Staying safe
Checking a payment page
What you will be able to do In 6 minutes, you'll know how to check that a payment page is trustworthy before entering your card details.
The moment of paying is the one scammers most like to imitate. A page can look exactly like a real checkout, with a nice-looking cart and a padlock in the address bar. Yet some details don't lie: the exact address of the website, what a form is allowed to ask you for, and how a real bank actually verifies a payment. We're going to examine a payment page together, on a screen we designed. Nothing here is real, so nothing can happen to you.
Simulated screen
I practice
This screen was drawn by us. Nothing is sent, nothing is installed, and no real brand is shown.
The situationYou've just picked out an item on an online shop, and the payment page shows up in front of you.
The interactive exercise needs JavaScript. The written step by step, just below, says exactly the same thing.
The written step by step
The same steps, in words, to read or print. This sheet works even without the exercise.
The address, before you get your card out
Your turn Before paying, touch the website's name: the part that really matters.
After "https://" and up to the first forward slash, that's the website's name: here, papeterie-du-lundi.example. That's the name you check.
The padlock isn't enough
Your turn Touch what truly guarantees you're in the right place.
The padlock only proves the trip is encrypted. Only the address checked by hand truly tells you where you are.
The field that has no business being there
Your turn One field on this form should never be asked for. Touch it.
The 4-digit PIN is only ever typed at an ATM or a payment terminal, never on a screen. A form that asks for it should be closed.
The real verification
Your turn An extra verification kicks in. Touch the one that's normal.
The verification that counts arrives in your bank's app, on your phone: a notification for you to open and confirm yourself, never a code given by the payment page.
The decision
Your turn You've just spotted a page that isn't right. Touch what you do.
We close the page without sending anything, then contact the shop again through a method we already know, not through this page.
The sheet to keep
- The website's name, right before the first forward slash, is the only part of the address that truly matters.
- The padlock and the "https" say the connection is encrypted, not that the website is honest.
- A payment form asks for the card number, the expiry date, and the 3-digit code on the back, never more.
- The 4-digit PIN is only ever typed at an ATM or a terminal, never on a screen.
- The real extra verification arrives in your bank's app or through a message it sends, never from the page where you're paying.
- If in doubt, close the page and contact the seller again through a method you already know.
The reflexes in this skill
The padlock is not enough: I read the address
The little padlock icon means the connection is encrypted, not that the site is honest. A scam site has one too. The name of the site sits just before the first forward slash: that is where to look.
I go through the official door
The address typed in by hand, the app installed from the official store, the phone number printed on the back of your card. Never the link someone hands you, even when it looks right.
I stop before I click
Urgency is the sign of a trap. A message that counts down the hours is trying to stop you from thinking. Putting your phone down for two minutes costs nothing, and it is almost always enough.
Two questions to check
Nothing is graded, and nothing is saved anywhere except in your own browser.
A payment page shows a closed padlock next to the address. What can you conclude from that?
See the answer
The connection is encrypted, but that says nothing about the website's honesty
The padlock protects the information in transit, not the destination. A dishonest page can have one too, just like a real website. Only the address checked by hand has real value.
A payment page asks for your 4-digit PIN. What do you do?
See the answer
I close the page: this code is never asked for online
This code is only used at ATMs and physical terminals. No legitimate website asks for it online, padlock or not: it's a sign of a dishonest page.
I've done it
Check this box once you can do this skill on your own.
Your progress stays in your own browser.