How to tell if a website is safe before entering card details

If you’re about to enter card details on an unfamiliar website, do a quick go/no-go check first. Confirm the domain is the real one. Make sure the business identity matches. Then inspect the checkout page. If any of those do not line up, do not pay. A padlock or HTTPS alone is not enough. It only shows the connection is encrypted, not that the seller is legitimate.

The 60-second rule before you pay

1. Check the domain in the address bar first.

Read the site address carefully before you type anything. You want the exact domain, not just a brand name hidden in a longer address. Typos, extra words, odd spellings, and unfamiliar subdomains are common lookalike tricks. brand-name.example.com is not the same as brand-name.com.

If you arrived from an ad, email, or message, compare that address with the one shown on the page before you move on.

2. Confirm the site is the business you meant to visit.

The logo, site name, company name, and payment merchant should point to the same business. If the store name, footer details, and card statement name seem unrelated, treat that as a warning sign.

A checkout that uses a third-party payment processor can be normal. The switch should still make sense. If the store sends you to a payment page that looks unrelated or uses a different brand without explanation, stop and verify the seller another way.

3. Inspect the checkout page before you enter payment details.

A legitimate checkout page should clearly show what you are buying, the total price, shipping cost, and any taxes that apply. The payment form should look ordinary and complete, with the usual card and billing fields in a straightforward layout.

Watch for missing totals, hidden fees that appear late, fake countdown timers, odd pop-ups, or repeated redirects before the payment form appears. If the page keeps changing shape as you get closer to paying, that is a good reason to leave.

4. Look for business, return, contact, and privacy details.

A real store usually makes it easy to find a contact page, a return or refund policy, and a privacy policy from the footer or main menu. The contact details should be usable, such as an email address, phone number, support form, or physical address when that would reasonably be expected.

Read the policy pages closely enough to see whether they match the store. Broken links, copied text, vague support details, or a return policy that conflicts with what the product page says are all signs to slow down and verify the company through another trusted source.

5. Use the padlock as a basic check, not a green light.

The padlock and https mean the connection is encrypted, which helps protect data in transit. They do not prove the website is honest, well run, or safe to buy from. A scam site can still use HTTPS.

If the site has no HTTPS at all, that is a strong reason not to proceed. If HTTPS is present, keep checking the domain, merchant identity, and checkout page instead of stopping there.

6. Stop the purchase now if you see a red flag.

Back out if you see mismatched brand names, a strange domain, missing policy pages, broken English in critical checkout text, pressure to pay immediately, or a payment method that seems unusual for the type of store. Those are the signs that matter most at this stage.

Also stop if security tools block the site, links do not work, or the page looks copied together in a hurry. A polished design does not make up for a weak checkout flow, and a plain design is not a problem if the business details line up.

7. If it feels off but you are not sure, verify from a trusted source.

Do not keep clicking around the same suspicious page just to reassure yourself. Instead, type the brand name into a search engine yourself, open the company’s official app if it has one, or start from a marketplace or retailer you already trust.

If the site came from an ad or email, do not use that same path again. A mismatched domain or strange checkout is enough reason to pause until you can confirm the seller through a separate source.

8. If you already paid and later suspect the site was unsafe, act immediately.

Save screenshots, the URL, and any order confirmation you received. Then contact your card issuer or payment provider using the number or app on the back of your card. Ask what fraud or dispute steps they want you to use.

Monitor the charge closely for follow-up emails or extra payments. If you reused a password on that site, change it anywhere else you used the same password. Follow the issuer’s current fraud and dispute process from its official source, since those steps can change.

What a legitimate checkout page should show

A legitimate checkout page should show the product name, the final total, shipping, and taxes before you enter payment details. It should also make the seller’s identity easy to understand, whether that is the store name, the merchant name, or a clearly explained payment processor.

The page should look like a normal checkout flow, not a maze of pop-ups or last-second redirects. If the site hides the total until the final step, shows extra charges without explanation, or makes the merchant hard to identify, treat that as a reason to stop.

Red flags that mean stop the purchase now

• The domain is a typo, a lookalike, or a longer address with the brand name buried inside it.
• The store name, checkout name, and card statement name do not appear to belong to the same business.
• The site has no clear contact page, return policy, or privacy policy.
• The checkout uses pressure tactics, fake urgency, or hidden fees.
• The payment page is missing HTTPS.
• The text in the checkout flow is broken, copied, or inconsistent in the parts that matter.
• The site redirects you in a way that does not make sense for the purchase.

None of those signs proves fraud on its own, but any one of them is enough to justify stopping if you are about to type in card details.

Conclusion

If the domain is exact, the merchant identity makes sense, and the checkout page shows the full cost with normal payment fields, you can proceed with caution. If any part of that check fails, the safer move is to leave and buy elsewhere.