Safe online shopping: how to avoid fraud

Online shopping is a routine part of everyday life for most of us, and as a rule it goes perfectly well. At the same time the fraudsters have got better: fake online shops copy well-known brands down to the smallest detail, and phishing messages can be hard to tell apart from genuine notifications. The good news is that the vast majority of fraud attempts follow recognisable patterns. Learn the patterns and you can shop safely, including when you are hunting for good offers, as we write about in our guide to smarter online shopping.

How to recognise a fake online shop

A fake online shop usually gives itself away through a combination of signs: unrealistically low prices, a recently registered domain, a missing company registration number and contact details, and language that reads like machine translation. One sign on its own proves nothing, but if you find two or more at once, leave the purchase alone, however tempting the offer looks.

The most common signs are worth learning by heart:

• Unrealistic prices. Well-known brands at 70 to 90 per cent off outside the usual sale periods is the classic lure. No legitimate shop sells popular goods far below cost price over time. If the price is too good to be true, it usually is.
• Recently registered domain. Fraudulent shops rarely last long before they are shut down, so they are set up on fresh domains. A free lookup in a whois service shows when the domain was registered. If it is only a few weeks or months old while the shop claims “thousands of satisfied customers”, something does not add up.
• Missing company number and contact details. Norwegian online shops are required to state a company registration number, and legitimate ones show a physical address and have customer service you can actually reach. If you find neither a company number, an address nor a phone number, only an anonymous contact form, that is a bad sign.
• Poor language. Odd phrasing, a mix of Norwegian and English and obvious translation errors point to a site thrown together in a hurry, often from abroad, to harvest card numbers for a few weeks before it disappears.

Phishing: fake tracking texts and payment links

Phishing means messages that claim to come from someone you trust, such as Posten, Bring, your bank or an online shop, and that try to trick you into giving up card details or BankID codes. The basic rule is simple: do not click links in unexpected messages. Go directly to the sender's own app or website and check there instead.

The most widespread example in Norway is fake tracking texts. The message typically claims that a parcel from “Posten” or “Bring” has been held at customs, or that a small fee must be paid before delivery, with a link to a payment page that looks genuine. The page is built to steal your card details. If you really are expecting a parcel, open the tracking number in Posten's or Bring's own app instead of tapping the link; that gives you the answer without any risk.

Fake payment links also turn up when you sell something on online marketplaces. A “buyer” sends a link where you are supposedly going to “receive the payment”, but the page asks you for a card number or to approve with BankID. Remember: the person who is going to receive money never needs to give card details or log in through a link they have been sent. An account number is enough.

Email phishing follows the same recipe, often disguised as order confirmations for purchases you never made, invoices with a payment deadline or “your account has been blocked” alerts. The aim is always the same: to make you click in the heat of the moment. Check the sender address carefully, since it usually differs from the real domain by a single letter or an unfamiliar top-level domain, and log in to the service directly instead to see whether the alert is real. Be sceptical of shop adverts on social media too: the fact that a shop advertises on established platforms is no guarantee that it is genuine, so run the same checks there as anywhere else.

Choose payment methods that protect you

Payment cards are the safest way to pay in online shops you have not used before. If you pay by card, you can contact your card issuer and ask for the money to be reversed, known as a chargeback, if the goods never turn up or the shop turns out to be fraudulent. Paying in advance straight to a private individual, by contrast, gives you almost no protection.

A bank transfer or a Vipps payment to a private individual you do not know is in practice like handing over cash: once the money has been sent, it is hard to get back. If you pay by credit card you also have a statutory right under the Norwegian Financial Contracts Act to bring a claim against the card issuer if the seller fails to deliver, an extra safeguard that debit cards do not give in the same way. We have written more about which payment methods pay off in everyday life in Klarna, invoice or card: which pays off?

Check the shop before you enter your card number

A quick background check takes two minutes and weeds out most of the dubious operators: look up the company registration number in the Brønnøysund Register Centre, search for reviews of the shop from several independent sources, and look for established trust marks. Legitimate shops also state clearly what applies for the right of withdrawal, returns and complaints.

• Company number in the Brønnøysund Register Centre. Look up the number the shop gives. If the company does not exist, or is registered for something entirely different from what the shop claims, steer clear. Check as well that the company name actually matches the shop.
• Reviews from several sources. Search for the shop name together with words such as “fraud” or “reviews”. Stay critical at the same time: fake shops often plant their own five-star reviews, so look for patterns across independent websites rather than a single rating.
• Trust marks. Established certification schemes for online retail are a plus, but check that the mark actually links to the certifier; anyone can paste in a picture of a badge.
• Clear purchase terms. A legitimate shop explains the right of withdrawal, the return process and the right to complain in plain language. You can read more about what you are entitled to on a return in our guide to the right of withdrawal and returns.

BankID: never share one-time codes

BankID is personal electronic identification, and one-time codes and passwords should never be shared with anyone, not even the bank. Neither the bank, the police nor Posten will ever ring you and ask for codes, or ask you to approve something in the BankID app that you did not start yourself. If you are asked to, it is fraud. Hang up.

Many fraud attempts combine channels: first a phishing text or email, then a call from someone claiming to be from “the bank's security department” who creates urgency, along the lines of “your account is being emptied right now, you have to approve this to stop it”. Time pressure is the tool itself. Real banks always give you time to think it over, and you can always hang up and call the bank back on its official number.

Been defrauded? Here is what to do

If you have paid a fake shop or handed over card details, time matters. Contact your bank immediately to block the card and stop or reverse the payment, report the matter to the police, and get in touch with the Norwegian Consumer Council (Forbrukerrådet) if you need guidance on your rights.

• Call the bank first. Block the card and explain what has happened. Ask to raise a claim on the transaction (a chargeback) if you paid by card. The sooner you report it, the better the chance of stopping the payment or getting the money back.
• Report it to the police. Fraud can be reported to the police, including online. The report is also often useful documentation for the bank.
• Contact the Norwegian Consumer Council. They will advise you on what rights you have and how to proceed, for example if the bank rejects the claim.
• Change your passwords. If you have given away a password, or used the same password in several places, change it everywhere, and turn on two-factor authentication wherever it is available.

Safe online shopping comes down to habits in the end: check the shop before you pay, choose a card over paying strangers in advance, and keep your BankID codes to yourself. At Sparebørsen we work with established online shops, but the advice here applies wherever you shop, and it costs you only a couple of minutes per purchase.