Yes, websites can steal your information, and the methods range from invisible code running behind an otherwise legitimate checkout page to convincing fake sites built to capture your passwords. The FBI’s Internet Crime Complaint Center logged more than 193,000 phishing and spoofing complaints in 2024, and that number only counts people who reported it.1FBI Internet Crime Complaint Center. 2024 IC3 Annual Report Understanding how the theft works, what data is at stake, and what protections you have is the most practical defense.
How the Theft Happens
Phishing and Spoofed Sites
Phishing is the most common method. An attacker builds a page that looks like your bank, your email provider, or a familiar retailer, then drives you there through a fake email, a text message, or a paid search ad. When you type your login or payment details, the data goes to the attacker instead of the real company. These pages have grown convincing. Many display the padlock icon and use HTTPS, which fools people into assuming the site is safe. A padlock only means the connection between your browser and the server is encrypted. It says nothing about who is running the server.
Formjacking on Real Sites
Formjacking is more unsettling because the site you visit is genuine. Attackers inject malicious code into the payment page of a legitimate online store, and that script captures your card number, name, and billing address as you type, before the data reaches the retailer’s own servers. The scripts are invisible to shoppers. One documented wave compromised thousands of stores at once by planting card-skimming code inside a shared e-commerce platform, so every shop on it was quietly harvesting payment data. Prosecutors treat this conduct as wire fraud under federal law, which carries up to 20 years in prison.2Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
Drive-By Downloads
A drive-by download installs software on your device just because you loaded a compromised page. You don’t click anything or give permission. The page exploits a flaw in your browser or an outdated plugin to push code onto the machine, and that code then logs keystrokes, captures screenshots, or uploads files to a remote server. Distributing this kind of code is a federal crime under the Computer Fraud and Abuse Act.3Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
Malicious Redirects
Some attacks hijack your browser mid-session and silently bounce you from a real site to one the attacker controls. The redirect can happen so quickly you may not notice the URL change. Once you land on the fake page it can grab session cookies, capture login tokens, or trigger further exploits. Public Wi-Fi makes this easier, since an attacker who controls the network can intercept and reroute traffic on the fly.
What Gets Taken
Personal Identifiers
Names, dates of birth, Social Security numbers, and home addresses are the top targets because they unlock everything else. With these details a criminal can open credit accounts in your name, file a fraudulent tax return, or sell a complete identity package. Using another person’s identifiers to commit fraud is punishable by up to 15 years in prison under federal law.4Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information
Financial Credentials
Card numbers, CVV codes, and bank logins convert directly to cash. Stolen card numbers get tested with small charges before being used for larger fraud or resold in bulk. Federal law limits how much you can lose in most cases, but the disruption of canceling cards, disputing charges, and waiting for replacements is real.
Session Tokens and Behavioral Data
Not every attack goes after your password. A stolen session token, the small piece of data your browser exchanges with a site to keep you logged in, lets an attacker act as you without ever knowing your credentials. They can access your email, social accounts, or banking portal for as long as that session stays alive. Attackers also gather browsing history, search patterns, and device fingerprints, which get combined and sold to build profiles used for targeted scams.
Red Flags on a Suspicious Site
Lookalike Domain Names
Fraudsters register domains with subtle misspellings of well-known brands, like “arnazon.com” or “paypa1.com” with a numeral swapped for a letter. The visual layout is often a near-perfect copy of the real site. The tactic, called typosquatting, relies on you not looking closely at the URL. Federal law targets it directly: registering a domain confusingly similar to a trademark with bad-faith intent to profit can lead to statutory damages between $1,000 and $100,000 per domain.5Office of the Law Revision Counsel. 15 USC 1117 – Recovery for Violation of Rights
Certificate Warnings and Missing HTTPS
Take browser certificate warnings seriously. A full-screen alert saying the site’s identity can’t be verified means something is wrong. An expired certificate, one issued to a different company, or a page asking for personal information without HTTPS at all are all reasons to close the tab. The reverse doesn’t hold, though. HTTPS alone does not mean a site is safe. Criminals can get basic SSL certificates for free in minutes.
Aggressive Pop-Ups and Fake Alerts
Pop-ups that mimic system warnings or antivirus notifications, claiming your device is infected and demanding you click right now, are almost always scams. Real antivirus software does not deliver warnings through your browser. Clicking these fake alerts can run scripts that scrape stored passwords or install tracking software. Close the tab entirely rather than clicking any button inside the pop-up, including anything labeled “Cancel” or “Close.”
When the Real Site Isn’t the Problem
Sometimes the site you’re visiting isn’t the thief. A third-party script running in the background is. Advertising networks inject code into thousands of sites at once, so a compromise at the network level pushes malicious code onto every site that displays those ads. Social media widgets and unverified browser plugins create similar risks by sending data to outside servers with no visible sign to you. The FTC has authority to take action against companies whose deceptive or unfair practices enable this kind of collection.6Federal Trade Commission. A Brief Overview of the Federal Trade Commissions Investigative, Law Enforcement, and Rulemaking Authority Sticking to established, well-known sites reduces your exposure, since smaller sites are less likely to have the defenses that block unauthorized scripts.
Your Financial Protections If Someone Uses Your Data
If a thief uses your stolen information to make purchases or drain your accounts, federal law caps how much you can lose. The protections differ sharply between credit and debit cards.
For credit cards, your maximum liability for unauthorized charges is $50, and you owe nothing at all if you report the card stolen before any fraudulent charges appear.7Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Most major issuers waive that $50 as a matter of policy.
Debit cards give you weaker protection, and timing decides your exposure. Under Regulation E, which implements the Electronic Fund Transfer Act:
- Within 2 business days of discovering the theft, your liability caps at $50.
- Between 2 and 60 days, your liability can rise to $500.
- After 60 days from your statement date, you could be liable for the full amount of unauthorized transfers that occur after that 60-day window.8eCFR. Part 1005 Electronic Fund Transfers (Regulation E)
The practical takeaway: use credit cards rather than debit cards for online purchases when you can. If a debit card is compromised, report it the same day.
What to Do If Your Information Has Already Been Stolen
Speed matters. Each hour of delay widens the damage.
Change the compromised password immediately, and change it anywhere you reused it. Password reuse is how one breach becomes six.
File a report at IdentityTheft.gov. The FTC-run site generates an official Identity Theft Report and builds a personalized recovery plan based on what was stolen, walking you through disputing accounts, contacting creditors, and placing fraud alerts.9Federal Trade Commission. IdentityTheft.gov – Report Identity Theft and Get a Recovery Plan
Freeze your credit with all three major bureaus: Equifax, Experian, and TransUnion. Requests made online or by phone must be honored within one business day, and a freeze blocks anyone from opening new credit accounts in your name until you lift it. You can unfreeze temporarily when you need to apply for credit yourself.10USAGov. How to Place or Lift a Security Freeze on Your Credit Report
If your Social Security number was exposed, enroll in the IRS Identity Protection PIN program to prevent someone from filing a fraudulent tax return in your name. Anyone with an SSN or ITIN can enroll through their IRS Online Account. If you can’t verify your identity online and your adjusted gross income is below $84,000, or $168,000 for joint filers, you can apply using Form 15227.11Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number (IP PIN)
Call your bank and card issuers to report unauthorized transactions and request new numbers. For debit cards, doing this within two business days keeps your maximum liability at $50.8eCFR. Part 1005 Electronic Fund Transfers (Regulation E)
How to Lower the Risk Going Forward
Turn on multi-factor authentication wherever it’s offered. A stolen password alone can’t get into an account that requires a second verification step. Hardware security keys and authenticator apps are stronger than SMS codes, which can be intercepted through SIM-swapping attacks. For your most sensitive accounts, a hardware key is worth the small cost.
Use a password manager. Beyond generating unique passwords for every site, modern managers flag credentials that appear in known breaches and warn you when you’ve reused passwords. That monitoring catches compromises you would not otherwise notice.
Keep your browser and operating system updated. Drive-by downloads rely on known vulnerabilities in outdated software, and automatic updates close those gaps before attackers reach them. This is the lowest-effort, highest-impact habit on the list.
Check the full URL before entering anything sensitive. Look at the whole domain in the address bar, not just the padlock. Bookmark the login pages for your bank and other important accounts rather than following links from emails. When in doubt, open a new tab and type the address yourself.
Trim your browser extensions. Every extension has some access to your browsing data. Stick to well-known extensions with large user bases, and remove any you no longer use. Fewer extensions means a smaller attack surface.