Looks are easy to copy; the domain and the certificate are not. A genuine checkout page opens on the payment service domain over HTTPS, shows the amount and the purpose of the payment, and never asks for data a payment does not need.
What to check
- The domain in the address bar: fakes use lookalike names with extra words and hyphens.
- An HTTPS connection with a valid certificate.
- The amount and purpose matching what was agreed.
What should raise an alarm
- A request for your card PIN, an SMS code on a third-party site, or your online banking password.
- A page opened from an email about an "unexpected refund" or a "blocked card".
- Pressure to hurry: "pay within two minutes or the order is cancelled".
What a merchant can do
- Send links only from an account or address the buyer already knows.
- Publish how your checkout works and which domain it uses.
- Never ask a buyer to send card details in a chat.
Whether payment links are safe is covered separately.
