Shopping online safely – ITSAP.00.071

Understand common online shopping threats

Online shopping could put you and your organization at risk of identity theft, account compromise and financial loss. Threat actors now use a wider range of techniques to make fraudulent websites, ads and messages appear legitimate and trustworthy. Some of these techniques may be automated or enhanced using artificial intelligence (AI), making scams harder to detect. The following examples demonstrate common ways threat actors can gain access to user accounts and obtain sensitive information:

• fake e-commerce sites that collect your information or payment details after you complete a purchase without delivering goods or services
• fraudulent payment processing sites, including fake checkout pages or third-party payment requests, that collect money for fake or unauthorized transactions
• websites that do not use encrypted connections (such as, HTTPS), increasing the risk of your information being intercepted, particularly when you use public or unsecured networks
• websites or online marketplaces that lack basic consumer protections and do not verify sellers, increasing the risk of fraud
• impersonation scams where criminals copy the names, logos, and designs of real retailers or delivery companies
• fraudulent shopping links or QR codes delivered through malicious shopping apps, social media ads, emails or text messages
• requests to move payments outside the official checkout process, such as paying by e-transfer, gift card or cryptocurrency, or to return money for an alleged overpayment

Professional-looking websites, padlock icons, encrypted connections and familiar brand names do not guarantee a site is legitimate. Many fraudulent shopping sites are designed to closely resemble trusted retailers and exploit the trust users have in familiar brands.

Recognize the warning signs of a scam

Fraudulent shopping websites, including those created with AI tools, can appear legitimate and convincing. Use the following checks to help assess whether a website is safe to use.

Check how the website looks and behaves

• Look for poor design elements that make the site appear unprofessional
• Observe whether links, buttons and navigation features seem to work properly
• Check for clear contact information such as an address, email or phone number
• Review the privacy, return and refund policies and make sure they are clear
• Question requests for personal or payment information that is not needed for your purchase

Be careful of unusual offers and suspicious messages

• Compare prices and be cautious of deals that seem too good to be true
• Review shipping costs, duties and extra charges for anything that seems abnormal, and be cautious of unexpected fees that significantly increase the total cost
• Notice pressure tactics that push you to act quickly, such as limited time or last-chance messages
• Be alert to unexpected follow-up messages or customer-support requests claiming issues with your payment, delivery, customs fees, refunds or order status that require urgent action

Protect yourself when shopping online

The steps below can help protect you and your organization when shopping online. While these practices reduce risk, no single step can eliminate it completely.

Research the retailer

Before making a purchase:

• search for independent reviews beyond the retailer’s website
• check how long the retailer has been operating and whether it has an established online presence
• look for complaints, scam reports or unresolved customer issues
• confirm that customer service channels respond to inquiries before making large purchases

When a product is advertised through a social media platform or marketplace:

• confirm whether the seller or account is verified by the platform
• review feedback from multiple verified or confirmed buyers and look for consistent patterns across reviews
• use reputable online marketplaces with clear return and fraud-protection policies for third-party resellers

Browse safely

When visiting shopping websites:

• configure CIRA Canadian Shield on your home network or devices to help block known malicious websites
• use websites that support encrypted connections (HTTPS) to help protect your information
• follow browser security warnings and do not continue to websites flagged as unsafe
• do not rely on padlock icons or website appearance alone to determine if the site is legitimate
• be careful when shopping on mobile devices, where shortened URLs and limited screen space can make fraudulent sites harder to identify

Protect your accounts

To reduce account and payment-related risks:

• create a unique and strong passphrase for each online account
• avoid reusing passphrases for shopping, email and financial accounts
• use phishing-resistant multi-factor authentication (MFA) where available
• check your credit card statements regularly for unfamiliar charges
• use a safe form of payment from major financial institutions, such as credit cards, that offer fraud protection or chargeback options
• use virtual credit card numbers or accounts with spending limits when shopping with unfamiliar retailers

Take additional precautions

To further reduce your exposure, you should:

• limit the amount of personal information you provide to what is strictly necessary
• use guest checkout when available to reduce the likelihood that the retailer will store (or share) your personal information.
  • if you create an account, protect it with a strong passphrase and MFA
• regularly back up your devices and update them with the latest security patches
  • use secure, password-protected Wi-Fi networks and avoid making purchases on public Wi-Fi
• be cautious of promotional emails, texts or messages offering special deals
• go directly to retailers’ official websites instead of clicking links

Steps to take after an online shopping incident

Threats and scams can be difficult to spot. You may not even know that you’ve been targeted until after your money has been stolen or information has already been shared. Even if you’re not sure if you’ve been scammed, it is important to act quickly. If you believe you are the victim of a scam or a potential compromise, you should take the following actions to report and mitigate the incident.

Step 1: Notify your organization

If the purchase was made on behalf of your organization or involved organizational accounts, devices or payment methods, report the incident to your security department, technical support or senior management. Early reporting helps reduce further risk and supports organizational response and recovery.

Step 2: Contact your credit card company

Report the suspicious transaction immediately. Ask your bank or credit card company to cancel or reverse the charge and clarify whether account monitoring or a replacement card is needed.

Step 3: Reset affected accounts

Change passwords for any affected shopping, email and social media accounts. Use strong, unique passphrases and turn on phishing-resistant MFA where available. If you used the same password on other sites or accounts, change it on those accounts too and use unique passwords for each of your accounts going forward.

Step 4: Report the incident

Report fraud and cybercrime to the Canadian Anti-Fraud Centre or by calling 1-888-495-8501. You should also report attempted scams even if you didn’t lose any money, as this information helps protect others.

Learn more

• Using encryption to keep your sensitive data secure (ITSAP.40.016)
• Best practices for passphrases and passwords (ITSAP.30.032)
• Secure your accounts and devices with multi-factor authentication (ITSAP.30.030)
• How updates secure your device (ITSAP.10.096)
• Virtual private networks (ITSAP.80.101)
• How to spot an unsafe online store