Snag AcademyBefore you type anything
The page looks fine. The shop may well be genuine. The risk is in neither of those places, which is what makes this one hard to see.
A small shop's site, decent prices, a checkout form asking for a card number. Nothing looks broken because nothing is broken.
The address begins http:// rather than https://, and there is no padlock in the address bar.
The risk is in the road, not at either end
This is the bit worth slowing down on. The shop might be completely honest. Your computer might be completely clean. Both of those can be true and the problem is still there.
HTTPS encrypts the data for the whole journey between your device and the shop's server. Without it, everything you type crosses the network as plain, readable text.
On a café or airport wi-fi, anyone else on that network can read it as it goes past. This does not require skill or special equipment. It is just reading what is being broadcast in the open.
Why the usual defences do not apply
A stronger password does not help, because the password itself is what is travelling in the clear. Antivirus does not help either, because nothing is infecting your machine.
Notice the shape of that reasoning: the fault is not at either endpoint, it is in the channel between them. Defences placed at the endpoints cannot reach it. Work out where in the path the exposure happens before choosing a defence.
The practical rule
If a page is asking for money or a password and there is no padlock, do not type. Browsers now mark plain http:// pages as "Not secure" precisely because a missing letter is too easy to miss.
The padlock is not a guarantee that the shop is honest. It only means the road is private. Those are two separate questions, and this is the one you can check in a second.
The answer
Show the answer
In the puzzle, what is missing is: HTTPS, an encrypted connection, before anything is typed.
The wrong answers are all real security measures: more reviews, antivirus, a stronger password. Each protects something. None protects the thing at risk here.
Talking about it afterwards
- "Where exactly does the card number go after you press submit?"
- "Which of these defences is standing in the right place?"
- "Does a padlock mean the shop is honest? What does it actually promise?"
Two separate questions, worth keeping separate: is this road private, and is this shop trustworthy? The padlock answers only the first.
Your child can work this one out for themselves in the app, with the picture running and the wrong answer playing out. It is free, and there is no sign-up. Open this case →
Cases like this one
- The turn nobody saw coming — the part is missing
- Why strong swimmers still drown — the part is missing
- Why plain water is not enough — the part is missing