How to Shop Online Safely: A Senior's Guide to Avoiding Scams
You shop online safely by slowing down at a few moments: check the web address for misspellings and a padlock with https, search the store's name with “reviews” or “scam,” and pay by credit card for the best fraud protection. Never pay by gift card, wire, or money app — that money can't be recovered. None of this takes a tech expert, just a pause.
Quick answer
Shop online safely by slowing down at a few key moments: check the web address for misspellings and a padlock with https, search the store's name with “reviews” or “scam” before buying, and pay with a credit card for the strongest fraud protection. Never pay an online store by gift card, wire, or money app — no honest seller asks for those, and that money can't be recovered.
Why scammers love a good shopper
Scammers aren't only after the gullible — they're after the busy, the trusting, and anyone in a hurry to grab a deal. The Federal Trade Commission reports that online shopping is one of the most common ways people lose money to fraud. You don't need to be a tech expert to stay safe. You just need to slow down at a few key moments.
The 10-second gut check before any purchase
If a deal feels urgent ("only 2 left — buy in the next 5 minutes!"), if the price is wildly lower than everywhere else, or if a site you've never heard of is asking for payment by gift card, wire, or a money app — stop. Those three signals are present in the large majority of shopping scams. When in doubt, close the tab and search the store's name plus the word "scam."
How can I tell if an online store is fake?
- Check the web address. Look for tiny misspellings of real brands (like "amaz0n") and make sure it starts with https and shows a padlock. The padlock alone doesn't mean a site is honest — but a missing one is a red flag.
- Search the store before you buy. A quick search of the company name with "reviews" or "complaints" surfaces trouble fast. No reviews anywhere can be its own warning.
- Be wary of social-media ads. A flashy ad for an unbelievable deal often leads to a here-today-gone-tomorrow store. Buy from the brand's own site instead.
- Look for real contact details. A legitimate store lists a phone number, address, and a clear return policy. Vague or missing? Walk away.
What's the safest way to pay when shopping online?
How you pay decides whether you can get your money back. This is the single most important habit on this page.
- Use a credit card. Credit cards give you the strongest fraud protection — you can dispute a charge and usually owe nothing for purchases you didn't authorize.
- Never pay by gift card, wire, or money app. No honest store asks for these. Once that money is gone, it's gone — which is exactly why scammers demand it.
- Consider a digital wallet. Paying through a service like PayPal or a phone wallet keeps your card number off the store's system.
- Don't save your card on small or unfamiliar sites. Type it in each time, or use a wallet, so there's less to steal if the store is breached.
How you pay decides how much protection you have, long before anything goes wrong. Federal law puts a hard cap on what a credit card can cost you and gives you a written dispute right; it gives you less on a debit card, and essentially nothing on a gift card, wire, or crypto payment. Here is what each payment method actually gets you, and how long you have to act.
| How you paid | What the law gives you | Can it be recovered? | Deadline to act |
|---|---|---|---|
| Credit cardSafest | The strongest protection there is. Regulation Z caps your liability for unauthorized use at $50, and many issuers waive even that. Separately, the Fair Credit Billing Act lets you dispute a billing error, which expressly includes goods not delivered to the consumer as agreed — so a store that takes your money and ships nothing is a billing error, not just bad luck. | Usually yes. The issuer must investigate, and you may withhold payment on the disputed amount while it does. | Send written notice so it reaches the issuer no later than 60 days after the statement showing the charge was sent. Report a lost or stolen card right away. |
| Debit card | Regulation E — and your protection shrinks the longer you wait. Report within 2 business days of learning of the loss or theft: liability capped at $50. After that but within 60 days of the statement: capped at $500. Charges that appear on a statement and go unreported for more than 60 days: no cap at all on losses from transfers made after that window. | Often yes if reported fast — but it’s your own cash that left the account while the bank investigates. | Call the bank the day you notice. Report an error within 60 days of the statement being sent. The bank generally has 10 business days to investigate, or 45 days if it gives you provisional credit. |
| ACH or bank transfer | Regulation E covers a consumer bank account, but only for unauthorized transfers — money a scammer pulled out without you. A payment you set up yourself, even to a fraudster, is an authorized transfer and falls outside those error-resolution rights. | Sometimes, if it was unauthorized and caught early. Much harder if you sent it yourself. | The same Regulation E clock: report within 60 days of the statement being sent, and call the bank the same day you notice. |
| Wire transfer (Western Union, MoneyGram, bank wire) | No federal chargeback right. The FTC lists wires among the payment methods scammers demand precisely because the money is hard to trace and hard to get back. | Rarely. The one real chance is calling before the funds are picked up — the FTC says to contact the transfer company, or your bank for a bank wire, and ask them to reverse it. | Immediately. There is no statutory window to fall back on. |
| Peer-to-peer app (Zelle, Venmo, Cash App) | This is the gap most people don’t know about. Regulation E gives you error-resolution and liability protection for unauthorized transfers — ones a scammer initiated from your account. A payment you were tricked into sending was authorized by you, so those rights generally don’t apply. CFPB warns these apps may not carry the protections older payment methods do. | Often no, if you sent it yourself. Report it anyway and ask for a reversal. If the app was funded by a credit or debit card, report it to that card issuer too — that route may still carry card protections. | Immediately, to both the app and your bank. If any part of it was unauthorized, the 60-day Regulation E clock applies. |
| Gift card | None. A gift card is not a payment method with dispute rights. The FTC is blunt: anyone who tells you to buy a gift card and read off the numbers is a scammer. | Almost never — but not never. The FTC says to call the card issuer, report it as used in a scam, ask for your money back, and keep both the card and the store receipt. Some companies do refund. | Immediately — though the FTC says to report it no matter how long ago it happened. |
| Cryptocurrency | None. The FTC states plainly that crypto payments do not come with the legal protections credit and debit cards have. | Effectively no. The FTC says crypto payments typically are not reversible — you generally get your money back only if the person you paid sends it back. | No deadline exists, because no dispute right exists. Report to the platform, and to the FBI at IC3.gov. |
| Cash or money order | None. No federal dispute right attaches to cash. | Almost never. If you mailed cash by U.S. mail, the FTC says to call the U.S. Postal Inspection Service at 877-876-2455 and ask them to intercept the package. Another carrier — call them at once. | Immediately, while the package is still in transit. |
| PayPal — Goods & Services | Not federal law, but PayPal’s own Purchase Protection program covers eligible Goods & Services purchases through its Resolution Center. If you funded the payment with a credit card, your Fair Credit Billing Act rights still stand behind it. | Often yes, if the purchase is eligible under PayPal’s current terms. | Open a dispute in the Resolution Center as soon as you know — PayPal sets its own window, so check its current terms. The card-side 60-day written-notice deadline runs separately. |
| PayPal — Friends & Family | Little to none. A Friends & Family send is a personal transfer, not a purchase, so it sits outside PayPal’s purchase-dispute path. A seller who insists on Friends & Family is asking you to give up your protection. | Usually no. Report it to PayPal and to your bank or card issuer anyway. | Immediately. Never use Friends & Family to pay a stranger for goods. |
How do I avoid phishing texts and emails about my orders?
Many shopping scams don't start on a store at all — they start with a text, email, or pop-up. "There's a problem with your order." "Your package couldn't be delivered — click to reschedule." These are designed to make you click before you think.
- Never click links in unexpected messages. Go to the store or carrier's website yourself by typing the address, or use their app.
- Real companies don't ask for passwords or codes. No legitimate business will text or call asking for your password, full card number, or a one-time verification code. Anyone who does is a scammer.
- Ignore "your computer has a virus" pop-ups. Don't call the number or let anyone take remote control of your device. Close the window; if it won't close, restart the computer.
- Slow down when a message creates panic. Urgency and fear are the tools of the trade. A real problem will still be there after you take a breath and check directly.
What should I do if I think I've been scammed?
- Contact your bank or card company right away. Report the charge, ask them to block the card, and request a new one. The sooner you call, the better your odds of getting money back.
- Change your passwords. Start with the affected account and any others that share the same password.
- Report it. File with the FTC at ReportFraud.ftc.gov. It helps investigators and may help you, too.
- Don't be embarrassed. These scams fool millions of careful people every year. Reporting quickly is what limits the damage.
Keep your accounts and logins in one safe place
A surprising amount of online safety is just being organized — knowing which accounts you have, which card is on file where, and who to call if something goes wrong. Keeping that in one trusted place (not a sticky note on the monitor) makes you both safer day to day and far easier for a loved one to help in an emergency.
If you're also helping an older parent stay safe, our article on protecting aging parents from scams and financial abuse covers the warning signs to watch for.
You may be interested in…
Start getting retirement in order — one simple checklist at a time
Free quick-start checklists to help you organize the practical parts of retirement: what to gather, what to decide, and what to write down first.
- What to gather
- What to update
- What to share with family
Almost there — check your inbox.
We just sent a confirmation email. Click the link inside and your free download lands right after. (If you don't see it, check spam or promotions.)
Good to know
Common questions
I paid a website with a gift card and now they’ve stopped answering. Can I get my money back?
Sometimes — call the gift card company today, no matter how long ago it happened. The FTC says to report it to the card issuer right away and ask for your money back; if the funds are still sitting on the card, some companies can freeze it. Keep the physical card and the store receipt, because you’ll need the numbers on both. Then report it at ReportFraud.ftc.gov. Recovery isn’t guaranteed, but the ask costs nothing and some issuers do refund.
I used my debit card and the money’s already gone from my account. What do I do right now?
Call your bank now and report it as an unauthorized transaction — the clock is the whole game with debit cards. If you report a lost or stolen card within two business days of learning about it, your maximum loss is $50; after two business days but within 60 calendar days of the statement being sent, it’s $500; after 60 days you can lose everything taken, including money in linked accounts. Follow the call with a letter in writing, and keep a copy.
Is it actually safer to use a credit card?
Yes, meaningfully. With a credit card the most you can be responsible for after a card is lost or stolen is $50, and you owe nothing for unauthorized charges if your card wasn’t lost or stolen at all — versus a debit card, where your protection degrades to $500 and then to unlimited as time passes. A credit card dispute also holds up the merchant’s money instead of pulling yours out of your checking account while it’s investigated.
I sent the money on Zelle because the seller said it was faster. Am I protected?
Usually not, and that’s the hard truth about payment apps. Federal Regulation E protects you against transfers made by someone other than you without authority — but when you were talked into sending the payment yourself, it doesn’t fit that definition, so the error-resolution rights generally don’t apply. If a scammer stole your login and moved the money, that is treated as unauthorized and you should say exactly that to your bank. Either way, report it to the app and, if the app was linked to a credit or debit card, to that card issuer too.
The order never came and the seller has gone quiet. Is that fraud, or just a bad seller?
For your credit card it doesn’t matter what you call it — failure to deliver goods as agreed is a billing error you can dispute. Write to the issuer at the address for billing inquiries (not the payment address) so your letter arrives within 60 days of the first bill showing the charge, and include your account number and what went wrong. The issuer must acknowledge your dispute within 30 days and resolve it within 90.
The site looked completely real. How was I supposed to know?
Often you weren’t — professional fake storefronts copy real logos, real product photos and real return policies, and they buy ads that put them above the genuine store. The signals that actually hold up are boring ones: a checkable phone number and street address, a price that isn’t far below everywhere else, and a payment method that isn’t a gift card, wire or payment app. Being fooled by a good fake is not carelessness.
I got a text saying my package couldn’t be delivered and needs a small fee. Is that real?
Almost certainly not — carriers don’t text strangers for delivery fees, and this is one of the most common scam texts running. Don’t tap the link; open the carrier’s own app or type their address yourself and check the tracking number you already have. If you did tap it and entered card details, call your card issuer now and treat it as a compromised card.
How do I check a store before I buy, without becoming an expert?
Do three things that take two minutes: read the web address character by character for a misspelling of a brand you know, search the store’s name together with “reviews” or “scam,” and look for a real phone number, address and return policy on the site. Then pay by credit card. That combination catches the large majority of fake shops without any technical skill.
Verified from
Sources
- FTC Consumer Advice — Shopping Online
- FTC Consumer Advice — How to Recognize and Avoid Phishing Scams
- FTC Consumer Advice — What To Do if You Were Scammed
- 12 CFR 1026.12 — Special credit card provisions (CFPB)
- 12 CFR 1026.13 — Billing error resolution, Fair Credit Billing Act (CFPB)
- 12 CFR 1005.6 — Liability for unauthorized transfers, Regulation E (CFPB)
- 12 CFR 1005.11 — Procedures for resolving errors, Regulation E (CFPB)
- CFPB — How do I get my money back after an unauthorized transaction?
- CFPB — Tips for using mobile payment services
- FTC Consumer Advice — Avoiding and Reporting Gift Card Scams
- FTC Consumer Advice — What To Know About Cryptocurrency and Scams
- FTC Consumer Advice — Lost or Stolen Credit, ATM, and Debit Cards
- FTC Consumer Advice — Disputing Credit Card Charges
Get organized, stay safe
Write down which card is on file where
Online-safety advice mostly stops at “use a strong password.” The part nobody covers: when a card gets replaced, can you list every service that bills it? The End of Life Planner gives your accounts and subscriptions their own fill-in sections — what exists and who to call, deliberately without passwords or account numbers, so the book is harmless if it's ever mislaid.
See the End of Life Planner →