Shop and Pay Safely Online

With so many of us now shopping online, it’s no surprise that criminals are increasingly turning to web-enabled fraud to steal our money and personal details. The following tips will help you stay safe when shopping online for goods and services.

Check the shop is legitimate

You can research online shops to check they're legitimate, particularly if it’s a store you’ve not used before. Use consumer websites, or reviews from people (or organisations) that you trust.

You might receive suspicious emails or texts (known as phishing messages) that contain links to fake shops, with promotions that seem too good to be true. These days it’s easy for a criminal to duplicate the design of a legitimate website, which will often include logos, trademarks and products copied from a genuine store. Many will also use a deceptive website domain (for example, www.tescos-sales.com), that can be easily mistaken for a genuine domain (www.tesco.com). 

If you're unsure about a link you receive, don't click on it. Instead you can:

Use a credit card to pay

Only provide required details on checkout

When making your payment, only fill in the mandatory details (often marked with an asterisk) such as your address. Unless you think you’ll become a regular customer, don't create an account for the store:

Keep your accounts secure

Make sure your shopping, online banking and payment accounts are protected by strong passwords that you don't use for any other account. If you're using the same password for lots of accounts, criminals could steal your password from one account, and use it to access your other ones.

For this reason, you should make sure that all your important online accounts (such as email, banking, and social media accounts) have unique, strong passwords. You should also turn on 2-step verification (2SV) for all your important online accounts. This can stop hackers from accessing your accounts - even if they know your password - by asking you to confirm your identity using a second method, for example by sending a confirmation code to your phone. Note that 2SV is sometimes called 'two-factor authentication' (or 2FA). 

Watch out for suspicious links

Cyber criminals insert malicious links into SMS text messages, emails, and increasingly on social media posts. These can be difficult to spot, and will often include unbelievable offers for goods and services with links to websites designed to look like legitimate online stores.

These websites are managed by criminals, and are designed to trick people into making payments, or revealing their bank details, passwords, or other personal information.

If a text message, email, website or social media post doesn’t feel right, follow the NCSC guidance on dealing with suspicious emails and text messages:

If things go wrong

If you you’ve been tricked into making a payment, tell your bank and report it as a crime to Action Fraud (for England, Wales and Northern Ireland) or Police Scotland (for Scotland). 

If you think your credit or debit card has been used by someone else, let your bank know straight away so they can block anyone using it. Always contact your bank directly using the official website or phone number. 

If you don't receive an item you’ve purchased (or it doesn't match the description given), Citizens Advice has some useful information about getting your money back if you paid by credit card, debit card or PayPal.

----------

Tim Tostevin
Cyberhood Watch Ambassador (Neighbourhood Watch)