Online shopping is set to soar again this year, but how safe is that Internet mall? Just like the off-line world, it all depends on where you go.

With scammers ever more eager to separate consumers from their money, there is some justification for being fearful of making purchases online. But shopping well-known Web sites and researching less-well-known companies before making purchases will keep you as safe online as you can expect to be offline, experts said.

"Security is definitely a concern," said Sucharita Mulpuru, a senior analyst with Forrester Research. "It always is and always will be, but it's getting better and in fact probably it's more secure, in general, to buy online than it is in a lot of other ways," she said.

When "you go to a restaurant, you give somebody your credit card," she said. "That's arguably less secure than most of the transactions that happen online."

Still, 28% of Internet users have never shopped online, and of that group, 62% say they don't shop online because they're fearful about giving personal information over the Internet, according to Forrester Research.

And 86% of Internet users said they've changed their online behavior because they're worried about identity theft, and of those, 25% say they've stopped buying goods online, according to a survey of 1,500 adult Internet users in 2005 for Consumer Reports WebWatch, by Princeton Survey Research Associates International.

Yet those who refuse to shop online are a relatively small segment of the Internet population, and the bulk of Internet users plan to increase the amount they spend this holiday season, pushing online sales an estimated 18% higher than last year -- to about $32 billion in sales in November and December, according to JupiterResearch.

"We expect 115 million people to purchase online this holiday season," said Patti Freeman Evans, a senior analyst covering the retail industry, at JupiterResearch in New York.

Meanwhile, a hefty portion of consumers visit the Web to do some gift research. While 47% of consumers overall said they plan to make at least one holiday purchase online this year, up from 36% three years ago, a much larger portion of consumers -- almost 89% -- said they regularly or occasionally research products on the Internet before buying in a store, according to a survey by BIGResearch for the National Retail Federation.

The National Retail Federation expects holiday sales to rise 5% this year, to about $457 billion, but that figure does not include online sales.

Dangers abound

Shopping online may be as safe as driving to the local mall, but you'll still need to stay on guard. One click to the wrong Web site and you could end up downloading malicious code that puts your computer into someone else's control -- sending out fraudulent e-mails or even hosting a scam Web site -- without you ever knowing. See related story.

Another growing threat: Phishing e-mail messages which appear to be from a legitimate company, often a financial institution, asking you to update your account information. The information you enter goes to a fraudster, not your bank. Soon, consumers should expect a holiday theme to these messages.

"I don't think anyone will be surprised to see more phishing attacks specifically around holiday shopping," said Rich Mogull, a research vice president in the security and risk group at Gartner Research, the Stamford, Conn.-based research firm. Mogull is in Phoenix.

"There are always a lot of [scammers] trying to leverage the holidays ... we expect to see an influx, particularly once Black Friday comes around," he said.

Check out that Web site

For the most part, when it comes to security measures, "retailers are doing a good job, they're just not letting consumers know about it as well as they could," Freeman Evans said. "Consumers see maybe at checkout a VeriSign logo, but they have to wait until they've already decided to check out to see it."

That's slowly changing, with some retailers this holiday season posting security-related messages on the first page of their Web sites, she said, such as the "Hacker Safe" logo, which tells shoppers that the Web site meets certain security standards.
Look for such logos, as well as for the padlock, or "https" (rather than just "http") in the URL, indicating some layer of protection is in effect.

"Companies are realizing that this is a problem and that if they lose the trust and confidence of consumers, they'll be out of business," said Jorgen Wouters, a senior producer with Consumer Reports WebWatch, a research organization that aims to improve the credibility of information on the Internet, based in Yonkers, N.Y.

One good strategy for staying as safe as possible is to stick to well-known retailers, because their Web sites are less likely to include malicious spyware or adware that will cram your computer with pop-ups.

But it's possible to shop safely at smaller retailers as well, as long as you do your homework. "If you're going to start bargain-hunting, in particular, you need to know who you're doing business with and you need to understand some of the smaller retailers may not have security controls in place," Mogull said.

Make sure the Web site offers contact information, including an address, experts said. Also, consider visiting the Better Business Bureau to find out whether complaints have been lodged against the retailer. Visit the BBB Web site.

Plus, check out online reviews of the retailer. "Go to comparison shopping sites, read the reviews there and see what kind of ratings they get," Freeman Evans said.

Also, read the privacy policy posted on the retailer's Web site to find out what types of security measures the company has in place. "The better sites will spell out [in their privacy policies] whether they use SSL or encryption or things along those lines," Wouters said.

And, some new tools will alert you to which Web sites are dangerous and which are safe, such as McAfee's Site Advisor, a free product.

More tips for staying safe

Enter in Web site addresses yourself, rather than clicking on links. "If someone sends you an e-mail with an offer, don't click on it," Mogull said. "Go to the Web site" on your own.

Pay by credit card to ensure that, should a fraud occur, the maximum you're on the hook for is $50. Also, check your credit-card statements regularly to catch any possible problems early.

Keep your computer security products up-to-date. Make sure you've got the latest antivirus and antispyware protection, as well as the latest security patches for your operating system, and make sure your firewall is on. While these security tools won't cover all of the latest threats, you're a lot better off with some protection rather than none.

"It's not perfect," Mogull said, "but new versions can do a lot."