Shopping and paying

Clearance sale — everything must go!

https://www.mower-clearance-outlet.test/cordless-mower

Cordless lawn mower, 46 cm cut — only 3 left!

Offer ends in 09:58 minutes

★ Verified shop ★ 100% buyer protection ★

• Payment: bank transfer only (3% discount)

You're looking for a lawn mower and found this shop through an advert. Would you order here?

• ✓ No. The price is far too low, it's bank transfer only, and there's no company address. – Exactly. Three warning signs at once: a bargain price with time pressure, bank transfer instead of card, and no details about who's behind it.
• ✗ Order quickly before the time runs out. – The countdown is there to stop you checking. Money sent by bank transfer is usually gone.
• ✗ Order — the “Verified shop” badge shows it's all fine. – Anyone can paint a badge onto their page. A badge proves nothing — check the shop itself.

A trap: a fake shop. It lures you with a price far below the usual one, rushes you with a countdown, decorates itself with a home-made badge and only takes bank transfers. Pay by credit card where you can — never by bank transfer to a shop you don't know.

CraneBasket

https://www.cranebasket.example/filter-coffee-maker

Filter coffee maker, 1.2 litres — delivery in 2 to 3 working days

4.3 out of 5 stars from 812 reviews

• Payment: credit card, debit card or bank transfer

You've ordered from CraneBasket many times. You opened the site yourself. Would you order here?

• ✓ Yes — and pay by credit card. – Good. A shop you know, a usual price, full company details and a returns policy. A credit card gives you extra protection.
• ✗ No — it's better never to shop online. – Caution is good, but nothing here speaks against buying. Avoiding everything means missing the genuine — better to learn what to look for.

Genuine. A shop you know and opened yourself, a usual price, full company details, a returns policy and several ways to pay. Nothing here speaks against the order.

Pay by phone — just scan!

https://car-park-ticket-online.test/zone4

A sticker on the parking machine in a town-centre car park.

“Scan and get your parking ticket in seconds.”

Your phone shows this address. What do you do?

• ✓ Don't open it. Pay at the machine — or in the parking app you already use. – Exactly. Anyone can put a sticker on a machine. The address belongs to car-park-ticket-online.test — nothing says it's your council's.
• ✗ Open it and enter your card details — it's quick. – That's how your card details end up with scammers. Fake QR stickers on parking meters and charging points are a known trick.
• ✗ Open it, but just have a look. – Opening it already takes you to a stranger's page that will push you. If the address is unfamiliar, don't open it at all.

A trap: a fake QR code. It was stuck over the real notice and leads to a stranger's page. After scanning, read the address before you open anything — and when in doubt, pay the way you already know.

Buyer (classifieds site)

← Hi, is the floor lamp still available? I'll take it for £35, postage is fine.

→ Yes, it is.

← Great! I've already paid through the site's payment service. Please confirm receipt with your card here so the money is released: payment-release-now.test/release

You're selling a floor lamp on a classifieds site. What do you do?

• ✓ Don't open the link. Keep messages and payment on the site itself — or take cash on collection. – Exactly. To receive money, you never enter your card details. Real payment services don't ask the person being paid to “confirm” via a link.
• ✗ Open the link and enter your card details so the money arrives. – That's exactly how scammers steal card details. Someone sending you money doesn't need your card details.
• ✗ Post the lamp already — the money is on its way. – Only send something once the money is in your account. None is coming here — just a link.

A trap: a fake payment link. When you sell something, you never enter card details to get paid. Keep everything on the site — cash on collection is the safest.

Kestrelmoor Bank — Important notice about your online banking

https://kestrelmoorbank.example-security-update.test/activate

A letter in your post.

“By the 15th of this month you must activate our new security procedure. Otherwise your online banking access will be suspended. Simply scan the QR code.”

What do you do?

• ✓ Don't scan it. Open the Kestrelmoor app or the address you know yourself — or ask the bank on the number on your card. – Exactly. Letters can be faked too. Whether there's a new procedure, you'll see in the app or hear from the bank — through a route you choose yourself.
• ✗ Scan it — the letter came by post, after all. – Letters can be faked as well. The address belongs to example-security-update.test — not to Kestrelmoor Bank. The bank's name at the front is only a disguise.
• ✗ Scan it and enter your login details so access isn't suspended. – That's what the letter is made for: with a deadline and a threat, you're meant to enter your login details on a stranger's page.

A trap: a fake bank letter with a QR code. The deadline and the threat are the levers, and the address doesn't belong to the bank. Always open your online banking yourself — through the app or a bookmark.