What to Do After Entering Card Details on a Suspicious Website
Calm, ordered steps to take right now if you typed card details, a gift-card code or a password into a page that turned out to be fake — or clicked a phishing link.
Check a Website
Is this the right website for your card?
Before you type a card number, security code, gift-card code or billing address, use this checklist on the page you’re about to use. It takes about a minute and could save your balance.
The eight-question website check
This is an educational checklist, not an automated scanner. It never asks for card information, and your answers never leave this page.
Is the domain spelled correctly?
How to check: Read the address from the ending (.com, .net…) backwards. Compare the word just before the ending, character by character, with the address printed on your card or packaging.
Red flag: Extra words, hyphens, swapped letters (rn for m, 1 for l) or a different ending.
Did you reach the website from an official source?
How to check: Typing the address from your card, a receipt or a statement — or using a bookmark you made — is the strongest route.
Red flag: You arrived from a text, email, social post, pop-up, ad or a phone caller’s instructions.
Does the site clearly identify the company?
How to check: Look for a legal company name, terms, a privacy policy and contact routes that match your card.
Red flag: No company name, copied or contradictory policies, or contact details that differ from your card.
Does it request information that seems unnecessary?
How to check: A balance check or purchase needs only the details for that task.
Red flag: A PIN, your banking password, government ID, or photos of your card for a “free check”.
Is the checkout or balance page using HTTPS?
How to check: The address should start with https:// and your browser should show no warning. Remember: this is a minimum, not proof.
Red flag: A “not secure” label or a certificate warning on a page asking for card details.
Are there suspicious redirects?
How to check: After the page loads, read the address bar again. Is it still the site you meant to visit?
Red flag: You were bounced through several addresses or ended up on an unrelated domain.
Is the page creating urgency or threatening account loss?
How to check: Genuine issuers send alerts, but you can always verify calmly through the official app or the number on your card.
Red flag: Countdowns, “your card will be cancelled”, “your balance expires today”, or unexpected prizes.
Are there spelling or branding inconsistencies?
How to check: Real companies are usually consistent with names, logos and tone.
Red flag: Typos, blurry or mixed logos, odd grammar or a brand name that changes between pages.
Answer the questions about the site you are looking at.
Your answers stay on this page. Nothing is sent or saved.
Skill 1
How to read a web address
The address bar is the one thing a fake website can’t fully copy. Here’s an invented address, using a made-up brand and the reserved .example ending so that no real site is involved:
https://Connection- Encrypted connection. Necessary — but not proof of honesty.
balance.Subdomain- Chosen freely by whoever owns the domain.
mylabelRegistered name- The part that identifies the owner. Compare it with your card.
.exampleEnding- Must match exactly. .com, .co and .net would each be a different owner.
/gift/checkPath- Anyone can put any words here — including brand names.
Read from right to left. Find the ending (.example here), then the word right before it. That pair identifies who controls the page. Learn the lookalike tricks.
Skill 2
Reach the official site the safe way
Safer routes
- Typing the address printed on your card, packaging, receipt or statement
- A bookmark you created from one of those sources
- Your issuer’s official app from your phone’s app store
- The phone number printed on the back of your card
Riskier routes
- Links in texts, emails, chats or social media comments
- Sponsored search results for “balance check” or “card checker”
- Phone numbers shown on unfamiliar pages or in search snippets
- Instructions from someone who called you
Found a red flag? Do this instead
- Don’t enter — or re-enter — any card details on that page.
- Close the tab.
- Type the official address from your card or packaging into a new tab, or call the number on the card.
- If you already entered details, contact your issuer now using the number on your card.
- Report the page through your browser’s “report deceptive site” option or your national fraud reporting service.
Keep learning
How to Check if a Website Is Legit Before You Enter Card Details
A calm, repeatable routine for checking a website before you type a card number, gift-card code or billing address — no special tools required.
How to Find the Official Website for Your Card or Gift Card
The official website for your card is usually printed right on it. Here is how to find it, confirm it and avoid the lookalikes that sit between you and the real thing.