Safe Online Checkout Checklist: What to Check Before You Pay

Before you reach the checkout

• Did you arrive by typing the address, from a bookmark or from a trusted app?
• Does the domain match the business you think you are buying from?
• Is the business identifiable — company name, returns policy, contact details?
• Are prices plausible? Extreme discounts on in-demand products are a classic lure.

When a website should ask for card details

A website should ask for card details only when you are knowingly paying for something, starting a subscription you chose, or adding a card to an account you control. It should not ask for card details to:

• “Verify your identity” for a prize, survey or giveaway.
• “Check” whether your card is valid.
• “Unlock” a parcel delivery you weren’t expecting, except through the carrier’s verified site for a known charge.
• Read an article, view a file or claim a refund.

At the checkout page

Many merchants use a payment provider, sometimes called a payment gateway. You may see the card form embedded in the page, or be redirected briefly to the provider’s page. Either can be legitimate. What matters is that the address you end up on belongs to the merchant or a recognizable payment provider, and that you reached it from the merchant’s own site.

• The page uses HTTPS and the domain is what you expect.
• The total, currency and any recurring charges are clearly shown.
• You are not asked for your card PIN — online card payments do not use it.
• You are not asked for your online banking password inside the merchant’s page.

3-D Secure: the extra confirmation step

3-D Secure is an industry protocol that lets your issuer confirm a purchase, for example with a prompt in your banking app or a one-time code. You might see it named by the card network. It is a legitimate and helpful step — but scammers imitate it too.

Digital wallets and tokenization

Digital wallets such as Apple Pay and Google Pay use tokenization: the merchant receives a substitute number (a token) instead of your actual card number, and payments are typically confirmed with your device’s biometrics or passcode. If a merchant is breached, your real card number is less exposed.

Wallets reduce risk at the payment step, but they do not make a fake shop real. You can still be persuaded to pay for goods that never arrive, so the website checks still matter.

Common mistakes

Approving prompts on autopilot

Read the merchant name and amount every time.

Paying by gift card for goods

Legitimate shops rarely demand gift cards as payment.

Saving cards on unfamiliar sites

Only save card details on accounts you use regularly and trust.

What to do next

• Use our website checklist for any shop you haven’t used before.
• Turn on transaction alerts with your issuer.