#ad · Affiliate disclosure: This guide contains NordVPN and NordPass affiliate links. If you buy through them, Top Shelf Picks may earn a commission at no extra cost to you. Almost everything on this checklist is free to do, and we say where a free tool works just as well.

Holiday online shopping security checklist 2026

By Top Shelf Picks · November 2, 2026 · Card protection rules from the FTC and CFPB consumer pages; product features from NordVPN's and NordPass's own pages (sources at the end).

Short answer: Black Friday is November 27, 2026 and Cyber Monday is November 30, and scammers plan for that week the same way stores do. The things that actually protect you are simple and mostly free: no reused passwords on shopping and email accounts, two-factor authentication on your email, paying with a credit card or wallet instead of a debit card, never clicking deal or delivery links (go to the store yourself), and not logging in on open Wi-Fi without protection. Work through the checklist below once and it covers you for the whole season.

1. Lock down your accounts before the sales start

Start with email, not shopping sites

Most "my account got hacked" stories begin with a reused password. A breach at one small site leaks an email and password pair, and criminals try that same pair on big retailers, payment apps and email providers. If they get into your email, they can reset everything else. So:

• Give your main email account a long, unique password you don't use anywhere else.
• Turn on 2FA. An authenticator app or a passkey is stronger than SMS codes, but SMS is still far better than nothing.

Then fix reused passwords on stores and payment accounts

You don't have to fix every account you've ever made. Prioritize the ones that have a saved card or can move money: big retailers, PayPal and other wallets, your bank, and any store where you have a stored payment method. Where a site offers passkeys, consider switching. A passkey can't be typed into a fake login page, which makes phishing much harder.

Use a password manager so this is actually doable

Nobody remembers 40 unique passwords. A password manager generates them, saves them and fills them in, and a good one will only autofill on the real site's address, which is a quiet extra defense against look-alike pages. Free options exist: Bitwarden's free plan is generous, and your browser's built-in manager is better than reusing passwords. If you want breach alerts and an easier experience across devices, NordPass is our pick for most people. Its free plan stores unlimited passwords (with one active session at a time), and Premium adds Password Health, which shows weak and reused passwords, and a Data Breach Scanner that checks whether your email or cards turn up in known leaks. Premium and Family come with a 30-day money-back guarantee. See our full NordPass review or best password managers 2026 for the alternatives.

2. Pay the safest way

How you pay decides how much trouble you're in if something goes wrong. Here's how the FTC describes federal protections for lost or stolen cards and unauthorized charges:

Many card issuers go further with their own zero-liability policies, so check your card agreement. The practical difference is that with a credit card, the disputed money is the bank's while it investigates. With a debit card, it's your checking account that's short, sometimes right before rent is due.

• Best: a credit card, a virtual card number from your issuer (many banks offer these in their app), or a wallet such as Apple Pay, Google Pay or PayPal that doesn't hand the store your real card number.
• Okay: a debit card at big retailers you already trust, with alerts turned on.
• Never for a deal: gift cards, wire transfers, payment apps sent to a stranger, or crypto. If a "store" or "seller" asks for one of these, it's a scam. Legitimate retailers don't take payment in gift cards.

Turn on real-time transaction alerts in your bank's app. A push notification for every charge is the fastest fraud detector you'll ever own, and it's free.

3. Treat every deal email and text as suspicious

Phishing peaks around Black Friday because people are expecting deal emails and delivery notices. The messages look real because they copy real store emails. Common ones:

• The "too good" deal: a well-known product at a price far below every other retailer, with a countdown timer.
• The delivery problem: "Your package couldn't be delivered, click to reschedule" or "pay a small redelivery fee." Carriers don't text you to collect fees through a link.
• The account alert: "Unusual sign-in on your account" or "your order was cancelled, confirm your payment details."
• The fake charge: a receipt for something you didn't buy with a phone number to "cancel." The person who answers will ask for remote access or card details.

The one habit that beats almost all of these: don't use the link or phone number in the message. Open the store's app, type its address yourself, or check your order history directly. If the deal or problem is real, you'll see it there. For tracking, paste the tracking number into the carrier's own site rather than clicking.

Also hover over (or long-press) links to see where they really go, and check the sender's actual address, not just the display name.

4. Check the store before you pay

Fake shops pop up every holiday season, often advertised through social media ads, and they disappear in January. Before buying from a store you don't know:

• Read the address bar carefully. Look-alike domains swap letters, add words ("-outlet", "-official", "-sale") or use unusual endings. The padlock icon only means the connection is encrypted. Scam sites have padlocks too.
• Look for real contact details: a physical address, a working phone number and a clear return and refund policy. Vague or copied policies are a red flag.
• Search the store's name plus "reviews" or "scam" and read what people say on independent sites, not just the testimonials on the store's own pages.
• Be suspicious of huge discounts on brands that rarely discount and sites that only take unusual payment methods.
• On marketplaces, check the seller's rating and history, and keep the payment and conversation inside the platform so its buyer protection applies.

If you click ads from social feeds, a scam-site blocker is a useful safety net. Your browser has basic protection built in (keep it turned on). NordVPN also includes what it now calls a next-gen antivirus, labeled "Scam, phishing, and malware protection" in the app, which warns about known scam sites, blocks malicious and phishing pages, flags dangerous links in email, and scans downloads. NordVPN says the full feature runs even without a VPN connection on supported devices. No blocker catches every brand-new fake shop, so treat it as backup, not a replacement for the checks above.

5. Public Wi-Fi: lower risk than it used to be, but not zero

Honest take: most shopping sites now use HTTPS, so someone on the same coffee-shop network can't simply read your card number as it travels. That's why we don't tell people a VPN is essential for shopping at home on their own password-protected Wi-Fi. (Our guide Do you actually need a VPN? goes into this.)

The real public Wi-Fi risks during holiday travel are:

• Fake hotspots with names like "Airport_Free_WiFi" set up to watch traffic or push you to fake login pages.
• Captive portals and pop-ups that ask for an email, a password or an app install.

What to do:

• For logging in, paying or banking while out, use mobile data or your phone's hotspot instead of open Wi-Fi when you can.
• If you need public or hotel Wi-Fi, connect through a reputable VPN first. It encrypts your traffic between your device and the VPN server, which takes the fake-hotspot and snooping risks off the table.
• Turn off auto-join for open networks, and "forget" networks you don't need.
• Never install an app or certificate just to get onto a Wi-Fi network.

If you travel over the holidays, NordVPN is the VPN we recommend for most people: it's fast, easy to use on phones and laptops, has been independently audited, and comes with a 30-day money-back guarantee. Its Black Friday pricing is usually the best of the year, but check the renewal price before you buy. Our NordVPN Black Friday explainer walks through that, and the NordVPN vs NordPass bundle guide covers which plans include a password manager.

6. Keep your devices boring and updated

• Update your phone, computer, browser and shopping apps before the big weekend.
• Install shopping apps only from the official app store, and check that the developer name matches the retailer.
• Prune browser extensions. "Coupon" and "price tracker" extensions can read the pages you visit. Keep only ones from developers you recognize, and remove anything you don't use.

7. After you buy: watch through January

Fraud often shows up weeks later, when returns, gift cards and delivery confusion make odd charges easy to miss.

• Review card statements line by line in December and January. Small "test" charges of a dollar or two often come before bigger fraud.
• Buy gift cards from the retailer directly or from behind the counter, check that packaging hasn't been tampered with, and keep the receipt.
• Be extra careful with "return" or "refund" emails. Process returns from the store's site or app, not from a link.

If something goes wrong: the first hour

1. Call your card issuer using the number on the back of your card or in its app. Report the charge or the exposed card and ask for a new number. The FTC also recommends following up in writing and keeping notes of your calls. Speed matters most for debit cards.
2. Change the password you typed into the fake page, everywhere you used it, starting with email. Turn on 2FA if it was off.
3. Sign out of other sessions on your email and big shopping accounts (most have a "sign out everywhere" option) and check for new forwarding rules or saved addresses you didn't add.
4. Report it at ReportFraud.ftc.gov. If someone opened accounts in your name, IdentityTheft.gov gives a step-by-step recovery plan.
5. Check your credit reports for accounts you don't recognize, and consider a free credit freeze with the three bureaus if your personal details were exposed.

Printable checklist

• ☐ Unique password + 2FA on my email
• ☐ No reused passwords on stores, wallets and bank
• ☐ Password manager set up (free or paid)
• ☐ One credit card or virtual card for online shopping, with alerts on
• ☐ Phone, computer, browser and apps updated
• ☐ Unused browser extensions removed
• ☐ I open deals from the store's app or address, never from a link
• ☐ I check unfamiliar stores for contact details, returns and reviews
• ☐ Mobile data or a VPN for logins and payments on public Wi-Fi
• ☐ Statements reviewed through January
• ☐ Card issuer's fraud number saved in my contacts

FAQ

Is it safe to shop online on public Wi-Fi?

Safer than it used to be, because most stores use HTTPS. The remaining risks are fake hotspots, look-alike login pages and out-of-date devices. Use mobile data or a reputable VPN for logins and payments when you're on public Wi-Fi.

How can I tell if a Black Friday deal email is a scam?

Watch for urgency, a sender domain that doesn't match the store, links that go somewhere else, requests to "confirm" payment details, and prices far below everyone else's. The safe habit is to skip the link and look for the deal in the store's app or site.

What should I do if I entered my card on a fake site?

Call your card issuer right away and ask for a new card number, change any password you typed, turn on 2FA, and report it at ReportFraud.ftc.gov. Use IdentityTheft.gov if your identity was misused.

Related: Do you actually need a VPN? · Best password managers 2026 · NordPass review 2026 · NordVPN review 2026 · Black Friday 2026 software deals · Black Friday 2026 deals page

Sources

FTC Consumer Advice, "Lost or Stolen Credit, ATM, and Debit Cards" (consumer.ftc.gov); CFPB, "Am I responsible for unauthorized charges if my credit cards are lost or stolen?" and "How do I get my money back after I discover an unauthorized transaction?" (consumerfinance.gov); NordVPN next-gen antivirus feature page (nordvpn.com/features/threat-protection); NordPass plan and help-center pages as cited in our NordPass review. All accessed November 2, 2026. This guide is general information, not legal or financial advice. Check your own card agreement for your issuer's terms.