The Security Mentor

Do you want the short answer, or the long answer?

The short answer is yes. You can always refuse to pay a fraudulent charge. There are laws about this. A debit card may not give you the same protection. I don't use my debit card for web purchases.

The long answer is (ready for this?) "it depends". Your credit card information can indeed get stolen. The two most common ways to steal credit card information online are to break into a store's database, or to trick you into typing your credit card information someplace untrustworthy. You can do something about the second risk. Use what you already know -- only give out your card number if you started the transaction. That's the same rule you follow over the phone. So you'd type in the card number after you order something from amazon.com, but you wouldn't if you get email that asks for it.

Oh, and make sure it's really amazon.com you're talking to. Sleazy people regularly get domains that are misspellings of high-traffic sites. Usually the reason is to collect money from advertisers. Someday one of them might start to steal credit card numbers.

I didn't mention looking for the padlock icon at the bottom right. If you see that, then some really sophisticated technology is trying to keep your credit card number unreadable and ensure that you're really talking to the site you think you are. Unfortunately that technology only works if a bunch of people you've never heard of did their jobs right. There's no substitute for street smarts.