Skip to main content
Online shopping has transformed how we buy everything from groceries to electronics — offering unmatched convenience, endless selection, and the ability to compare prices across hundreds of retailers in seconds. But that convenience comes with real risk. The FBI’s Internet Crime Complaint Center (IC3) receives hundreds of thousands of complaints about online shopping fraud every year, with losses totaling in the billions of dollars. Fake storefronts, counterfeit goods, phishing sites designed to steal your payment details, and fraudulent sellers on legitimate marketplaces are all thriving in the booming world of e-commerce. The good news is that with a few smart habits and the right tools, you can enjoy all the benefits of online shopping while keeping your money and personal information safe.

​
Red Flags to Watch For

Before you reach for your credit card, take a moment to assess the site you’re shopping on. Scammers put significant effort into making fraudulent stores look legitimate — but they almost always leave telltale signs. Train yourself to spot these warning signals.
A brand-new PlayStation listed at 80% off, designer sneakers for $19.99, or a luxury watch for a fraction of its retail price. If a deal seems impossibly good, it almost always is. These offers are engineered to override your skepticism and rush you into a purchase before you think too critically. Counterfeit goods, empty shipments, and stolen payment details are the usual outcomes.
Legitimate online retailers always use HTTPS encryption to protect the data you submit — including payment information. Look for “https://” at the start of the URL and a padlock icon in your browser’s address bar. The absence of HTTPS on a checkout page is a clear sign that your data is being transmitted insecurely, or that the site is not what it claims to be.
Before purchasing from a retailer you’ve never heard of, search for independent reviews. Check Google, Trustpilot, and the Better Business Bureau. A legitimate store operating for any length of time will have a trail of customer feedback — good or bad. If a store has zero reviews, reviews that all appeared within the last week, or an implausibly high number of five-star ratings with no detail, treat it with serious skepticism.
“Only 2 left in stock — order now!” “This price expires in 00:04:32!” Artificial scarcity and countdown timers are classic manipulation techniques designed to prevent you from taking time to research or reconsider. Legitimate retailers may have genuine sales deadlines, but high-pressure urgency that follows you from page to page is a hallmark of scam operations designed to make you act before you think.
Any retailer that insists on gift cards, wire transfers, cryptocurrency, or peer-to-peer payment apps like Zelle or Venmo as the only payment options is almost certainly a scam. These payment methods are irreversible — once the money is sent, it’s gone. Legitimate retailers accept credit cards and established payment processors because it builds trust. Unusual payment requirements exist specifically to prevent chargebacks and victim recourse.
Cybercriminals register domains that closely mimic trusted brands — think “arnazon.com,” “wallmart.com,” or “apple-store-deals.net” — to trick shoppers into entering their credentials or payment details on fake sites. Always inspect the full URL carefully before logging in or checking out. Pay attention to subtle substitutions: zeros for the letter O, extra hyphens, added words, or unfamiliar domain extensions like “.shop” or “.xyz” instead of “.com.”

​
Safe Shopping Checklist

Building a quick pre-purchase ritual takes less than two minutes and can save you from costly fraud. Before completing any transaction online, run through this checklist.

Verify the Website URL and Look for HTTPS

Pause before you enter any personal or payment information and read the full URL in your browser’s address bar. Confirm the domain is spelled correctly and matches the brand you intend to shop with. Check for the padlock icon and “https://” prefix, which indicate an encrypted connection. For extra confidence, look for an Extended Validation (EV) certificate — some browsers display the company name in green next to the padlock.

Research the Seller With Reviews and Ratings

For any unfamiliar retailer, spend two minutes searching for reviews before you buy. Check Google Reviews, Trustpilot, the Better Business Bureau, and relevant subreddits or consumer forums. On marketplace platforms like Amazon, eBay, or Etsy, review the seller’s rating, number of completed transactions, and response to negative feedback. A pattern of unresolved complaints about non-delivery or counterfeit goods is a clear warning sign.

Use a Credit Card — Not a Debit Card

When it comes to online shopping, credit cards are significantly safer than debit cards. Credit cards offer robust fraud protection under the Fair Credit Billing Act — if unauthorized charges appear, your maximum liability is typically $50, and most card issuers offer zero-liability policies. More importantly, disputes are resolved against a credit balance, not your actual bank funds. Debit card fraud can drain your checking account while you wait for resolution, potentially causing cascading problems with rent, bills, and direct debits.

Enable Norton Secure VPN Before Entering Card Details

If you’re shopping on any network other than your own trusted home Wi-Fi — a coffee shop, airport, hotel, or your mobile carrier’s network — activate Norton Secure VPN before proceeding to checkout. A VPN encrypts your internet traffic end-to-end, making it impossible for anyone on the same network to intercept your card number, billing address, or login credentials. Even on your home network, a VPN adds an extra layer of privacy from your ISP and any potential network intrusions.

Check Your Bank Statement After Purchase

The transaction doesn’t end at the order confirmation page. Within a few days of making a purchase, log in to your credit card or bank account and verify that the charge appears correctly — the right amount, from the right merchant. Some fraudulent sites authorize a small test charge before running a larger unauthorized transaction. Catching discrepancies early makes dispute resolution far simpler. Set up transaction alerts with your bank so you’re notified of every charge in real time.

Use Norton Password Manager to Store Login Credentials Safely

Creating an account with an online retailer means another set of credentials to manage. Reusing a password you use elsewhere is dangerous — if that retailer ever suffers a breach, your email/password combo could end up in a credential-stuffing attack against your bank or email. Norton Password Manager generates a unique, complex password for each site, stores it securely in an encrypted vault, and auto-fills it when you return. Your shopping accounts stay secure without any mental overhead.

​
Holiday Shopping Season: Extra Vigilance

The period between Black Friday and Christmas is the most dangerous time of year for online shoppers — and cybercriminals know it. Threat actors prepare for the holiday shopping surge months in advance, spinning up fake storefronts, registering lookalike domains, and launching targeted phishing campaigns designed to exploit the frenzy of deal-hunting. During the holiday shopping season, take these additional precautions:
  • Stick to retailers you already know and trust. The holiday season is not the time to experiment with obscure new storefronts promising impossibly deep discounts. Save discovery shopping for times when you can research leisurely.
  • Go directly to retailer websites rather than clicking through ads or emails. Malicious ads and sponsored search results can lead to convincing clone sites. Type retailer URLs directly into your browser or use your saved bookmarks.
  • Watch out for fake order and shipping notifications. During the holidays, your inbox fills with legitimate shipping emails — which makes it the perfect time for attackers to sneak in convincing fakes. These emails typically contain malicious links disguised as “track your package” buttons.
  • Be cautious with social media ads for unfamiliar brands. Instagram and Facebook ads promoting unknown stores with flashy deals are a common vector for shopping fraud. The low cost of social media advertising makes it trivially easy for scammers to reach millions of potential victims.
  • Keep a running list of your purchases. With multiple orders in flight during the holidays, it’s easy to lose track. A simple note or spreadsheet helps you match every expected delivery to a confirmed order — making fraudulent charges and missing packages immediately obvious.

​
What Norton Does for Shoppers

Shopping online safely isn’t just about your habits — it’s also about having the right tools working in the background. Norton offers a suite of protections specifically relevant to online shoppers. Norton Safe Web analyzes websites in real time, checking URLs against a continuously updated database of known phishing sites, fraudulent retailers, and malware-hosting pages. Before you enter a sketchy storefront, Norton can warn you that the site has been flagged by its global intelligence network. Norton Secure VPN encrypts your connection whenever you’re shopping on the go, ensuring that your payment details can’t be intercepted — whether you’re checking out from a hotel Wi-Fi or a shopping center’s free network. Norton Password Manager ensures that every account you create with a retailer has a unique, complex password — so a breach at one store doesn’t cascade into a breach of your email, bank, or other accounts. Norton Identity Monitoring keeps watch for your credit card numbers, email addresses, and other personal details on dark web forums where stolen payment information is bought and sold. If your data appears in a breach — whether from a retailer you shopped with or another source — Norton alerts you so you can act immediately.
Phishing emails disguised as shipping notifications are among the most effective scams of the year — especially during the holiday season. These emails mimic UPS, FedEx, USPS, Amazon, and other trusted delivery and retail brands, complete with official logos and convincing language. They often claim there’s a problem with your delivery and prompt you to click a link and confirm your address or payment details. Never click links in unexpected shipping emails. Instead, go directly to the carrier’s official website and enter your tracking number manually.
Many major credit card issuers and some banks offer virtual credit card numbers — temporary, single-use card numbers linked to your real account. When you shop at an unfamiliar site, using a virtual number means that even if the merchant’s systems are breached, your actual card details are never exposed. Check whether your credit card issuer offers this feature through their app or website — it’s one of the most underused protections available to online shoppers.