How to shop online safely

I find it funny to see how there are still people who think that shopping online isn’t safe. They think their card details are going to get stolen and used for evil purposes and illegitimate purchases… or simply that they’ll pay and the product will never arrive. Let’s take a look at how to shop online safely and see if we can finally shake off that fear once and for all.

When people ask me about this, I say it’s just like in the physical world: depending on where you shop, I feel much more at ease putting my card in the card reader at Carrefour than at that street stall in Taiwan where I bought a fake Lego set. And to be clear, I’ve got nothing against Taiwan, it’s just that it didn’t give me the same good (and safe) impression. In this post we’ll go over some tips and things to keep in mind before handing over our card number online.

The most important thing: where we’re going to shop

Sticking with the comparison to the physical world, you need to look for trustworthy shops. Obviously this isn’t always possible, sometimes we need some weird item that’s not on Amazon, or we want to take advantage of a deal on some website… or we want something very specific that can only be found on the Taiwanese manufacturer’s website, so what can we do then?

First of all, let’s take a look at our browser to check that we’ve got the little padlock in the address bar. Nowadays the little padlock doesn’t really add much trust online, since pretty much anyone can install a legitimate certificate that shows that green padlock, but this certificate does tell us that the site is using the HTTPS protocol and that all communications are encrypted between our browser and the server with its database… in other words, that nobody could intercept our card details while they travel across the Internet. No, this doesn’t solve all our problems since we still don’t know if the shop itself can be trusted, so keep reading.

Another good idea could be to do a quick Google search to see what buyers say about that shop, surely if it’s a fake store someone has already complained. If you do this, you’ll be surprised at how often people ask about whether an online shop can be trusted over on ForoCoches.

Is there a payment gateway?

The name ‘payment gateway’ sounds pretty cool, right? It means that the shop in question isn’t handling your card itself, but instead implements a trusted third party’s payment method. It’s fairly common among Spanish shops. In other words, the moment you go to enter your card, you’re redirected to a secure Sermepa or Redsys page, which are well-known Spanish entities, and they’re the ones who’ll talk to your bank to check your balance and verify the transaction. This solution is ideal.

PayPal

Since the Spanish payment gateway isn’t very widespread in the rest of the world, on some sites you’ll find that you can use PayPal. If PayPal is supported, you can breathe easy. PayPal is an international payment gateway that’s extremely widespread across the Internet. It lets us link a card or bank account to our PayPal account so we can pay through this platform… in other words, we enter our PayPal username on the shop’s site, and they’re the ones who take care of checking whether we have enough balance and validating the transaction.

Not content with just that, PayPal also implements a payment recovery method that Spanish gateways don’t have. If you receive the product damaged, never receive it, or simply want to return it because it’s not what you wanted, PayPal freezes the money and doesn’t hand it back to you or give it to the shop until the mess gets sorted out. These kinds of disputes open up a direct line of communication between buyer and seller to clear up the misunderstanding, and if it doesn’t get resolved, then PayPal steps in to ‘arbitrate,’ asking for photos of the product or asking both parties what happened so it can mediate and act as judge. Of course all of this is regulated and works like a charm, always favoring buyer protection.

Ah, one more thing, PayPal lets us send money to our contacts (yes, just like Bizum or Apple Pay Cash… but for years now), which is really handy, for example, if someone pays for dinner and needs to be paid back their share, or if we buy some second-hand item and want to use PayPal as the payment method so we can rely on its security mechanisms if needed.

Oh, one more thing I almost forgot! Related to the last point, you can keep a prepaid balance in your PayPal account and use it however you like… whether for future purchases, payments between friends, or transferring it into your real bank account if you’d rather not keep it there.

Alright, I’ll give you a few minutes before continuing with the post so you can open a PayPal account, coming up with a very strong password like we already covered in that post a few weeks back (keep in mind that if someone manages to get into your PayPal account, they could send money to their own account or buy things charged to your real credit card, your real bank account, or your PayPal balance), and use it the next time you make a purchase online (except on Amazon, since it looks like they’re planning to roll out their own payment gateway soon and don’t want to support PayPal).

Card / Cash on Delivery / Bank Transfer:

Some websites offer several payment methods for their products: entering your card number, cash on delivery, or bank transfer. At first glance, cash on delivery might seem like the safest method since you pay when you receive the package, but unfortunately you can’t open the package beforehand to check that the contents are what you expected, so you could end up receiving a package, paying for it, and finding it full of rocks. Entering your bank card comes with the risks we already mentioned earlier; if the site isn’t completely trustworthy you could run into trouble… (don’t worry, you can shop at Zara with zero risk, I’m talking about those sketchy sites that claim you can get RayBans for 20% of their real price and aren’t even properly translated). Even so, some banks (almost all Spanish ones) offer the option of creating a virtual card that you can top up with funds, so on shopping sites you enter this virtual card’s number and, if it turns out to be a fraudulent site, the worst that could happen is that the balance on that card disappears… so you just top it up with the exact amount you need for your next purchase and you’re all set.

The bank transfer method is also safe from the standpoint of the transaction itself… but it usually takes several days for the transfer to reach the account and for the shop in question to confirm it and send you the product. Also, in the case of banks outside Spain, it might even come with fees that bump up the final price of the product.

There are other payment gateways like Apple Pay (yes, the same method we used for mobile payments that we already covered), the German company Boon, etc., but they’re much less widespread than PayPal, so whenever you can and it’s available, I’d recommend using your PayPal account that you set up in the previous section.

One last warning! Never, ever, ever will anyone ask you for your credentials, your card number, your PayPal account, or your PIN to access your bank via email. Sometimes you’ll get emails telling you there’s been some kind of security issue and that you need to log into your bank/account to fix it, giving you a link to click so you can go straight there to verify it. If you ever get one of these emails, you need to check whether it’s well written (scammers sometimes use automatic translators to send them out in multiple languages), check whether the ACTUAL sender is who they claim to be (by looking at the email address: BBVA_soporte@gmail.com doesn’t look like a real BBVA address, does it?), and if all of this seems legit, instead of clicking the link they gave you in the email, go open your bank/account website yourselves and see if once you’re inside there’s any security notification waiting. Don’t click on the link they send you by email. The default rule in these cases is always be suspicious, it’s better to just delete the email, and if the bank really has something to tell us, they’ll get in touch with us again.