Shopping online can be just as dangerous to your security as leaving your car unlocked in the mall parking lot.

Consumer Reports notes the following:

Don’t judge a website by its cover. A malicious website can look legitimate, even though it aims to nab your personal data, even identity, or sell counterfeit products.

Others aim to lure you in “with low prices they honor only if you buy extra items, or quietly adding unexpected charges based on fine-print disclosures they know you won't read.”

• Look up any unfamiliar online store on bbb.org (Better Business Bureau). Check the rating, any adverse reviews and confirm its address. Search it out with keywords like “complaints.”
• Carefully read the seller’s fine print.
• Don’t use a debit card; use a credit card, so that the dispute process is easier.

Defective products. Read the fine print; it may say that all goods “are sold as is.” This means you won’t have the right to receive a replacement for bad merchandise.

You may be able to get a refund within 30 days of purchase, but beyond that, many sites say you must deal directly with the product’s manufacturer (you’ll need to pay for return shipping). Another problem is when the website is not an authorized dealer for the product you bought.

• Make sure the site is an authorized dealer. Contact the manufacturer if necessary. Read the terms and conditions.
• Be suspicious of sites that you know or believe will send you tons of spam after your purchase.
• Understand the site’s privacy policy before giving personal data. “Many retailers let you elect to receive offers or have your info shared.” Others will automatically spam you or share your information unless you uncheck the pre-checked option boxes. “And limit the info you provide to what's critical for completing the purchase.”

Infected computer, or your payments are disrupted.

• Never give out credit card information unless the Internet connection is secured.
• Don’t peruse the Web unless the computer (or smartphone) is protected.
• Make sure the retailer’s URL begins with a “https” (the “s” is necessary) preceded by a padlock icon.