Use a credit card, not a debit card, for online purchases

A credit card offers legal protection that a debit card does not. If someone uses your credit card number fraudulently, federal law limits your liability to $50, and most card issuers waive that fee entirely. If someone drains your debit card account, the money comes directly from your bank account, and you may not recover it even if you report the fraud quickly.

Credit cards also let you dispute a charge if the merchant never sends what you ordered, sends something broken, or misrepresents what they're selling. Your card issuer can reverse the charge while they investigate. With a debit card, you have to prove the merchant's wrongdoing before your bank returns your money — if they do at all.

This protection applies whether you shop on a major retailer's website or a small business site. The card type matters more than the merchant's size.

Key Takeaways

  • Credit cards limit your fraud liability to $50 by law, while debit cards put your bank account at direct risk with weaker recovery protections.
  • Look for the padlock icon and "https://" in the address bar before entering your card number — these show the site encrypts your data in transit.
  • Never use public Wi-Fi to enter your card details; use your phone's cellular data or wait until you're on a secure home network.
  • Check your card statement monthly for charges you don't recognize, and report them to your card issuer within 60 days to dispute them.
  • Create a unique, strong password for each shopping site you use, and consider using your card issuer's virtual card number feature if available.

Check for encryption before you enter your card number

Before you type your credit card details into any website, look at two things: the address bar and the payment page itself. The address should start with "https://" (not just "http://"), and there should be a small padlock icon next to it. These signals mean the site encrypts data you send, so your card number doesn't travel across the internet in plain text.

The padlock alone is not enough. A site can have encryption but still be fraudulent. The padlock means the connection is secure; it does not mean the business is legitimate. Always verify you're on the real website by typing the address directly into your browser rather than clicking a link in an email or text message. Scammers create fake sites that look identical to real ones and use links to send you there.

If you're unsure whether a site is real, search for the company's name plus "scam" or "fake" and see what comes up. Call the company's phone number from their official website (not from a search result) and ask whether they operate the site you're looking at.

Avoid entering your card on public Wi-Fi networks

Public Wi-Fi at coffee shops, airports, libraries, and hotels is not encrypted. Anyone on the same network can intercept data you send, including your credit card number. Even if the shopping site uses encryption, someone on the Wi-Fi network can still see what you're doing and potentially capture your information.

If you're shopping on your phone, use your cellular data instead of connecting to the Wi-Fi. If you're on a computer and must use public Wi-Fi, wait until you get home or to a secure network before entering your card details. The few minutes you save by shopping now are not worth the risk.

A VPN (virtual private network) encrypts all your data on public Wi-Fi, but free VPNs are often unreliable or sell your data to advertisers. If you use public Wi-Fi regularly, a paid VPN from a reputable provider is worth the cost — but the simplest rule is to avoid entering card details on public networks altogether.

Use unique, strong passwords for each shopping site

If a retailer's website gets hacked and passwords are stolen, hackers will try that same password on your email, bank, and other shopping sites. A unique password for each site means a breach at one retailer does not compromise your other accounts.

A strong password is at least 12 characters long and mixes uppercase letters, lowercase letters, numbers, and symbols. "MyDog2024!" is stronger than "password123". A password manager like Bitwarden, 1Password, or Dashlane stores unique passwords for each site so you only have to remember one master password. Most are free or cost a few dollars per month.

If a shopping site offers the option to log in with your Google, Apple, or Facebook account instead of creating a new password, that can be convenient — but only if you use a strong password for that main account. You're shifting the security burden rather than eliminating it.

Consider using a virtual card number when available

Many credit card issuers now offer virtual card numbers — temporary, unique numbers linked to your real account that work for one purchase or one merchant. If a retailer's database is hacked, the stolen virtual number is useless because it's already expired or tied to only that one transaction.

Chase, American Express, Capital One, and Citi all offer this feature to some cardholders, though the name varies (Chase calls it "Chase Pay," Amex calls it "Virtual Card Numbers"). Check your card issuer's website or app to see if it's available to you. If it is, use it for any site you're shopping on for the first time or any site with a less established reputation.

Virtual numbers do not replace the need for a strong password or a secure connection, but they add a layer of protection. You can still dispute a charge if the merchant misrepresents what they're selling, even if you used a virtual number.

Review your statement monthly and report fraud within 60 days

Check your credit card statement at least once a month for charges you don't recognize. The sooner you spot fraud, the sooner you can report it. Federal law gives you 60 days from the date the charge appears on your statement to report it; after that, you may lose your right to dispute it.

When you find a fraudulent charge, call the number on the back of your card or log into your card issuer's website and report it through their fraud center. Do not call a number from an email or text message claiming to be from your card issuer — scammers use fake fraud alerts to steal more information. Your card issuer will cancel your current card, issue a new one, and reverse the fraudulent charge. This usually takes a few days to a few weeks.

While the dispute is being investigated, you are not responsible for the fraudulent charge. Your card issuer covers it. Keep records of any communication with the card issuer in case you need to follow up.

Never share your full card number, expiration date, or CVV in email or text

Legitimate merchants never ask for your card details by email, text, or phone call. If someone contacts you claiming to be from a retailer or your bank and asks for your card number, it is a scam. Hang up or delete the message.

The only time you should enter your full card number, expiration date, and CVV (the three-digit code on the back) is on an encrypted checkout page of a website you trust, or by phone directly to a merchant you called yourself. Even then, verify you're talking to the real company by using a phone number from their official website.

If you receive a suspicious email or text claiming to be from a retailer, forward it to the company's fraud team directly (search their website for a fraud reporting email address). Do not click links in the message or reply to it.

Frequently Asked Questions

Is it safe to save my credit card to a shopping website?

Saving your card to a site you trust and use regularly is generally safe if the site uses encryption and has good security practices. The risk is that if the site gets hacked, your card number could be stolen. Major retailers like Amazon invest heavily in security, but smaller sites may not. If you're unsure about a site's security, do not save your card — enter it each time you shop.

What should I do if I see a charge I don't recognize?

Call your card issuer immediately using the number on the back of your card. Do not call a number from an email or text. Report the charge as fraudulent and ask them to cancel your card and issue a new one. They will reverse the charge while they investigate. Keep records of the call and any follow-up communication.

Can I get my money back if a merchant never sends my order?

Yes. Contact your card issuer and dispute the charge, explaining that the merchant never delivered the item. Your card issuer will investigate and reverse the charge if they find in your favor. This process usually takes 30 to 60 days. In the meantime, also contact the merchant directly and ask for a refund or to resend the item.

Is it safer to use a credit card or a payment app like PayPal?

Both offer fraud protection, but in different ways. A credit card gives you the $50 liability cap and the right to dispute charges. PayPal and similar apps add a layer between you and the merchant, so the merchant never sees your card number. Use whichever you trust more, but avoid entering your debit card into either one.

What's the difference between "http" and "https"?

The "s" stands for "secure" and means the site encrypts data you send. "Http" does not encrypt, so your card number could be intercepted. Always look for "https://" before entering card details. The padlock icon confirms it's active.