Mozilla’s MDN documentation describes TLS as providing encryption, integrity and authentication for a connection. HTTPS uses it to protect web traffic in transit. A protected connection is a necessary buying check, but it does not establish whether the shop’s promises are true.

Before signing in or paying, inspect the full domain in the address bar. An encrypted connection to the wrong domain still reaches the wrong party. Open a known bookmark or navigate independently when an unexpected message asks you to verify an account.

If the browser shows a certificate or insecure-connection warning, stop before entering sensitive data. Check the address and use the organization’s known support route to resolve the problem. Do not assume that accepting a warning is a normal checkout step.

MDN also explains mixed content: an HTTPS page can try to load resources through unencrypted HTTP, which browsers may upgrade or block. Do not disable browser protections to make a checkout work. Keep the browser updated, and remember that transport protection does not protect data after a dishonest recipient receives it.