Americans are expected to do much of their holiday shopping online this year even as the pandemic recedes, and criminals are expected to follow them. So here are some tips for safe digital shopping.
The United States has seen a steady rise in online card fraud in recent years, and it accelerated during the pandemic as more people shopped on the internet to avoid brick-and-mortar stores, according to a report this week from Aite-Novarica Group, a business and technology consultant. Losses from online card fraud are expected to reach almost $8 billion by the end of this year, up from about $6 million in 2019, the report said.
At the same time, consumers still expect to do about two-thirds of their holiday spending this year online, even though they feel less anxious about shopping in stores, according to a holiday retail survey published this past week by Deloitte.
And with tight supplies of merchandise and shipping delays from the lingering effects of the pandemic, holiday shoppers may turn to less familiar, less secure websites in search of the perfect gift.
“The supply shortage is drawing people to ever more peripheral websites,” said Brian Hamilton, chief executive of One, a start-up digital banking service. His company is seeing more disputed transactions, which is also happening in the broader payments and banking industry, he said.
Credit cards are often considered the safest payment option when shopping online because they have strong, federally mandated consumer protections. If you have a disagreement with a merchant or receive a defective product and can’t resolve the problem yourself, you can dispute it with your card company.
“The credit card goes to bat on your behalf,” said Chuck Bell, programs director of advocacy with Consumer Reports.
And if your card is stolen or hacked and you spot unauthorized charges, you aren’t liable for them — or could be responsible for $50 at most — if you report it promptly.
In addition, the major payment networks generally go beyond the requirements and extend zero fraud liability for credit card and certain debit card transactions, according to WalletHub.
Even so, having a card hacked can be a hassle. You’ll need to take time to report the matter to your card issuer. It will generally cancel your card and issue one with a new number, so you will need to reset any recurring payments or subscriptions.
For that reason, some shoppers may want to consider options like “virtual” credit cards or digital wallets, which add an extra layer of security when you use them.
Virtual cards are, in effect, temporary card numbers issued by your card company that are used to mask your real card number. You enter the virtual number when shopping online, and the merchant never sees your actual card number. So if the website is fraudulent, or if a legitimate site is breached, your card number isn’t exposed.
In some cases, there may be an extra step to take to use a virtual card. You must retrieve the virtual number from your credit card’s website and then enter it on the website where you’re shopping, said Ted Rossman, senior industry analyst at CreditCards.com. It doesn’t take long, but the added time may discourage some shoppers, he said.
Citibank and Capital One both offer credit cards with virtual options. (Capital One’s version functions as an extension on your internet browser, a bank spokeswoman said, so there’s no need to visit another website after you register. The virtual number is added automatically when you pay.)
Mr. Hamilton said One also offered virtual cards, for debit and credit cards.
Services like ApplePay and GooglePay can also add protection when payment cards are used. The services create random account numbers, or “tokens,” that shield your real number when you make a purchase. The services are handy when shopping in person because you can store your card numbers on your mobile phone’s wallet. They can also be used online, although availability varies by merchant. Look for the symbol for each payment option at checkout.
Tokens and other security featuresare also used by the “Click to Pay” service, an offering from the major card processing networks, including Visa and Mastercard, that’s recommended by the American Bankers Association. You must register your credit or debit card on the network’s website or through your card company, and then select the “Click to Pay” button when making a purchase on a retailer’s website.
The service is used by more than 10,000 merchants and has “tens of millions” of cardholder participants, said Sukhmani Dev, senior vice president of digital products, North America, at Mastercard.
Here are some questions and answers about safe practices when shopping online:
How else can I protect myself?
The Federal Trade Commission offers these tips: Shop with a credit card online, and never buy anything from online sellers that accept payment only by gift cards, money transfers or cryptocurrency. Such payments are nearly impossible to trace and reverse, and criminals often tell people to use those methods so they can get cash quickly, the commission says.
Vet unfamiliar websites before shopping by searching online for the merchant’s name and the word “complaint” or “scam,” the agency advises, and read the seller’s description of the goods carefully. If the seller offers brand-name goods at steep discounts, the agency said, “they might be fakes.”
The Privacy Rights Clearinghouse also recommends making sure the website shows a tiny lock icon, or https, in the checkout browser, indicating transactions are secure. You can also sign up for alerts from your bank or credit card so you are notified when purchases are made.
“The U.S. consumer really needs to be smart,” said David Mattei, a strategic adviser specializing in payments fraud at Aite-Novarica Group. If major retailers are out of an item, he said, there’s a good chance an online seller you have never heard of doesn’t have it, either. And if a website asks for details like your Social Security number, he said, “that should be a red flag” that the site is not legitimate.
Can I use a debit card to shop online?
You can, but experts like the Privacy Rights Clearinghouse generally caution against it. That’s because if the card is compromised, funds are taken directly from your bank account. There are consumer protections in place, but it may take time to resolve the issue and in the meantime you may be out the cash.
“It’s a different feeling, to see money gone from your bank account,” said Odysseas Papadimitriou, chief executive of financial website WalletHub.
What about ‘buy now, pay later’ services?
Online retailers are increasingly offering a buy now, pay later option at checkout; it allows you to buy an item and pay for it in installments. Many online shoppers began using this type of credit during the pandemic. But these options lack the same buyer protections as traditional credit cards, according to the Consumer Financial Protection Bureau.
The providers let you pay for an item over time, as a credit card does, but without interest. Still, they may charge hefty late fees if you miss payments, and they don’t have the same dispute protections as credit cards do if the product is faulty or damaged or turns out to be part of a scam. And returning items bought with these services may be complicated. You may be responsible for the total cost of a purchase even after you’ve returned it. Be sure, the bureau says, to carefully read and understand the merchant’s specific return policies.
(Traditional financial players, including Mastercard, are working on buy now, pay later options that would provide traditional credit-card protections.)