unencrypted credit card transaction

[geranium]

A friend has just rung me in a bit of a state to say she has just made a big order of toys for her kids and thinks she has done so via an unencrypted link. It was all a bit convoluted but as I understand it, she went into the website via another link and the padlock sign never appeared while she was paying. After finishing, she then got worried and went into the toy site direct. Apparently the padlock sign appeared immediately when she went in that way.

I'm not sure whether she really has made an unencrpyted credit card transaction since by now she can't quite remember what she did but, just in case she has, can you give me any advice to pass on. Is she in danger of fraud? Does she need to warn the toysite? her credit card company? or does she just keep her fingers crossed and study credit card bills very closely in future?

Thanks for any tips.

if there was no padlock sign then it may have been unencrypted, or it may be that something about the link produced a "mixed" page - for example by adding an unencrypted logo to the top (that would mean no padlock, but the data would be secure).

But even if it was unencryted, that does not mean that anyone necessarily managed to intercept them. she does just need to check her bills carefully (but then she should do that anyway) and contact her bank if she sees a transaction she doesn't recognise.

I would also email the toy website so they can add a redirect to the secure pages.

Just to clarify, email the toy website so they can redirect her order to a secure page or so they can make the link lead to a secure page?

Can she remember where the original link was?

Just spoken to her. She thinks she could find it. Sounds like it was an email from a friend with the link and she just went from being in the email to the website via the email link.

email the toy company so they can redirect ALL customers who happen to get to insecure order pages to redirect them to secure pages (this is what most sites do)

PS I suggested she speak to her credit company earlier. She said she has just done so. They don't sound particularly bothered ie they just said to wait and see if there were any fraudulent transactions and if there were to contact them. Unfortunately, she didn't get a name of who she spoke to and they didn't think it worth making a note against her account so if there are problems there won't be a record of her calling to warn the company in advance.

Ok IF there were any transactions they will be fraudulant and you arnt liable for fraudulent transactions on your accoint, so i woudnt worry too much!