Safe Online Shopping for the Holidays and Beyond

Safe Online Shopping for the Holidays and Beyond article image.

This holiday shopping season might be the first time you'll be able to complete all your purchases without driving around the mall parking lot in despair or even changing out of your pajamas. An Experian survey projects that the average American consumer will spend $775 on holiday gifts this year, a 17% increase from last year. And with the pandemic causing a major shift in behavior, 62% of those we surveyed plan to shop more online compared with last year.

But there's one holiday tradition virtual shopping can't erase: the threat of identity theft and fraud. For many shoppers, that threat is more acute this year: 57% of consumers feel the risk of identity theft is greater this year due to the pandemic, according to an Experian survey. The holiday season brings more transactions and distractions, increasing the likelihood that your personal information will be hacked. That could result in account takeovers, fraudulent activity and full-on identity fraud. Although you can't eliminate this threat altogether, you can improve your chances of thwarting fraudsters by being extra mindful of security. Following a handful of safe holiday shopping tips can help prevent the disruption and hassle fraud tends to cause.

Protect Your Information

Identity theft happens when thieves steal your personal information, which could include your Social Security number; information associated with your credit card, online accounts or bank account information; and passwords or PINs.

Often, con artists get hold of someone's personal information by posing as a legitimate merchant, intercepting a legitimate transaction in progress or pilfering data long after you've made your purchase. The less information you give up when completing a transaction, the less vulnerable you are if a retailer or online seller is hacked. Consider doing the following to reduce your exposure:

  • Use Apple Pay, Google Pay or another digital wallet instead of your card. Digital wallets use an encryption system that replaces your card information with a one-time digital "token" when you make a transaction. You don't have to fully understand the technology—just know that the merchant never sees your card number and, if your payment data were ever breached, it would be useless.
  • Use a virtual private network (VPN). These work on your mobile phone and home computer to encrypt your online activity and ensure your information and transactions stay private.
  • Don't shop on public Wi-Fi. Although a VPN can help obscure your information, it's a good year-round practice to avoid any type of transaction that could disclose your personal information while using public Wi-Fi.
  • Don't store your card information online. Fraudsters will have less key information to access in the event of a data breach. When a merchant asks if you'd like to save your payment information for future purchases, think about saying know.
  • Be careful at points of sale. Thieves can attach skimming devices to card readers to capture your card information. Be especially careful when you're at a gas pump or outdoor ATM. Also be on guard against shoulder surfing: Thieves may be watching you enter your PIN at the ATM or sales counter.

Be a Social Skeptic

Social scams are becoming more common. Classically, these include phishing emails that capture your account or payment information by pretending to be a familiar vendor, or scam calls that attempt the same thing by phone. Social media is the new frontier for these scams, so keep your eyes out there as well.

  • Beware of social media ads. These often offer "too good to be true" pricing on your favorite items, but may simply exist to take your credit card information and leave you empty handed, or otherwise disappointed. Before making purchases, conduct some research into the company, keeping a special eye out for any customer complaints. If something seems off, it's often best to trust your gut. If the deal they're offering is vastly better than what's being charged by websites you know and trust, be leery. Also be skeptical of ads claiming a merchant has stock of widely sold-out items as well, such as video game consoles, as they may simply be looking to take advantage of desperate consumers.
  • Look out for email phishing scams. If you receive an email informing you of account irregularities—or anything else—don't click on any links in the email. Instead, ignore the email and go directly to the company's site. Call the support number listed on the website directly if you have any questions. If an email looks unusual, or is sent from an address you don't recognize, stay extra vigilant.
  • Be wary of social engineering phone calls. Here's the scenario: Someone's calling to let you know your account has been hacked. They ask you to read back the authentication code they just texted so they can verify your identity and fill you in on what's happened. Don't go along with it. Scammers may call to ask for all kinds of personal information or for a two-factor authentication code they need to log in to your account. They may even pose as a favorite charity looking for a donation. Hang up and, if you have any doubts, contact the company or charity organization directly to follow up.

Activate Card Security Features

EMV chips in credit and debit cards help to discourage counterfeit card fraud, but your card's security features don't stop there. Check out and try these options to keep your card information safe.

  • Turn your cards off when not in use. Many credit and debit cards now come with an on/off switch you can activate online or by app. Especially during the busy holiday season, consider leaving your cards "off" until you're about to use them.
  • Set up alerts and notifications. Set up text alerts that let you know when a big transaction—or even any transaction—is being attempted. It's a simple way to help spot and address potential fraud.
  • Use virtual cards for secure online shopping. Ask your card issuer if they offer virtual cards. These are temporary virtual credit card numbers that stand in for your regular credit card credentials for secure shopping online. If your virtual card number is compromised, your credit card number will remain safe. Citi and Capital One are two card issuers that offer virtual cards.

Let the Best Card Win

You can use credit or debit when shopping online, but be aware that there are differences.

  • Credit cards have an edge over debit for online shopping. Although fraudulent charges made on your debit card may be reversed, using a credit card is one way to avoid your bank account being depleted while you wait for the bank to investigate and reimburse you. Commonly, fraud protections are more stringent with credit cards, with many card issuers going as far as offering $0 fraud liability. If you don't want to run up a big balance on your credit card, consider loading up a prepaid card and using it instead.
  • If you must use debit, consider checking out with PayPal. Using PayPal Checkout lets you avoid entering card information on a retailer's site. PayPal provides a gateway between your information and the merchant, so they don't see—or store—your personal financial data.

Monitor Your Credit and Identity

Keep a close eye on your credit to make sure nothing suspicious is happening—during and after the holidays. Identity thieves may try to run up fraudulent charges on your existing accounts or open new accounts in your name and run up a balance they leave for you to deal with.

  • Set up free credit monitoring. Free credit monitoring with Experian lets you access your regularly updated credit score and report, and can alert you when changes occur to your credit file. This may be especially helpful during the busy, fraught holiday season, but it's also a good idea throughout the year. You'll spot potential problems with your credit file quickly and be able to address them more quickly.
  • Report suspicious activity or identity theft. If you think you are the victim of identity theft, contact the card issuer or bank directly using the number listed on the back of your card. You may also want to file a report with the FTC, notify credit bureaus and place a lock on your credit. Getting identity theft protection now can help you navigate this process if you ever need to.

Be Secure During the Holidays and Beyond

The holidays don't have to be prime time for identity theft. And being mindful of security is a good idea at any time of year. By maintaining basic cybersecurity, being wary of social scams, choosing and using the most secure payment cards, and monitoring your credit and identity, you can go a long way toward keeping ID theft at bay—during the holidays and throughout the year.

The purpose of this question submission tool is to provide general education on credit reporting. The Ask Experian team cannot respond to each question individually. However, if your question is of interest to a wide audience of consumers, the Experian team may include it in a future post and may also share responses in its social media outreach. If you have a question, others likely have the same question, too. By sharing your questions and our answers, we can help others as well.

Personal credit report disputes cannot be submitted through Ask Experian. To dispute information in your personal credit report, simply follow the instructions provided with it. Your personal credit report includes appropriate contact information including a website address, toll-free telephone number and mailing address.

To submit a dispute online visit Experian's Dispute Center. If you have a current copy of your personal credit report, simply enter the report number where indicated, and follow the instructions provided. If you do not have a current personal report, Experian will provide a free copy when you submit the information requested. Additionally, you may obtain a free copy of your report once a week through April 2022 at AnnualCreditReport.