Shopping and paying safely: habits that protect you better than software

Most online fraud breaks no encryption and penetrates no bank. It persuades the account holder to hand over the key voluntarily, usually in a moment of haste or alarm. Because real protection is a set of habits rather than a piece of software, here are the ones we find genuinely sufficient for anyone who shops online regularly, whether they are buying from Goldy Store or from anyone else.

Before you buy, check the shop rather than the advert

An attractive advert tells you nothing about who stands behind it. Look at the shop itself. Does it have a real address and a telephone number that someone answers? Are the terms, returns and privacy pages present and seriously written, rather than copied boilerplate? Is the returns policy stated plainly? A shop that hides how to contact it is telling you something important before you have paid anything.

Be equally wary of an offer that looks better than it could possibly be. A price wildly below the entire market is not a lucky find. It is usually bait, a counterfeit, or an item that will never ship at all.

At the moment of payment

• Never give a verification code to anyone. The code sent to your phone is a one-time key. No shop employee, no bank employee and no courier ever needs it. Anyone asking for it is trying to enter your account at that exact moment.
• Pay from inside your own order page, not from a link that arrived in a private message. Sent links are the easiest thing in the world to forge, and one changed character in an address is enough to land you somewhere that is not us.
• Check the amount and the currency before you confirm, and make sure any additional charges appeared before payment rather than after it.
• Read your bank notification as it arrives and match it to your order. A charge you cannot account for should be reported the same day, not a month later.

Signals that justify stopping on their own

Fraud depends on hurry, which is why time pressure is its clearest signature: the offer ends in minutes, your order will be cancelled unless you confirm now, your parcel is held until you pay a small fee through this link. Add to that a request to pay by personal transfer to an individual name, or a message from a shop you know but sent from a number or an email address you have never dealt with. In every one of these cases the response is the same: close the message, go to your account at the shop directly, or call the number published on the site — ours is 009004 — and ask. Nobody has ever lost anything by verifying.

Your own account

Use a password unique to each shop rather than one password everywhere, because a single leaked site otherwise opens all the others. Turn on two-step verification wherever it is offered. Do not store card details on a shared device, and do not complete a payment over an open public network. If you shop from a device that is not yours, sign out deliberately rather than just closing the window.

After the purchase, keep the trail

Hold on to the order number, the confirmation message and the bank notification until the parcel arrives and you are satisfied with it. Those three things reduce any later dispute to a few minutes, whether it is with the shop or with your payment provider. And track your order from your account rather than from messages of unknown origin claiming to be delivery updates.

If it goes wrong anyway

If you have given your details to something that turns out to be fake, speed matters far more than embarrassment. Tell your bank or card issuer immediately so the card can be stopped, change the password on every account where you reused it, and then tell the shop that was impersonated so they can warn others. Nobody on our team will ever ask you for a card number, a PIN, or a verification code under any circumstances. Anyone doing so in our name is an impostor, and reporting it to us protects the next buyer after you.