You find a laptop at a price that looks almost too good to be true. The website looks professional, checkout is quick, and a padlock appears beside the web address.
That still does not guarantee the seller is genuine.
Fake stores and phishing pages can copy the look of trusted businesses, collect card details and disappear. Other websites may be genuine but have compromised payment pages.
Before you enter your card details, take a couple of minutes to check the website, the payment page and the information being requested. Here is what to look for, what should make you pause, and what to do if you have already entered your details.
This article provides general safety information. If you suspect fraud, contact your bank or card issuer promptly.
Why You Should Check a Website Before Paying Online
A website can look convincing and still put your money or personal information at risk.
Common threats include:
Phishing pages: Fake versions of bank, merchant or payment pages designed to collect card details, passwords or verification codes.
Fake online stores: Websites that accept payment but never deliver the goods or services advertised.
Compromised checkout pages: A genuine website whose payment page or systems have been tampered with.
Fraudulent payment links: Links shared through email, SMS, WhatsApp or social media that send you to an imitation website.
Impersonation: Someone pretending to represent a known business, bank or customer-support team.
A quick check cannot identify every threat, but it can help you avoid obvious warning signs before sharing sensitive information.
Check the Website URL and Domain Name
Start with the full address in your browser's address bar. Do not rely on the logo, colours or name displayed on the page.
Read the actual domain
Consider this example:
{examplebank.com.secure-login.net/pay}
The registered domain in this example is secure-login.net, not examplebank.com. The first part of the address is being used to make the link look familiar.
When checking a domain, identify the main domain immediately before the first single slash after the hostname. Be alert to extra words and brand names that appear as part of a longer, unrelated domain.
Look for misspellings and look-alike characters
Scammers may use a domain that differs from the genuine one by a single character. For example, a letter may be missing, two letters may be reversed, or a character may resemble another one.
Read the address carefully instead of assuming it is correct because it looks familiar at a glance.
Watch for extra words and unfamiliar endings
A domain such as examplebank-support.com is not automatically owned by the bank whose name appears in it. Similarly, a familiar brand name on a different domain ending deserves a closer look.
A different ending does not prove a website is fraudulent, but it is a reason to verify the address through an official source.
Be careful with shortened links
Shortened links hide the destination address. If a link comes from an unexpected message, an unfamiliar seller or an account you cannot verify, do not open it just to see where it goes.
Instead, visit the company's official website by typing its known address yourself or opening its official app.
Does HTTPS Mean a Website Is Safe?
No. HTTPS encrypts the connection between your browser and the website, helping protect information while it is transmitted. It does not prove that the business is genuine or that the website is safe to use.
A scam website can use HTTPS too.
The padlock is therefore one technical signal, not a guarantee of trustworthiness. Check that the domain matches the business you intended to visit, and investigate the seller separately.
If the address is unfamiliar, the offer is suspicious or the page asks for unexpected information, do not proceed just because the browser shows a padlock.
Check the Website's Reputation and Contact Information
Before paying an unfamiliar business, look for signs that it is identifiable and accountable.
Check the business identity
Look for a legal business name, a working contact method and an address where relevant. If the business claims to be registered in Nigeria, you can search for its details through the Corporate Affairs Commission's official services.
For a foreign company, check the appropriate official company register in its home jurisdiction where one is available.
Registration alone does not guarantee that a seller is honest, so treat it as one check among several.
Test the contact details
Look for an email address, customer-support channel and phone number. If you are making a significant purchase, contact the business before paying.
Be cautious if the seller provides only a personal social-media account, refuses to answer basic questions or pressures you to pay before you can verify who they are.
Look for independent reviews
Search for the business name alongside terms such as “reviews”, “complaints” or “scam”.
Read reviews on independent platforms rather than relying entirely on testimonials published by the seller. A sudden collection of similar five-star reviews is not proof of fraud, but it is worth investigating.
Check the domain's registration history
ICANN's Lookup tool can show available registration information for many domains, including the creation date.
A newly registered domain is not automatically fraudulent. However, if a website claims to have operated for many years but its domain was registered very recently, investigate the inconsistency before paying.
Some registration details may be hidden or unavailable, so this check is not conclusive on its own.
Read the policies
Look for shipping, returns, refunds, privacy and customer-support policies where relevant. Check whether the terms make sense for the business and whether the details agree with what the seller told you.
Copied, contradictory or vague policies can be a warning sign, especially when combined with other concerns.
Look for Red Flags on the Payment Page
Even if the shop itself looks legitimate, check the checkout page before entering your details.
Pause if you notice any of the following:
An unexpected redirect: You are sent to an unfamiliar domain without a clear explanation.
An unusual payment request: The seller asks you to send money to an unrelated personal account for an ordinary online purchase.
Unusual payment methods: The seller insists on gift cards, cryptocurrency or an irreversible transfer when you expected a conventional checkout.
Pressure to pay immediately: You are told to ignore warnings, act within seconds or pay before you can verify the seller.
Unexpected pop-ups: A new window asks you to “verify” your card or update account details in a way that does not match the payment you started.
Prices that seem implausibly low: The deal is dramatically cheaper than comparable offers and the seller cannot explain why.
Unnecessary personal information: The page asks for your banking password, BVN or NIN without a clear, legitimate reason related to the service.
A redirect to a payment processor is not inherently suspicious. Many genuine businesses use third-party payment gateways. The question is whether the checkout is consistent with the merchant, whether the destination is credible and whether the information requested is appropriate.
How to Check Whether a Website or Link Is Suspicious
If you are still unsure, use more than one method.
1. Preview the link
On a desktop computer, hover over the link to see its destination. On a phone, you can often press and hold a link to preview it, although the exact behaviour depends on the app.
If the address looks unrelated to the company or hides an unexpected destination, do not proceed.
2. Use a website reputation checker
Tools such as Google Safe Browsing's Site Status, VirusTotal and urlscan.io can help you investigate a suspicious address.
These tools are useful for checking known threats and examining website behaviour, but their results are not guarantees. A newly created scam page may not yet appear on any blocklist. Do not enter card details into a tool that asks for them.
Also be mindful that submitting a URL to a public scanning service may make that URL visible to other users. Avoid submitting private, personalised or sensitive links.
3. Search for independent reports
Search the exact domain name with terms such as “scam”, “fake” or “reviews”. Check whether others have reported suspicious behaviour.
A lack of complaints does not prove a site is safe, especially if it is new.
4. Compare it with the official website
If the page claims to belong to a bank, merchant or payment company, open the company's official website or app separately.
Compare the domain and contact information. Do not use the contact details supplied by a suspicious message to verify that same message.
5. Confirm through another channel
If someone sends you a payment link, confirm it with them using a phone number or account you already trust. If a supposed bank representative contacts you, end the conversation and contact your bank through its official channel.
Do not let urgency replace verification.
What Information Should a Legitimate Payment Page Ask For?
A typical online card checkout may ask for:
Card number.
Expiry date.
CVV or security code.
Name on the card, where required.
Billing address or postcode, where required.
Email address or phone number for a receipt or transaction update.
Depending on the card, issuing bank, merchant and payment method, you may also be asked to complete an authentication step, such as approving the payment through your bank or entering a one-time password (OTP).
The important point is that the request should make sense for the transaction you initiated.
Be cautious with PINs, passwords and verification codes
Never give your bank login password to a merchant or a person claiming to help with a payment. Never read an OTP or authentication code to someone over a call or chat because they ask you to do so.
Be particularly cautious if a page asks for your BVN or NIN during an ordinary card checkout without a clear reason.
There is a Nigeria-specific detail worth knowing: some legitimate local payment flows may ask for a card PIN or other card authentication details, depending on the card, payment method and gateway. For example, some local card transactions have different authentication steps from international online checkouts.
That does not mean every PIN request is legitimate. If you are unsure whether the page belongs to the genuine payment provider, stop and verify it through the merchant or your bank's official channel before proceeding.
Do not follow a rule such as “every page asking for a PIN is fraudulent” without considering the payment method. Equally, do not enter a PIN just because a page looks professional.
What to Do Before and After Making an Online Payment
Before you pay
Use this short checklist:
Confirm the website domain.
Check that the payment page is consistent with the merchant and expected payment process.
Review the final amount, currency and any additional fees.
Use a payment method that provides an appropriate way to raise a dispute if something goes wrong.
Turn on transaction alerts through your bank or card provider, where available.
Keep the order confirmation, receipt and seller's contact details.
For unfamiliar merchants, consider using a virtual card if your provider offers one and its terms suit the transaction. Check the card's limits, funding arrangements and available security controls first.
After you pay
Do not stop paying attention once the transaction is complete.
Check that the transaction alert matches the amount you agreed to pay.
Keep the receipt and order confirmation.
Review your account activity for transactions you do not recognise.
Contact the merchant through its verified support channel if the order does not arrive or something seems wrong.
Contact your bank or card issuer promptly if you suspect card theft or an unauthorised transaction.
The sooner you report suspected fraud, the sooner your bank or card provider can advise you about blocking the card, disputing transactions and protecting the account.
Can a Virtual Card Make Online Payments Safer?
A virtual card can help separate some online spending from your main bank card, depending on how the provider structures the product. It may also give you more control over the amount you make available for online purchases.
But a virtual card does not make a fraudulent website trustworthy. If you enter its details into a phishing page, those details may still be misused.
Before using a virtual card, check:
How it is funded and whether its balance is separate from your main account.
Whether you can freeze or disable it.
Whether transaction limits are available.
What fees apply to card creation, funding, currency conversion and payments.
How to report an unauthorised transaction and what dispute process is available.
Use only the features your provider actually offers. Do not assume every virtual card has spending limits, instant freezing or the same protections.
We built our virtual dollar card to make international online payments easier for our users. As we prepare to launch on 30th october, we're committed. to providing a reliable and secure payment experience. In the meantime, the safety tips in this article can help you protect your card details and make safer online payments, regardlesss of your card provider.
Frequently Asked Questions
Are HTTPS websites always safe?
No. HTTPS encrypts the connection between your browser and the website. It does not prove that the seller is genuine. Check the domain, the business identity and the payment page before entering card details.
How can I check whether a website is genuine?
Start by checking the full URL and looking for misspellings or unfamiliar domains. Verify the business's identity and contact details, search for independent reviews, and use a website reputation checker if necessary. No single check guarantees that a site is safe.
Are website-checking tools always reliable?
No. They can identify known threats, but a new fraudulent site may not have been reported yet. Use them alongside other checks, and never enter sensitive payment details into a checker.
What should I do if I entered my card details on a suspicious website?
Contact your bank or card issuer immediately. Ask whether you should block or replace the card, and review recent transactions for anything you do not recognise. If the card is virtual, use the provider's available controls to freeze or disable it if possible.
Change any password you entered on the suspicious page, especially if you reused it elsewhere. Preserve screenshots, receipts and messages as evidence, and report suspected fraud through the appropriate official channels.
In Nigeria, you can start with your bank and use the Nigeria Police Force National Cybercrime Centre's official e-reporting portal at nccc.npf.gov.ng. The EFCC also provides a petition and reporting route through its official website. Use official channels and be wary of anyone who promises to recover your money in exchange for an upfront fee.
Is it safe to buy from a website I found through an advert?
An advert does not guarantee that a website is legitimate. Ads can lead to genuine businesses or fraudulent pages. Check the URL, seller identity, payment process and independent reputation before paying.
Can a virtual card prevent online fraud?
No. A virtual card may help you separate online spending from your main card, depending on its features and terms, but it cannot guarantee that a merchant is legitimate or prevent every type of fraud. Always verify the website before entering card details.