase from your bank balance and provide a billing-dispute process Deadlines and coverage depend on the type of problem, issuer, and account terms
Debit card Convenient and widely accepted Funds come directly from your bank account, so report suspicious activity promptly
PayPal May provide a separate purchase-protection process for eligible transactions Eligibility, evidence requirements, and deadlines apply
Virtual card number Hides your regular card number and can limit exposure at one retailer Some numbers have restrictions for subscriptions, refunds, or recurring charges
Gift card, wire transfer, or cryptocurrency May be requested for legitimate reasons in limited situations Payments can be difficult to reverse; an unfamiliar seller demanding one is a major warning sign

A virtual card reduces exposure of your primary card number, but it doesn't verify the merchant or guarantee a refund. Treat it as one layer of protection, not a substitute for checking the seller and terms.

Keep marketplace purchases inside the marketplace's checkout and messaging system when possible. Moving payment to a private channel can affect whether the platform's process applies. A platform guarantee, PayPal protection, and a card dispute may each have different conditions, so don't assume one process will cover the same loss as another.

PayPal deadlines differ from card-dispute deadlines

PayPal's U.S. Purchase Protection terms describe a separate company process. They state that a dispute must generally be opened within 180 days of payment, or within 30 days of delivery or fulfillment for applicable claims, whichever is sooner. Eligibility and deadlines vary by claim type. Check the current PayPal Purchase Protection terms and open a dispute promptly.

A PayPal claim isn't a universal replacement for contacting your card issuer. If a card funded the PayPal payment, ask the issuer how its process applies and follow its instructions. Provide accurate records, and don't assume that an approved merchant refund and a separate dispute will produce two recoveries.

Secure your account and checkout

Use unique passwords and multifactor authentication

Use a long, unique password or passphrase for every shopping account. A password manager can generate and store those credentials. Some password managers also match credentials to the saved site address, which can help prevent sign-in on a lookalike domain.

Turn on multifactor authentication for:

An authenticator app or security key is generally less exposed to phone-number takeover than text-message codes. SMS authentication is still better than no second factor when stronger options aren't available. Store recovery codes somewhere safe, and don't share them with anyone claiming to be customer support.

Your email account deserves special attention because it can often reset shopping and payment passwords. After a suspected compromise, review sign-in alerts, recovery addresses, forwarding rules, and logged-in devices.

Use a safe connection, but understand what a VPN does

For checkout, use a trusted home network or cellular data when possible. Public Wi-Fi can expose you to a fake hotspot or an attacker on the same network. HTTPS protects information sent to a properly configured site, but it doesn't protect you from a fraudulent store or a compromised device.

A VPN can create an encrypted connection between your device and the VPN provider. It may reduce exposure on an untrusted network, but it won't:

Choose a VPN based on the provider's privacy terms and your trust in that provider. You don't need a VPN simply because you're shopping online, and it isn't a guarantee of anonymity.

Private or incognito browsing has a narrower purpose. It usually limits local history and some stored browser data, but websites, internet providers, VPN providers, and other services may still observe activity. Incognito mode isn't a replacement for HTTPS, account security, or careful seller verification.

Share less information at checkout

Use guest checkout when you don't need an account. Provide only the information required to complete the order, and don't send card details by email, chat, or social media.

Before accepting a saved-payment option, consider whether you'll shop with that retailer again. On an unfamiliar site, avoiding stored card details can reduce the consequences of a later account breach. Turn on transaction alerts so an unexpected charge is noticed quickly.

Use shopping apps, voice tools, and virtual try-ons carefully

New shopping features can be convenient, but they don't remove the need to verify the seller and product.

Understand shipping, returns, and cross-border costs

Read these policies before placing the order:

Save a screenshot or PDF of the listing, checkout total, delivery promise, and return terms. Keep the order confirmation, tracking number, seller messages, and photographs of the item and packaging.

For U.S. purchases, the FTC says that if a seller doesn't promise a shipping time, it generally must ship within 30 days after receiving your name, address, and payment or permission to charge your account. That rule concerns shipment, not necessarily delivery to your door. A promised date shown during checkout is also worth preserving because it can help explain a later dispute.

Cross-border shopping adds uncertainty. Before paying, identify the seller's country and check:

Don't assume a U.S. shipping rule or consumer remedy applies to an overseas seller. Customs charges and return postage can change the real cost of a bargain.

What to do when an online order goes wrong

Act quickly and keep the process organized.

1. Preserve the evidence

Save the order number, receipt, product page, advertised price, delivery promise, seller profile, tracking history, messages, and photographs. Record when you contacted the seller and what resolution you requested.

2. Contact the seller through an official channel

Use the retailer's account page or contact details on its legitimate website, not a phone number or link from a suspicious message. State whether the problem is non-delivery, an unauthorized charge, damage, a missing part, or a product that differs from the listing. Ask for a specific remedy and keep the response.

3. Contact the payment provider

For an unauthorized charge, contact the card issuer or bank immediately and follow its fraud procedure. You may need to lock or replace the card and secure the related account.

For an order that never arrived or was materially different from the listing, contact the merchant first when practical, then use the payment provider's dispute or claim process. Don't wait until the seller's return window or the provider's deadline has expired.

4. Follow the correct credit-card dispute process

A merchant's return policy and a credit-card billing dispute are different processes. For covered U.S. credit-card billing errors, the FTC's billing-error guidance says to dispute the error in writing within 60 days of the date the first statement showing the error was sent.

Follow the issuer's instructions and send the dispute to the address designated for billing inquiries if one is provided. The issuer generally must acknowledge the dispute in writing within 30 days unless it has already resolved it. It generally must resolve the matter within two billing cycles, and no more than 90 days, after receiving the dispute.

During the investigation, you generally don't have to pay the disputed amount or related finance and other charges, but pay the undisputed portion of the bill on time. These rules apply to covered billing errors; they don't mean every disagreement with a seller will automatically qualify.

5. Escalate when appropriate

If the seller or platform doesn't resolve the matter, keep the case number and submit the evidence through the platform's official claim process or your card issuer's process. For suspected identity theft, contact the affected financial institutions, change exposed passwords, and consider a credit freeze or fraud alert through the major credit bureaus.

Safe-shopping checklist

Before clicking Place order, confirm:

Frequently asked questions

Is HTTPS enough to make online shopping safe?

No. HTTPS encrypts information sent between your browser and the website, but it doesn't establish that the seller is honest. Check the domain, business details, policies, reviews, and payment options separately.

Is a VPN better than incognito mode for shopping?

They solve different problems. Incognito mode mainly limits local browser history and some stored session data. A VPN can protect the connection between your device and the VPN provider on an untrusted network, but neither tool verifies a seller or protects a compromised account.

Should I use a credit card or debit card online?

A credit card may provide a more suitable dispute process for some purchases and doesn't take funds directly from your checking account. Debit-card protections and procedures vary, so use alerts and contact your bank quickly about suspicious activity. Review your issuer's terms before relying on either option.

What is the credit-card dispute deadline for an online purchase?

For a covered billing error, U.S. law generally requires a written dispute within 60 days after the first statement showing the error was sent. Contact the issuer promptly anyway, because other card benefits and dispute categories may have different requirements.

Does PayPal guarantee a refund?

No. PayPal Purchase Protection applies only to eligible transactions and requires the buyer to follow its process and deadlines. Check the current terms and open a dispute promptly if the seller doesn't resolve the problem.

Before paying, save the product page and checkout terms. If you already entered information on a suspicious page, stop using the message link and contact the financial institution through the number on your card or statement.