How to Avoid Online Shopping Scams: A Buyer's Safety Checklist

This article describes US federal consumer payment rules in general terms and is not legal or financial advice. Your card issuer or bank may offer more than the law requires, and your own agreement governs your account.

Almost every guide to this subject is about spotting a bad seller before you hand over money. That part matters, and it is not the part that decides how much you lose.

The payment method you choose decides how much you can get back when you are wrong. And you will occasionally be wrong, because the convincing scams are convincing.

Two numbers make the point. On a credit card, federal law caps your liability for unauthorised charges at $50. On a debit card, if you miss a 60 day window, it can be unlimited.

Nobody tells you that. Every page currently ranking for this question says "use a credit card" and then stops, without naming a law or giving a single figure. The second half of this article is the explanation they skip.

The checklist comes first, for anyone who wants to act in two minutes.

The checklist

Before you buy

1. Type the retailer's address yourself instead of following an ad or a search result
2. Check how long the domain has existed
3. Search the seller's name alongside the word "scam"
4. Find a phone number and a physical address, and check that both resolve
5. Compare the price against a retailer you already use

At checkout

1. Pay by credit card wherever it is offered
2. Refuse bank transfer, cryptocurrency, gift cards and peer-to-peer apps
3. Give billing and shipping details and nothing else
4. Decline to save the card unless you shop there regularly
5. Screenshot the order confirmation before you close the tab

After you buy

1. Check your statement within 48 hours, then again at the next statement
2. Keep every message until the item arrives and the return window closes

Items 6 and 11 are the two that do the most work, and they are the two most people skip. The rest of this article is mostly about why.

Before you buy: is the seller real?

Three checks take about a minute between them.

Look up when the domain was registered. A store selling branded goods on a domain created a few weeks ago is the strongest single signal you can get. Scam storefronts are disposable by design.

Paste a sentence of the returns policy into a search engine, in quotation marks. Template operations deploy the same boilerplate across dozens of unrelated shops. Finding that exact paragraph on nine other stores answers the question.

Reverse image search one product photo. Photography lifted from a different retailer is common and takes seconds to expose.

There is more to this than three checks, and it has its own guide rather than a summary here. Our walkthrough of confirming a business is real covers the registry searches and the contact-detail checks properly.

One thing belongs here rather than there, because it is about the purchase rather than the website. Compare the price against a retailer you already trust. If a current-season branded item is 70 percent cheaper across an entire catalogue, the question is not whether the site looks professional. It is who is absorbing that loss. On a real clearance there is an answer, because a retailer is shifting old stock or a brand is exiting a line. On these sites there is no answer, because nothing is being shipped.

How you pay decides what you can get back

These are not four versions of the same thing. They sit under different federal laws, or under no law at all, and the differences are much larger than most people assume.

Credit cards

Governed by the Fair Credit Billing Act.

• Liability for unauthorised charges is capped at $50 per card, and most issuers waive even that as a matter of policy
• You can dispute a billing error by giving written notice within 60 days of the first statement showing it
• The issuer must acknowledge your dispute within 30 days and resolve it within two billing cycles or 90 days
• For goods that are defective or never arrive, you can withhold payment after making a good-faith attempt to resolve things with the seller first

That last point is the one that matters most for a scam purchase, and it is worth being precise about. For a bank-issued card the purchase must be over $50 and, strictly read, within your home state or 100 miles of your address. In practice issuers rarely apply the geographic test to online orders, but it is in the law, so do not treat it as guaranteed.

The structural advantage underneath all of this: your own money has not left your account. You are declining to pay a bill rather than chasing a refund.

Debit cards

Governed by the Electronic Fund Transfer Act and its implementing rule, Regulation E. The structure is completely different, and the difference is not in your favour.

Here are the liability tiers set out in Regulation E:

Two details people get wrong.

The two-day clock starts when you learn of the loss, not when the transaction happens. The rule says "within two business days after learning of the loss or theft of the access device."

The 60 day clock runs from when the statement was sent, not from when you opened it. After that window closes, the bank may hold you liable for everything that happened between the deadline and the day you called, if it can show your earlier notice would have prevented it.

Then the difference almost nobody writes about. For goods that are defective or never delivered, there is no federal right to stop payment on a debit card. As the Minnesota Attorney General's office puts it in a side-by-side comparison of credit and debit dispute rights, it is treated like paying with cash.

Your bank may well help anyway. Many do, through card network rules or simple goodwill, and in ordinary cases they resolve it quickly. But that is a courtesy, not a right you can insist on, and the distinction becomes very real when a bank decides not to.

The practical summary: on a debit card the money has already gone from your account, so you are asking to get it back. On a credit card you are refusing to pay. Those are not the same negotiating position.

Digital wallets

The honest answer here is slightly awkward, which is probably why it is rarely given. A wallet is not a level of protection. It is a wrapper.

Apple Pay, Google Pay and the rest pass the transaction through to whatever card you have loaded. A wallet funded by a credit card inherits the Fair Credit Billing Act. The same wallet funded by a debit card inherits Regulation E and every tier in the table above.

What a wallet genuinely adds is worth having. The merchant receives a token rather than your real card number, so a data breach at that retailer does not expose the card itself. That is a real improvement over typing your details into a form.

So the useful instruction is practical rather than reassuring: check which card your wallet is set to use before buying from somewhere unfamiliar. The default is frequently a debit card, and most people have never looked.

Transfers, peer-to-peer apps and everything else

Bank transfer, wire, cryptocurrency, gift cards, Zelle, Venmo, Cash App.

These are not payment methods with weaker protection. For a purchase, they have no purchase protection at all, and that is by design rather than oversight. They exist to move money irreversibly between people who already trust each other. Wells Fargo states plainly on its own scam guidance that neither it nor Zelle offers purchase protection.

Which leads to the most useful single inference in this article. A seller who insists on one of these has chosen the one route you cannot reverse. That choice tells you something about the seller, and nothing about the convenience of the app.

The comparison, side by side

Read the "right to withhold payment" row twice. That row is the entire reason to reach for a credit card when buying from a seller you do not know.

At checkout: five minutes of care

Give the minimum. Billing details and a shipping address. A shop does not need your date of birth, your Social Security number, or a bank account number. A checkout asking for those is not a checkout.

Do not save the card at a retailer you may never use again. Every stored card is a copy of your details sitting in a database you have no control over.

Screenshot the confirmation page before you close the tab, including the order number and the total. Scam stores take their sites down, and the confirmation email sometimes never comes.

Watch for the switch. A site that accepts cards throughout and then asks for a transfer at the final step has told you exactly what it is. Close it.

Use a virtual or single-use card number if your issuer offers one. Many do, most people never use it, and it limits the exposure from one unfamiliar seller to one number you can cancel without replacing your actual card.

That last one is genuinely underused. If your bank's app has it, buying from an unknown store becomes a much smaller decision.

After you buy: the 48-hour habit

This is the habit that converts every legal protection above into actual money.

Check your statement within 48 hours, then again at the next statement. Every protection in this article sits behind a deadline, and those deadlines run from when the statement was issued rather than from when you happened to notice something.

Look for small test charges. Stolen card details are usually validated with a tiny transaction, sometimes under a dollar, before anything significant is attempted. A trivial payment you cannot explain is a warning, not a rounding error.

Keep everything until the return window closes. Order confirmation, tracking, and every message with the seller. Disputes are won with documents and lost without them.

Here is the sentence worth remembering. The 60 day debit card cliff is the most expensive deadline in consumer payments, and a two-minute check of your account once a week makes it structurally impossible to hit.

If it has already happened

Call your card issuer or bank now and use the word fraud. Not "I think there might be a problem." Fraud routes you to the right team and starts the right clock.

Freeze or replace the card. Most banking apps do this in two taps.

Change any password you reused, starting with your email, because email is how every other account gets reset.

Write down everything while it is fresh: the site address, what you entered, the amounts, the dates, and who you spoke to at the bank.

Report it to the FTC at reportfraud.ftc.gov.

Speed is the whole game here. Every tier in the Regulation E table is a clock, and the first few hours are worth more than the following few weeks. We cover how to run a dispute properly, and where else to report, in separate guides.

The three that matter most

Credit card wherever it is offered. Not because fraud is more likely elsewhere, but because that row in the table about withholding payment is the difference between a complaint and a loss.

Statement checked within 48 hours. It takes two minutes and it is the only thing standing between you and every deadline in this article.

Nothing irreversible to a seller you have not verified. No transfer, no crypto, no gift card, no payment app. If those are the only options, that was the answer to your question.