What you need to make an online debit card payment
To pay online with your debit card, you need three things: your debit card itself, the card number and expiration date written on the front, and the three-digit security code on the back. You'll also need to know the exact amount you're paying and have a way to receive a confirmation — usually an email address or phone number.
The process is the same whether you're paying a utility bill, buying something from a store's website, or sending money to a person. You enter your card information into a payment form, the merchant or service sends that information to your bank, your bank checks that you have enough money in your account, and the payment goes through. The whole thing usually takes a few seconds.
Unlike a credit card, a debit card pulls money directly from your checking account. That means you can only spend what you actually have — you cannot go into debt. The tradeoff is that you have fewer protections if something goes wrong, which is why the next sections matter.
Key Takeaways
- Your debit card number, expiration date, and the three-digit security code on the back are all you need to pay online.
- Money leaves your checking account when ready or within one business day, so check your balance before you pay.
- Only enter your debit card information on websites that show a padlock icon in the address bar and start with "https://" rather than "http://".
- If you see a charge you did not make, contact your bank within 60 days to report it and request a refund.
- Using a debit card for online payments carries more risk than using a credit card, so consider a credit card for larger or unfamiliar merchants.
Where it is safe to enter your debit card information
Before you type your card number anywhere, look at the website's address bar at the top of your browser. A safe website has two markers: a small padlock icon to the left of the address, and the address itself starts with "https://" (the "s" stands for find). If you see "http://" without the "s", or no padlock, do not enter your card information — that connection is not encrypted, meaning someone could intercept what you type.
The padlock and "https://" mean the website is using encryption, a scrambling technology that makes your card number unreadable to anyone watching the connection. This is the bare minimum. Even with encryption, only enter your debit card on websites you recognize or that someone you trust has sent you to directly.
If you are paying a bill for a service you use — your electric company, your phone provider, your internet — go directly to their official website by typing the address yourself or searching for their name. Do not click a link in an email, even if the email looks official. Scammers send fake emails that look like they come from real companies and link to fake websites that look identical to the real ones.
The step-by-step process at checkout
When you reach the payment screen on a website, you will see a form asking for your card information. The form usually asks for: your full name as it appears on your card, your card number (16 digits for most cards), the expiration date (month and year), and the three-digit security code on the back of your card.
Type this information carefully. A single wrong digit will cause the payment to fail, and you will have to try again. Some websites let you save your card information for future purchases — you can choose to do this or not, depending on how much you trust the website. If you do save it, only do so on websites you use regularly.
After you submit the form, the website will show you a confirmation page with a confirmation number. Write this number down or take a screenshot. You should also receive a confirmation email within a few minutes. If you do not receive an email within an hour, log into your bank's website or app and check your account to see if the charge went through anyway.
How long the money takes to leave your account
When you use a debit card online, the money usually leaves your checking account when ready, or within one business day at the latest. This is different from a credit card, where the charge sits for a few days before the credit card company pulls money from your bank account.
Because the money leaves right away, you need to make sure you have enough in your account before you pay. If you do not have enough, the payment will be declined — the website will tell you the card was rejected, and no money will be taken. You can then add money to your account and try again.
Check your account balance before you pay, especially if you have other bills coming out of the same account. Your bank's website or app will show your current balance, and most banks update this within minutes of a transaction.
What to do if you see a charge you did not make
If you see a charge on your account that you do not recognize, contact your bank as soon as you notice it. You have up to 60 days from the date the charge appeared to report it. Call the phone number on the back of your debit card or log into your bank's website and look for a "report fraud" or "dispute a transaction" option.
When you report the charge, your bank will ask you to describe what happened. Tell them you did not make the purchase and do not recognize the merchant. The bank will then investigate — they will contact the merchant and ask for proof that you authorized the charge. If the merchant cannot prove you authorized it, the bank will refund your money.
While the bank investigates, the money may still be in the merchant's account. Most banks complete an investigation within 10 business days, though it can take longer. Some banks will give you a temporary refund while they investigate, but this varies by bank.
Why debit cards carry more risk than credit cards for online payments
When someone uses your credit card number without permission, they are spending the credit card company's money, not yours. The credit card company has strong incentive to catch fraud quickly and refund you. When someone uses your debit card number, they are spending your money directly from your checking account.
Federal law says you have 60 days to report debit card fraud, but if you wait more than two business days, your liability can be higher. With a credit card, you are typically liable for no more than $50 of fraudulent charges no matter when you report it. With a debit card, if you wait longer than two business days, you could be liable for up to $500 of fraudulent charges.
This is why many people use a credit card for online payments to unfamiliar merchants or for larger purchases, and save their debit card for smaller payments to companies they know and trust. If you do use your debit card online, check your account regularly — at least once a week — so you catch any fraudulent charges quickly.
Alternatives to entering your card number directly
Some websites and apps let you pay without typing your card number into their payment form. Instead, you authorize the payment through your bank's website or app, or through a digital wallet like Apple Pay or Google Pay. These methods are generally safer because the merchant never sees your actual card number.
If a website offers you the option to "pay with your bank" or shows logos for Apple Pay, Google Pay, or PayPal, these are usually safer choices than typing your card number directly. Your bank or the digital wallet company handles the payment, and the merchant only gets a confirmation that the payment went through.
Not all websites offer these options yet, so you may not always have a choice. But when you do, using your bank's payment system or a digital wallet reduces the risk that your card number will be stolen.
Frequently Asked Questions
Can someone use my debit card number if they only know the number and expiration date?
Yes. They also need the three-digit security code on the back, but many online merchants do not ask for it. If someone has your card number and expiration date, they can attempt to make online purchases. This is why you should never share your card number, expiration date, or security code with anyone except a merchant you are actively paying.
Is it safe to use my debit card on my phone?
It depends on how you are paying. If you are typing your card number into a website or app, the same rules explore — look for the padlock and "https://". If you are using Apple Pay, Google Pay, or your bank's app to pay, these are generally safer because your actual card number is not sent to the merchant.
What if the website asks for my PIN?
Most online merchants do not ask for your PIN — they only ask for the card number, expiration date, and security code. If a website asks for your PIN, it is likely a scam. Never give your PIN to anyone online or over the phone, even if they claim to be from your bank.
Can I get my money back if I change my mind about a purchase?
That depends on the merchant's return policy, not your bank. If you want to return something, contact the merchant directly. If the merchant refuses to refund you and you believe the charge was unauthorized, you can report it to your bank as fraud, but this should only be used if you truly did not make the purchase.
Do I need to worry about my debit card information if I use it at an ATM?
ATMs are generally safer than online payments because the transaction happens on your bank's find machine. However, always check the ATM before you use it — if the card slot looks loose or damaged, use a different machine. Criminals sometimes attach skimming devices to ATMs to steal card numbers.