Spot a fake checkout page before you type a card number
Copycat payment pages look convincing. A short list of checks catches most of them before any data leaves your hands.
In this guide
A fake checkout page is built for one purpose: to collect your card details and send them to someone else. The best ones copy the real store's logo, colors and layout perfectly. They reach you through ads, search results, social media posts, messages and emails, often around big sales, ticket releases or limited drops. Paying with a prepaid card limits how much such a page can ever take, but avoiding the page altogether is better. These checks take less than a minute and catch most fakes.
Check 1: the web address
Look at the full address in the browser's address bar, not the page content. Things to check:
- The domain name. Is it exactly the store's real domain? Fakes use near-copies: an extra letter, a swapped letter, a hyphen, or the real name followed by words like "-sale" or "-official".
- The ending. A store you know at one domain ending suddenly appearing at an unusual ending is a warning.
- Subdomains. In "store-name.checkout-secure.example", the real domain is "checkout-secure.example", not the store. Read the part right before the first single slash.
The padlock icon only means the connection is encrypted. Scam sites have padlocks too. It says nothing about who runs the site.
Check 2: how you got there
- Typed the address or used a bookmark? Low risk.
- Clicked a search result? Check whether it was an ad. Fake stores buy ads above real results.
- Followed a link in a message or email? Higher risk, especially if it promised a discount, a delivery problem or an urgent payment.
- Redirected unexpectedly to a payment page? High risk. Real stores rarely jump you to an unfamiliar domain to pay, and when they do, it is to a known payment provider.
Check 3: the offer
Fake shops lure people with prices that are too good: sold-out items in stock, luxury goods at a fraction of the price, big-brand electronics at half off. Combined with a countdown timer and "only 2 left", the pressure is designed to stop you thinking. Slow down whenever a page pushes you to hurry.
Check 4: the page itself
| Warning sign | Why it matters |
|---|---|
| Asks for card details before showing the order total | Real checkouts show what you are paying for first |
| Asks for your card PIN or online banking password | No online store needs these |
| Asks for an authenticator code to "confirm the card" | Codes protect your accounts; stores do not ask for them |
| No contact details, returns policy or company name | Real stores publish these |
| Spelling mistakes and odd grammar | Often a sign of a hastily copied site |
| Only unusual payment options, like gift cards or wire transfers | These cannot be disputed |
Check 5: the payment step
Legitimate payment pages often show a card-network verification step, where a window from the card side asks you to confirm. If a page asks you to type a code into the store's own form instead, be careful. Fakes sometimes ask for every security detail in one long form, hoping you will fill everything in.
About our own checkout
On BuyVCC, you pay for a card order through a hosted crypto checkout. Our order page sends you there directly, and the checkout page shows the order amount and the payment options. We never ask you to send a transaction hash by email, never ask for wallet seed phrases or private keys, and never ask for your authenticator code in a message. How a hosted checkout confirms payment explains what a real checkout does.
If you already entered details on a fake page
- Note the time and the page address.
- If you used a BuyVCC card, open a support ticket immediately with the card ending and the time. Do not send the full number.
- If you typed a password into the fake page, replace it on the genuine site, and on every other site where you reused it.
- If you entered an authenticator code, change your password and generate new recovery codes. A code expires quickly, but act anyway.
- Keep an eye on the balance shown in My Cards over the next few days; a drop you cannot explain is worth reporting.
Because a prepaid card holds a fixed balance, the most a fraudster can take is what is on it. That is a strong reason to use separate cards for unfamiliar stores, as explained in prepaid or bank card online.
Habits that prevent most problems
- Type the address of stores you know, or use your own bookmarks.
- Be wary of shopping links in messages, even from friends, whose accounts may be hacked.
- Use a dedicated card with a modest balance for new stores.
- Keep browser and phone software up to date.
- Review your browser extensions; see extensions that can read checkout pages.
Quick answers
Does the padlock mean the site is safe?
No. It only means the connection is encrypted. Check the domain instead.
Can I report a fake store?
Yes. Most browsers have a report option for deceptive sites, and the real brand usually welcomes reports.
See how it works and pricing. Paid orders are usually checked and issued within a few hours.
BuyVCC Team
The people who review BuyVCC orders write these guides from the questions customers send us. Notice something outdated? Let us know.