How to Pay for Holiday Shopping: Which Methods Protect You
Credit card, debit, Apple Pay, Zelle or a gift card? What federal rules and the payment companies say about getting your money back if a seller is fake.
The payment method you pick before Black Friday decides what happens if a seller turns out to be fake. Some methods come with federal dispute rights. Others work like handing over cash. Choose once, now, and you will not have to think about it at checkout.
Shopping scams are a volume business. In an April 2026 data spotlight, the Federal Trade Commission said shopping scams were the most reported scam on social media in 2025, and that more than 40% of people who lost money to a scam on social media said it started when they ordered something they saw in an ad. You cannot inspect every store. You can make sure the money is recoverable when one of them disappoints you.
The comparison
| Method | What the rules or provider say | Use it for |
|---|---|---|
| Credit card | Unauthorized charges on a lost or stolen card: at most $50. If only the number was stolen, generally no liability. Billing errors: written notice within 60 days (CFPB) | Online stores, especially new or unfamiliar ones |
| Debit card | Report a lost or stolen card within two business days: up to $50. Later: up to $500. Statement errors: report within 60 days or risk the full amount after that (CFPB) | Stores you already trust; the money leaves your checking account immediately |
| Phone wallet (Apple Pay, Google Pay) | The merchant gets a device or virtual number, not your real card number. Dispute rights come from the card behind it | Checkout on sites and apps that accept it |
| Payment apps (Zelle, Venmo, Cash App) | FTC: scammers like them because “it’s hard for you to get your money back.” Zelle: “Only Send Money to Those You Trust” | Friends and family |
| Gift card, wire, crypto | FTC: “wiring money is like sending cash”; crypto lacks the legal protections of cards; a seller insisting on these is “probably a scam” | Gifts and people you know, never a store’s demand |
Credit cards: the strongest default
The Consumer Financial Protection Bureau’s page on lost or stolen credit cards says “the most you will owe for unauthorized charges on the card is $50,” and that if only the number is stolen, “you generally have no liability for unauthorized use.” Its dispute guide says to send “a written billing error notice to the card company within 60 calendar days after the charge appeared on your statement.” The company then has 30 days to confirm it received your dispute.
The FTC’s online shopping page says paying by credit card “best protects you and your money,” and its November 2025 holiday alert repeats the advice so you can dispute charges.
Debit cards: protected, but on a clock
Debit cards are covered by the Electronic Fund Transfer Act. The CFPB’s page on getting money back after an unauthorized transaction sets out the timing.
Within two business days
Report a lost or stolen card and your liability is the lower of $50 or the amount taken.
After two business days
You could be responsible for up to $500 in unauthorized transactions.
After 60 days
If an unauthorized transfer shows on a statement and you don’t report it within 60 days, you could have to pay the full amount of transactions after that period.
The practical difference is that a debit fraud empties your checking account while it is sorted out, which can matter in December when rent and bills are due. That is a reason to keep debit for familiar stores and to turn on transaction alerts so a bad charge shows up within minutes.
Phone wallets: a card with the number hidden
Apple’s Apple Pay security overview says “Apple doesn’t store the original card numbers” you add, and that “neither Apple nor your device sends your actual payment card number” to an app. The merchant gets a Device Account Number and a transaction-specific security code instead. Google’s Google Pay page describes its virtual card as “a randomly generated number that replaces your actual card number,” shared with the merchant “to help keep your actual card information safe.”
That does not make a fake store real. It means a store that leaks or sells your details has less to leak. Your dispute rights still come from the card behind the wallet: credit card rules for a credit card, debit rules for a debit card.
Some banks also offer virtual card numbers for online shopping. Google’s page on virtual cards in Chrome and Android notes that only select banks support them, and that turning one off in Google Pay may not deactivate it with your issuer.
Payment apps: for people, not stores
The FTC’s page on mobile payment apps explains why scammers like them: “it’s hard for you to get your money back.” Zelle’s own safety page is headed “Only Send Money to Those You Trust” and describes the service as being for friends, family, co-workers and others you trust. It also notes that the protections available can differ between unauthorized fraud and a payment you were tricked into making.
A store or a stranger’s listing that will only take Zelle, Venmo or Cash App is shifting all the risk to you. Our rules for selling online cover the reverse case, when a buyer wants to pay you that way.
Gift cards, wires and crypto: never at a seller’s request
The FTC’s holiday shopping alert says that if a seller insists on a gift card, wire transfer, payment app or cryptocurrency, “it’s probably a scam.” Its guide on what to do if you were scammed notes that “cryptocurrency payments don’t have the same legal protections as credit and debit cards do.” Gift cards are fine as presents; our guide to buying gift cards that resist tampering covers that side.
A five-minute setup before Black Friday
- Pick one credit card for all online shopping this season. One card means one statement to watch.
- Add it to your phone wallet, if you use one, so more checkouts never see the real number.
- Turn on a text or app alert for every charge on that card.
- Save receipts and order confirmations in one email folder until the return windows close.
- Write your issuer’s phone number from the back of the card into your contacts, so you do not search for it under stress.
Quick answers
Is a debit card ever better? It avoids interest if you would otherwise carry a balance. For unfamiliar online stores, the credit card’s protections and the separation from your checking account usually matter more.
Does buy now, pay later count as credit? Protections vary by provider and by how you fund the plan. We did not review them for this article, so read the provider’s dispute terms before relying on them.
What if I already paid a fake store with a payment app? The FTC’s advice is to contact the app or your bank, ask them to reverse the payment, and report it at ReportFraud.ftc.gov. Do it the same day.
Sources
- CFPB: Unauthorized charges on lost or stolen credit cards
- CFPB: How do I dispute a charge on my credit card bill?
- CFPB: Getting money back after an unauthorized transaction
- FTC: Online shopping
- FTC: Mobile payment apps
- FTC: What to do if you were scammed
- FTC Data Spotlight, April 2026
- Apple: Apple Pay security and privacy overview
- Google Pay Help: Keep your payment info safe
- Zelle: Safety education