Check the payment methods match what you have
Before you enter any information, look at what payment options the site actually lists. The most common are credit card, debit card, bank transfer (ACH), and digital wallets like PayPal or Apple Pay. If you only have a debit card and the site accepts credit cards only, you can still use your debit card as a credit card at most places — but if the site accepts bank transfer only and you don't have online banking set up, you'll need to find another way or set it up first.
Some sites accept only one method. Others let you choose. If a site forces you into a payment method you're uncomfortable with — say, a wire transfer when you've never done one — that's a sign to pause and either learn how that method works or look for an alternative payment route. Legitimate businesses usually offer at least two options.
Look for security signals before you pay
The payment page should show a padlock icon in your browser's address bar and the URL should start with https:// (not http://). This means the connection between your device and the server is encrypted. Without this, anyone on the same network could see your card number as you type it.
If you're paying by credit or debit card directly on the site (not through a third-party processor), look for logos from Visa, Mastercard, American Express, or Discover near the payment form. These indicate the site has met basic security standards. If the site asks you to email your card number or pay through an unusual method like gift cards or cryptocurrency, stop — that's not how legitimate businesses collect payments.
Understand what happens if something goes wrong
Before you submit payment, find the site's refund or dispute policy. This is usually in a footer link labeled "Returns," "Refund Policy," or "Terms of Service." Read what it says about your money if the product doesn't arrive, arrives damaged, or isn't what you ordered. Some sites offer refunds within 30 days; others don't refund at all.
Your protection depends on your payment method. Credit cards offer the strongest protection through chargeback rights — if the merchant doesn't refund you, you can dispute the charge with your card issuer and they will often reverse it. Debit cards offer less protection and the process is slower. Bank transfers (ACH) and wire transfers offer almost no protection once sent. Digital wallets like PayPal sit in the middle — PayPal has a buyer protection program, but it has limits and conditions.
Watch for hidden fees and unclear pricing
The price shown should be the final price you pay, or the site should clearly break down what you're paying for. Look for lines that say "Subtotal," "Shipping," "Tax," and "Processing Fee" or "Payment Fee." Some sites add a fee only for certain payment methods — for example, paying by wire transfer might cost $15 extra, while paying by ACH costs nothing.
If the site doesn't show you the total until the very last screen before you confirm, that's a red flag. Legitimate sites show the full cost before you enter payment information. If you see a charge you don't recognize, stop and contact the site's customer service before paying.
Verify the site is real before entering personal details
Check the domain name carefully. Scam sites often use URLs that look similar to real ones — for example, "amaz0n.com" instead of "amazon.com" or "paypa1.com" instead of "paypal.com." If you're not sure, go to the official website by typing the address into your browser yourself rather than clicking a link from an email or text message.
Look for contact information: a phone number, email address, or mailing address. If the site has none of these, or only a contact form with no way to reach a real person, that's a warning sign. Legitimate businesses want you to be able to reach them if something goes wrong. You should also be able to find the site's name and some basic information about the company — not just a payment form floating in space.
Know what information you should and shouldn't give
A legitimate payment page will ask for your card number, expiration date, and CVV (the three-digit code on the back). It may also ask for your billing address and zip code. It should never ask for your PIN, your full Social Security number, or your online banking password. If it does, you are on a fake site or a site that is not secure.
If you're paying by bank transfer, the site should ask for your routing number and account number — not your password. If it asks for your password, do not enter it. You should log into your own bank's website to authorize the transfer, not give your credentials to a third party.
Confirm the payment went through and keep your receipt
After you submit payment, the site should show a confirmation page with an order number or transaction ID. Write this down or take a screenshot. You should also receive a confirmation email within a few minutes — if you don't, check your spam folder, then contact the site to confirm they received your payment.
Keep this confirmation and the receipt for at least 60 days. If you need to dispute the charge or follow up on an order, you'll need proof that you paid. If the site never sends a confirmation, that's a sign something went wrong — contact them immediately to find out whether the payment processed.
Key Takeaways
- Check that the site accepts a payment method you actually have, and understand what happens if the method fails or the transaction is disputed.
- The payment page must show https:// in the address bar and a padlock icon; if it doesn't, your card information is not encrypted and you should not pay.
- Read the refund policy before you pay so you know what recourse you have if the product or service doesn't arrive or isn't what you ordered.
- Credit cards offer the strongest protection if something goes wrong; debit cards, bank transfers, and wire transfers offer much less protection once the money leaves your account.
- A legitimate site shows the full cost before asking for payment information and never asks for your password, PIN, or full Social Security number.
Frequently Asked Questions
Is it safe to use my debit card for online payments?
Debit cards work for online payments, but they offer less protection than credit cards if something goes wrong. If your debit card number is stolen, the money comes directly from your bank account and getting it back takes longer. If you have a choice, use a credit card instead. If you must use a debit card, use it only on sites you trust and monitor your account closely for unauthorized charges.
What should I do if I see a charge I didn't authorize?
Contact your card issuer or bank immediately — most have a fraud line you can call 24/7. Report the charge and ask them to reverse it. If you paid by credit card, the issuer will usually reverse the charge while they investigate. If you paid by debit card or bank transfer, the process is slower and you may not recover the money. Keep records of when you reported it and what you were told.
Can I trust a site that only accepts wire transfer or cryptocurrency?
Wire transfers and cryptocurrency are hard to reverse once sent, which makes them attractive to scammers. Legitimate businesses usually offer multiple payment methods including credit cards or bank transfers. If a site insists on wire transfer or cryptocurrency only, especially for a small purchase or an unfamiliar product, that's a strong warning sign. Use a different site if you can.
What does the CVV protect?
The CVV (the three-digit code on the back of your card) is meant to prove you physically have the card. It's not stored in the card's magnetic stripe, so a thief who steals your card number alone usually can't use it online without the CVV. Never give your CVV over the phone or email, and never let anyone photograph it. A legitimate site will only ask for it during the payment process on their secure checkout page.
How long should I wait for a payment confirmation?
You should see a confirmation page immediately after submitting payment, and receive a confirmation email within a few minutes. If you don't see either within 15 minutes, log into your bank account to check whether the charge actually went through. If it did, contact the site's customer service with your order number. If it didn't, try paying again — but check first to make sure you weren't charged twice.