How do I know if I'm shopping on a safe website?

Online shopping is convenient and can save you money, but it's not quite the same as shopping in the high street. At its best, you can purchase items from trusted, well-established retailers - although, of course, you can't actually inspect the goods. But at its worst, shopping on the web can be more like using your credit card at a car boot sale to buy goods in unmarked sealed cardboard boxes.

Anyone can create a web page, so there's no immediate way for a shopper to tell whether an online shop is genuine at first sight. So there's more to being safe than just ensuring your card transaction is encrypted.

Firstly, ask yourself whether the offer is realistic. If it sounds too good to be true, it probably is. Quite a lot of stolen and sub-standard goods get offered at seemingly huge discounts by small traders on auction and free advertisement sites. Online 'sales' of non-existent event tickets are notorious. But even mainstream dealers frequently limit your ability to check what you're buying - photos of goods with captions like "the item supplied may not be identical to that illustrated" are all too common.

It's a sad fact that many perfectly honest online business owners simply don't understand their legal obligations. But that makes it difficult to distinguish between them and less legitimate traders. You should probably err on the side of caution.

Can you identify the seller from information on the site? The law requires every commercial website to include specific contact details - at least a trading name, a street address or Post Office box number and a phone number or email address, and these must be clearly visible.

A phone number is a bit safer than an email address alone, but beware of sites that only give a mobile number. Consumer sales sites must (by law) also publish some obligatory terms and conditions - particularly about cancellations, returns and refunds. Check them out and make sure they're valid. Check the carriage charges too. If you can't see what they will be until the final stage of the checkout, the seller is not playing by the rules - they should be clearly set out in the terms and conditions.

If the trader has their own website, you can also use a 'WHOIS' service on the web to look up the registration details of the web address - the 'domain name' - of the site. Then check they match the details given on the site. The registration will also show how long the domain name has been registered - sites with registrations only a few days old or ones that are incomplete should be avoided. If the site only gives a PO Box number, you can get the street address (but not the name) of the holder by calling the Royal Mail helpline.

On the web, you get none of the subtle signals - body language, verbal cues - that could tell you at a car boot sale when a trader is not to be trusted. So, provided the statutory details are present on the site and seem in order, it's worth phoning the trader to find out if they sound business-like. It's also worth doing a web search for customer comments in blogs or online communities.

If you're buying via an auction site (such as eBay), it should publish seller ratings and history. These are well worth checking, although there is a recognised scam - sometimes a seller will set up and trade honestly in a small way for some time to gain a good reputation, then will put up a spectacular offer, that turns out to be fraudulent, and disappear. So it's worth doing a web search for the seller as well, in case they also have their own website or there are customer comments.

Once you're reasonably satisfied that the trader is genuine, you should look at the ordering system. If it takes you to a different site - particularly for making the payment - you should perform the same background checks again.

Then, if everything still checks out, make sure the web address of every page on the ordering site starts with ‘https://’. This is most important on the page where you type in your card details. The final ‘s’ before the colon is crucial as it means the data you send and receive on that page is encrypted in transit. A padlock or key symbol at the bottom of the browser window also indicates you're on an encrypted connection - but this is not a perfect guarantee, as the symbol can be faked using JavaScript on a page that doesn't use encryption.

But the encryption, although necessary, is actually less important than knowing you're communicating with the right website. The ‘https://’ confirms this by sending your web browser an encrypted electronic 'certificate'. If everything is in order, it happens invisibly. But sometimes a warning will pop up. The most common one says the site you're on isn't the site that owns the certificate. This should make you very suspicious. It's a common fault on badly-designed legitimate sites, but it can also indicate a malicious program that might steal your money or card details.

Finally, if a site asks for your card details when you respond to a 'free offer', it's certainly fraudulent. No free offer involves prior payment, and no legitimate trader is permitted to hold your full card details except while they are currently processing a specific purchase.