An online shopping safety checklist is the kind of article you save once and refer to twice — once when something feels wrong about a checkout you are about to complete, and once after the fact when you are trying to figure out what to do. This article gives you a checklist short enough to actually use, plus the three follow-up moves to make after a purchase you are not sure about.
The online shopping safety checklist: before the click
1. The URL bar shows the padlock. Non-negotiable. If the connection is not encrypted, the data going from your browser to the shop is plain text. Do not type a card number, an OTP, or even an email into an unencrypted page.
2. The URL matches the merchant. Sometimes phishing sites set up nearly-identical URLs to the real shop (amaz0n.com instead of amazon.com, or appstore-jamaica.com instead of the actual app store). Read the URL carefully, especially if you arrived via a link rather than typing.
3. The shop accepts a vault token, not just raw card details. The signal: a "wallet" or "tap-to-pay" option, a card field that does not ask for the full CVV, or a checkout that triggers an in-app confirmation. Shops that only accept raw card details are increasingly the smaller, less-protected ones.
4. The total includes shipping and any duties. Caribbean online shopping increasingly involves import duties that get added late. A cart total that does not mention shipping, taxes, or duties anywhere is a cart you should approach skeptically.
5. The privacy policy and terms exist and are recent. Not because you have to read them, but because their presence is a signal that the merchant is operating under a known regime. Shops with no policy at all are the riskiest category.
Online shopping safety checklist: at the click
6. Authorize via biometric or in-app, not by typing. If the shop accepts your VendaVault, the authorization should appear on your phone with the merchant name and amount visible. Approve with biometric. If you have to type a card number, the protection chain is weaker — but still type it into the actual checkout form, not into a popup that asked for it.
7. Confirm the amount on the in-app prompt. A common shape of fraud is "merchant displays $50 but processes $500." The in-app prompt shows the amount being charged; check it matches.
8. Save the receipt. Email confirmation, screenshot of the order page, or both. The receipt is your proof for any future chargeback.
Online shopping safety checklist: after the click
9. Watch the email for unusual changes. Order delays are normal; "your card was declined, please update payment info" emails arriving in the same hour are not. Phishing follows the legitimate purchase, exploiting the fact that you are now thinking about that merchant.
10. Track the shipment. If the tracking number does not start updating within 3-5 days of a "shipped" notification, the merchant may be sitting on it. Contact them; if they ghost, file the chargeback.
11. Check the next card statement. Match the charge to what you intended to pay. The vault shows daily; the bank shows monthly. Both should agree.
The three moves after a purchase you are not sure about
You bought something, and within an hour something feels wrong. The merchant looks sketchier than it did, the amount was higher than you expected, the confirmation email never arrived. Three things to do, in order:
Check your VendaVault transaction history. The vault shows the charge as soon as the merchant initiates it, with the merchant's trading name. Does the trading name match what you intended to buy from? If yes, the only question is whether the goods arrive. If no, treat as a likely phishing or fraudulent merchant.
Revoke any tokens for that merchant. Five seconds. Stops them from charging again. You can re-authorize later if it turns out to be legitimate.
Wait 48 hours before disputing. Sometimes the confirmation email is just slow. Sometimes the tracking number takes a day. If 48 hours pass and nothing arrives, file the chargeback with the merchant trading name and the date.
The one thing the online shopping safety checklist does not protect against
A merchant who is technically legitimate but oversells what they will deliver. The padlock is there, the URL is right, the in-app confirmation looks fine — but the product that arrives is half what you expected. The checklist does not catch this; only the chargeback does. Always know your chargeback rights before any online purchase over US$50.
Open yours
If you have not set up your VendaVault yet, three of the eleven checklist items above only work with a vault — the biometric authorization, the in-app prompt, the per-merchant token revoke. Three minutes at vault.vendapay.net/register, and the checklist becomes a habit instead of a worry. Open your VendaVault →