Smart Home & Tech · Privacy and security

How to avoid account phishing after holiday online shopping

Check holiday charges on the store and bank sites you type yourself. Do not tap text links, read a sign-in code to a caller, or turn antivirus off.

After a holiday order, check the charge by typing the store and the bank yourself. A text, an email button, or a caller who wants a code is not that check. Use a password that is not reused, keep the extra sign-in on, and leave antivirus on. This page does not explain how to send a fake message. It is the habit that keeps you off one.

Step 1: Type the site you already know

1. Open the store from the address you have used before, or type the bank’s address from the card in your wallet. Do not use the link in a text.
2. Look at the order list you reach that way. A charge that is not on that list is a question for the bank’s own page, which you also type.
3. Close a page that arrived from a search ad offering to “recover” the order.

The manager that fills a login only on the real site is password manager setup. Registration on a maker’s site, typed by you, is warranty registration.

Step 2: Codes stay on your screen

A real extra sign-in code is something you type into the site you opened. Read it yourself. Do not read it to a caller. Do not type it into a text thread. A caller who says they are the bank, the store, or the shipper, and who needs the code, can hang on the line while you use the number printed on the card or the site you typed. Then you can decide. You do not give them the code first.

Tell the household the same rule before the next sale email lands. A grandparent who is helpful will still read a code aloud unless you have said not to. The guest network is unrelated, but the same people should not be handed your bank login: temporary Wi-Fi passwords.

Step 3: One password per store, already in the manager

If you reused a store password, change it from the site you typed, and store the new one in the manager. Do not paste it into a “strength checker.” Do not photograph the manager. Do not turn off antivirus, the firewall, or a work VPN because a popup said the order needs it: the Wi-Fi security checklist.

Check refund status in the order account or with the payment provider; processing times and display differ, so a missing immediate entry alone does not prove fraud. Do not install a helper. Do not forward a port. Do not change DNS. A file attached to “your invoice” is not an invoice until the order page you typed shows that file. Serial numbers you do write down stay off social posts: documenting serial numbers.

Step 4: The card, if something is wrong

If a charge on the page you typed is not yours, use the dispute or lock control on that same bank page. Do not call a number that arrived in a text. Do not email a photo of the card. The return window for a real order is still the date on the order page, not a date in an email you did not expect: return packaging.

When you are done, close the bank page. Leave the computer’s lock screen on when you walk away. A shared shop computer is a bad place to leave the bank logged in.

If you clicked or shared information

Close the suspicious page. If you entered a password, change it from the genuine site, change any reused passwords, and review account sessions and multifactor settings. If you entered card or bank details, contact the issuer through a known number immediately and ask about locking or replacing the card. If a file downloaded, update security software and scan the device. Report the message through your mail or phone app and to the FTC; use IdentityTheft.gov if personal information may be misused. Do not wait for a charge to appear.

What you should be able to point at

• Orders checked on a site you typed. Text links unused.
• Codes not read aloud and not typed into a text. Callers given nothing until you use a number you already had.
• Unique passwords in the manager. No checker site. Antivirus, firewall, and work VPN still on.
• No helper install, no port forward, no DNS change.
• A charge you do not recognize handled on the bank page you opened. No photo of the card.

Example: the text waited, the order page did not

A text says a holiday package needs a fee and includes a short link. They do not tap it. They type the store they ordered from. The order is there, marked shipped, with no fee. They type the bank. The charge matches the order total they remember. They stop. They do not call the number in the text. Later a caller asks for the sign-in code “to stop a fraud.” They do not read it. They hang up and look at the bank page they type themselves. Nothing new is there. The household hears the rule at dinner: codes stay on the phone that received them. Antivirus stays on. Nobody installs a refund app. The password for that store is already unique. If the bank page had shown a charge they did not make, they would have used the lock control on that page, not a link.

Related guides

• Password manager setup
• Wi-Fi security checklist
• Warranty registration
• Temporary Wi-Fi passwords
• Return packaging

Last updated: October 29, 2026

Last reviewed October 22, 2026. Suggest a correction

Information on this site is for general educational purposes and is not professional advice.

Parent topic: Smart Home & Tech