Most online shopping goes fine, which is exactly why the one time it doesn’t feels so unfair. Americans reported losing a record $15.9 billion to fraud in 2025, across roughly 3 million reports. A surprising share of that money was not lost because someone picked the wrong shop. It was lost because of how they paid.
This guide ranks the common payment methods from safest to riskiest, explains what each one actually does for you when something goes wrong, and walks through a checkout routine that takes about two minutes. It also covers the free tools worth bookmarking, and what a VPN can and cannot do for your card details.
Why how you pay matters more than where you shop
Every payment method quietly answers one question: if this goes wrong, who can undo it? A credit card comes with a dispute process backed by law. A bank transfer, a gift card or a crypto payment usually has nobody standing behind it once the money has left. That one difference explains most of the fraud numbers below.
$15.9B reported lost to fraud in the US in 2025, up from $12.5 billion a year earlier, according to the FTC.
$4B+ of 2025 losses were paid by bank transfer or cryptocurrency, several times more than was lost through credit cards and payment apps combined.
$33.41B lost to credit, debit and prepaid card fraud worldwide in 2024, projected to reach $41.06 billion by 2030, according to the Nilson Report.
~40% of US online spending in 2025 went through digital wallets such as Apple Pay, Google Pay and PayPal, according to Global Payments.
The pattern is consistent year after year: the biggest losses flow through methods that cannot be reversed, while cards, the method people worry about most, account for a far smaller slice. Card fraud is common, but it is also the kind you can usually get your money back from. For the card figures, see CNBC Select’s breakdown of the Nilson and Global Payments data.
The safest ways to pay online, ranked
This ranking is by how much protection you keep if the seller turns out to be fake, not by convenience. The top two share one feature: the shop never sees your real card number, so there is nothing useful to steal.
Virtual card numbers
A throwaway card number that works for one purchase, or only with one shop, and can be frozen with a tap. If that shop leaks it, the number is useless anywhere else. Many banks now offer this in their app, and services like Privacy.com (US) and Revolut’s disposable cards do the same. It is the best choice for any shop you have not used before, and for free trials that “forget” to cancel.
Apple Pay and Google Pay
Instead of your card number, the shop receives a stand-in code (a “token”) that only works for that payment. Each purchase also needs your face, fingerprint or passcode, so a stolen phone is not a spending spree. You keep all the protections of the card behind the wallet.
Credit cards
The strongest legal protection of any standard method. Disputed charges are the bank’s money until the dispute is settled, not yours. In the US, federal law caps your liability for unauthorised charges at $50, and most issuers waive even that. In the UK, the NCSC recommends paying by credit card because Section 75 of the Consumer Credit Act makes the card provider jointly liable for purchases between £100 and £30,000.
PayPal and similar checkout services
Useful on marketplaces and with small sellers, because the seller never sees your card and buyer protection covers items that never arrive. One catch matters more than all the others: sending money as “friends and family” removes that protection entirely. A seller who asks you to pick that option is asking you to give up your safety net.
Debit cards
Fine with shops you trust, weaker everywhere else. Fraudulent charges come straight out of your account, and you wait for the bank to put the money back. Speed matters too. In the US, your liability grows the longer you wait to report: $50 within two business days, up to $500 after that, and potentially everything once 60 days have passed after your statement.
Prepaid cards
A prepaid card caps the damage at whatever you loaded onto it, which is its real value. Dispute rights are thin, fees are common, and plenty of shops refuse them, so treat it as a firewall rather than an everyday card.
| Payment method | Shop sees your real card number? | Money back if it’s a scam? | Best used for |
|---|---|---|---|
| Virtual card | No | Yes | New shops, subscriptions, free trials |
| Apple Pay / Google Pay | No, a token | Yes, via the linked card | Everyday shopping where supported |
| Credit card | Yes | Yes, strongest legal rights | Larger purchases |
| PayPal (goods and services) | No | Usually | Marketplaces, small sellers |
| Debit card | Yes | Sometimes, via chargeback | Shops you already trust |
| Bank transfer, crypto, gift card | Not applicable | Almost never | People and companies you know well |
Payment methods to avoid with anyone you don’t know
None of these are unsafe in themselves. Paying your landlord by bank transfer is normal. The problem is that each one is final the moment you press send, which is exactly why scammers ask for them.
Bank and wire transfers
The single most expensive payment method in fraud reports. Once the money lands, your bank has little power to pull it back, and fake online shops love offering a “5% discount for bank transfer”.
Gift cards
Anyone holding the code can spend it, anywhere, instantly. No real company, tax office or support desk ever asks to be paid in gift cards. If you are asked, you are talking to a scammer.
Crypto and instant payment apps
Crypto has no bank to call and no undo button. Apps like Zelle, Venmo or Cash App are built for paying friends, and most offer little or no protection when you pay a stranger for goods.
The rule that catches most scams: if a seller or “support agent” insists on one specific payment method, especially a transfer, gift card or crypto, the request itself is the scam. Real businesses take cards.
The two-minute safe checkout checklist
Five steps, in order. The first one takes the longest, and it is the one that stops a fake shop before your card details ever come into it.
Step 1
Check the shop is real
Fake shops copy logos, photos and layouts in minutes, so looks prove nothing. Three quick checks do:
Paste the address into ICANN Lookup to see when the website was registered. A “brand outlet” with 80% discounts that was registered three weeks ago is not a brand outlet.
Run it through Google Safe Browsing and ScamAdviser, and read reviews on Trustpilot rather than the ones on the shop’s own pages.
If you arrived from an ad, a text or an email, close it and type the shop’s address yourself. Lookalike addresses such as “nike-outlet-sale.shop” are built to pass a quick glance.
Step 2
Pay with a virtual card or a wallet
Use Apple Pay, Google Pay or a virtual card number where you can, and a credit card where you can’t. Keep the debit card for shops you have used for years.
Step 3
Check out as a guest and share the minimum
Skip creating an account unless you will genuinely shop there again, fill in only the required fields, and say no when the site or browser offers to save your card. A card that is not stored cannot leak in the shop’s next data breach.
Step 4
Lock down the accounts behind the payment
Your email, bank and PayPal accounts are the real keys. Give each one a unique password (a free password manager like Bitwarden remembers them for you), switch on two-step verification, and check Have I Been Pwned to see whether your email has already turned up in a breach.
Step 5
Turn on payment alerts
Every banking app can send a notification for each card payment. It costs nothing, and it turns “I noticed on my statement six weeks later” into “I noticed in ten seconds”, which, with a debit card, can decide whether you get your money back.
Shopping on hotel or cafe Wi-Fi?
ZoogVPN encrypts your connection on networks you don’t control and blocks known malicious sites before they load.
Where a VPN fits
An honest starting point: legitimate checkout pages already use HTTPS (the padlock in the address bar), so your card number is encrypted on its way to the shop with or without a VPN. A VPN adds protection around that connection, not inside it.
Where it genuinely helps is on networks you don’t control. On airport, hotel or cafe Wi-Fi it hides which sites you visit from everyone else on the network and protects you from fake hotspots and tampered DNS. ZoogVPN’s Shield feature also blocks ads, trackers and known malicious domains, so some fake shop pages and phishing links simply fail to load. Here is how to cut down the personal data that makes targeted scams possible in the first place.
Worth knowing
A VPN does not make a fake shop safe. If the shop itself is the scam, an encrypted connection just delivers your card details to the scammer privately. Checking the shop (Step 1) and choosing the payment method (Step 2) protect you. The VPN protects the road in between.
If you have already paid a scammer
Speed matters more than anything else here. Do these three things today, not after the weekend.
Call your bank or card provider. Use the number on the back of your card, never one from an email or text. Ask them to block the card and start a dispute or chargeback. For UK credit card purchases over £100, mention Section 75.
Change your passwords. Start with the email account linked to the purchase, then any account that shares that password. Turn on two-step verification while you are there.
Report it. In the US, file a report at ReportFraud.ftc.gov. In the UK, report to Report Fraud (Police Scotland in Scotland), forward scam texts to 7726 and scam emails to [email protected]. Reports are how fake shops get taken down.
Frequently asked questions
What is the safest way to pay online?
A virtual card number or a digital wallet such as Apple Pay or Google Pay, because the shop never receives your real card number. A credit card is the next best option, thanks to its strong legal dispute rights.
Is it safer to pay by credit card or debit card?
Credit card. Disputed charges come out of the bank’s money rather than yours, and the legal protections are stronger. With a debit card the money leaves your account first, and how much you get back can depend on how quickly you report.
Is PayPal safe for buying from strangers?
Yes, as long as you pay as “goods and services”. The “friends and family” option skips buyer protection, and a seller asking you to use it is a red flag.
Can I get my money back after a bank transfer scam?
Sometimes, if you contact your bank immediately and the money has not been moved on yet. Some countries, including the UK, now have reimbursement rules for certain transfer scams. Recovery is never guaranteed, which is why transfers should be kept for people and companies you already know.
Does a VPN protect my card details when shopping?
Partly. HTTPS already encrypts the card number on its way to the shop. A VPN adds protection on public Wi-Fi and, with ad and malicious-site blocking, keeps some scam pages from loading at all. It cannot protect you from a shop that is itself fake.
Shop from anywhere without worrying about the Wi-Fi
ZoogVPN encrypts your connection on every network and blocks ads, trackers and known malicious sites. AES-256 encryption, a kill switch and a strict no-logs policy, on up to 10 devices.
- Diana BestaievaContent Writer at ZoogVPN. Diana deeply explores the newest technologies and shares valuable insights engagingly and comprehensively. Keeping up with the tech news, she makes in-depth content, explaining complex concepts with ease.
