How to Check a Website Before You Enter Your Credit Card

Before you enter your credit card on any website, spend two minutes checking five things: the exact domain name, the padlock and the address behind it, the company details and contact information, the checkout page itself, and the payment methods on offer. If any one of those fails, close the tab — a card form is the single most valuable thing a fake shop can put in front of you.

The good news is that these checks are fast, free and don't require any technical skill. Here they are in the order you should actually do them.

Is the web address really the site I think it is?

Start with the address bar, not the page. Scam sites copy logos and product photos perfectly, but they can't use the real domain — so the domain is where the truth lives.

• Read the full domain slowly. Look for swapped letters, extra words or hyphens, and odd endings that imitate a brand you know.
• Check what comes right before the first slash. That part is the real domain; everything in front of it can be decoration designed to mislead.
• Type known brands in yourself. If you arrived from an ad, a social post or a message, open a new tab and go to the store directly instead of trusting the link.

If the site claims to be a brand you recognise but the domain doesn't match, stop there. You don't need the other checks — you already have your answer.

Does the padlock mean the site is safe?

No — and this is the most common misunderstanding in online shopping. The padlock only means your connection to the site is encrypted. It says nothing about who is on the other end.

A fraudulent store can get the same padlock in minutes, for free. So treat it this way:

• No padlock on a checkout page is an instant walk-away — never type a card number into an unencrypted form.
• A padlock present is the bare minimum, not a seal of approval. Keep going with the rest of the checks.

Who is actually behind this store?

A legitimate shop wants you to know who it is, because that's how it earns repeat customers. A throwaway site hides, because it plans to disappear. Look for:

• A real company name and physical address on the contact or about page — not just a web form or a generic email address.
• Working contact details. If a phone number is listed, does it connect? Does the email domain match the shop's domain?
• Consistent policy pages. Returns, shipping and privacy pages that mention a different store name, contradict each other or read like they were copied from somewhere else are a strong warning sign.
• A history off the site. Search the store's name together with words like "reviews" or "complaints" and see what other buyers say somewhere the shop doesn't control.

You can also run the store through a shop checker like HasTrust to see trust signals, domain details and what other shoppers have reported, all in one place.

What should I look at on the checkout page itself?

The checkout page is where the risk becomes real, so give it its own inspection before you type anything.

1. Confirm the domain hasn't changed. Some fake shops send you to a different address at checkout. If the payment page lives on an unrelated domain you've never heard of, stop.
2. Check what the form asks for. A card payment needs your card number, expiry, security code and billing address. A form that also wants your card PIN, online banking login, a photo of your card or your full ID is not a payment form — it's a harvesting form.
3. Look at the total and the currency. Make sure the amount matches your basket and the currency is what you expect, so a "cheap" order doesn't quietly become an expensive one.
4. Watch for pre-ticked boxes. Uncheck anything that signs you up for a subscription, a "membership" or recurring billing you didn't ask for.

If the checkout offers to store your card for next time, think twice on a shop you've never used — our guide on saving your card details on shopping websites explains when that's reasonable and when it isn't.

Which payment methods tell me something about the shop?

The payment options a store offers are themselves a trust signal. Legitimate shops want easy, protected payments because that's what customers expect.

• Credit card or a well-known payment provider is what you want to see: these routes come with dispute processes if something goes wrong. See our comparison of which payment methods have buyer protection before you choose.
• Bank transfer, wire, gift cards or crypto as the only options is a serious red flag, because those payments are hard or impossible to reverse. We cover this pattern in detail in what it means when a seller only accepts Zelle, bank transfer or gift cards.
• A "payment failed, try another method" message that pushes you from card to transfer is a classic trick: the shop wants your money through a channel you can't claw back.

What if the site passes the checks but I'm still unsure?

Trust that feeling — it usually means several small signals added up. A few ways to reduce the risk without walking away entirely:

• Use a credit card rather than a debit card for the first order, so a dispute involves the card company's money before yours.
• Use a virtual or single-use card number if your bank offers one, so the shop never sees your real card.
• Place a small first order before trusting a new store with a big purchase.
• Keep evidence. Screenshot the product page, the price and the order confirmation, so you have proof if you later need to dispute the charge.

If you were pushed to the site by an email or text message, paste it into the HasTrust scam checker before acting on it — unsolicited messages are how most people land on fake checkouts in the first place.

I already entered my card on a suspicious site — what now?

Act quickly and in this order:

1. Contact your bank or card issuer and tell them you may have entered your card on a fraudulent site. Ask them to block the card and issue a new one.
2. Watch your statements for small "test" charges as well as large ones, and for recurring subscriptions you didn't agree to.
3. Dispute any charge for goods that never arrive or aren't as described — our chargeback guide walks through exactly how to get your money back.
4. Change your password if you created an account on the site and reused a password from anywhere else.

Entering card details on a bad site doesn't automatically mean you'll lose money — banks reverse fraudulent card charges all the time. The people who lose out are the ones who wait, so make the call the same day.