What HTTPS Does and Does Not Prove About an Online Shop

The shop has HTTPS and the browser shows a secure connection. That is useful: the connection can protect information in transit between your browser and the site. It does not establish that the seller is honest, that the trainers are genuine or that the parcel will arrive.

Before buying from an unfamiliar shop, answer two questions separately: am I communicating with the intended website through a protected connection, and do I have enough reason to trust this merchant? Passing the first check cannot stand in for the second.

The US Federal Trade Commission's shopping guidance states the distinction plainly: HTTPS means the site is encrypted, but scammers can encrypt their sites too.

What the connection indicator actually tells you

HTTPS protects the network conversation with the website identified by its address. In an ordinary browser connection without certificate warnings, it helps prevent other parties on the network from reading or changing that conversation in transit.

The Chrome security team's explanation of the padlock makes the boundary explicit: the indicator describes the connection, rather than the trustworthiness of a page. Chrome changed its main site-control icon to reduce that misunderstanding, so your browser may show settings controls instead of the familiar lock.

A protected connection to the wrong site remains a connection to the wrong site. If you intended to visit a known retailer, check the actual domain against a saved bookmark or an independently known address. A brand name in a page heading or somewhere earlier in a long address does not identify the operator.

For illustration, shop.example.test and example-shop.test are different hostnames. A certificate for one does not certify a relationship to the other. These fictional names demonstrate the distinction; they are not shopping destinations.

Do not bypass a certificate warning to finish a purchase. Correctly understanding HTTPS means retaining its useful protection while assessing the merchant separately.

Ask the seller questions a certificate cannot answer

A buying decision needs evidence about the transaction. Look for a clear business identity, meaningful contact information, a product description with precise condition and model details, shipping commitments, and understandable return terms.

Read the policies as commitments, rather than treating their existence as a badge. Who pays return postage? Is the return address in a different country? Are sale items excluded? Does the seller's name remain consistent across the shop, policy pages and checkout?

The FTC recommends checking delivery, return and refund policies and reading product descriptions carefully. Its guidance is written for US consumers, so do not transplant its legal deadlines or chargeback rights into every country. For your own rights, use local consumer-protection guidance and your payment provider's actual terms.

A plausible policy page can be copied. An identifiable merchant with a consistent trading history is stronger evidence than a polished template alone. Search for the business outside its own website, including credible complaints and information about whether people received what was advertised. A lack of complaints is not proof that a new shop is legitimate.

Use independent checks without collecting endless badges

Reviews can help if you consider their context. Look for relevant detail about the product, delivery and returns across sources, rather than treating an average star rating as a guarantee. The FTC warns that some reviews and ratings can be fake or misleading.

Be cautious when an unfamiliar shop is the only source offering a scarce product at a remarkable discount. A low price is a reason to compare the model and condition; it is not proof of fraud by itself. Check whether “new”, “refurbished”, “digital licence” and “compatible with” mean the same thing across the offers you are comparing.

Badges deserve the same treatment. A picture claiming “verified seller”, “secure checkout” or “money-back guarantee” is content supplied by the page. If a protection matters to your decision, find its actual terms through the organisation that provides it. Do not assume a copied payment logo means a payment method will be available at checkout.

A worked decision: encrypted shop, unresolved merchant

Suppose an unfamiliar retailer advertises a graphics card well below the prices you found elsewhere. Its HTTPS connection works. Its return policy gives no usable return address, the company name changes between pages, and the checkout accepts only a bank transfer. This is an illustrative comparison, not a report about a particular business.

The connection check passed, but the transaction check still has unresolved problems. Looking deeper into the certificate cannot tell you whether the merchant will deliver. The sensible next step is to ask for clear business and payment information or choose another seller.

Conversely, a small retailer with an ordinary-looking website can have clear terms, a verifiable business and a suitable payment route. Visual sophistication is not the missing third certificate. Judge the evidence relevant to the purchase.

Keep payment protection in the decision

Use a payment method whose dispute process you understand and whose terms cover the type of purchase. Credit cards can provide useful dispute rights, but availability, deadlines and coverage depend on the jurisdiction and provider. “Buyer protection” can have exclusions and reporting windows.

The FTC warns against sellers insisting on payment through gift cards, wire transfers, cryptocurrency or similar hard-to-recover methods. If the only payment route removes protections you expected, stop before sending money. A secure connection cannot reverse an authorised transfer to a dishonest seller.

Keep the order confirmation, item description, price, seller identity, return terms and promised dispatch date. If a problem arises, contact the seller and payment provider through their official channels promptly. Do not pay a second “release fee” simply because an unexpected message uses your order number.

HTTPS remains part of a sensible purchase. Read it as “this connection has protection”, then complete the merchant and transaction checks that determine whether you want to buy.