Is Temu legit and safe? What to know before you buy

Is Temu legit or a scam?

Temu is legit. It’s a functioning e-commerce site, not a fake or scam website. In the US, Temu operates through a registered entity. The platform supports secure payment methods and offers returns or refunds for most items within 90 days, with some exceptions.

As of publication, Temu has a Better Business Bureau (BBB) business profile with a B rating. The rating is below BBB’s top range, and BBB doesn’t accredit Temu. The profile also lists more than 6,000 complaints against the business. BBB’s complaint analysis from October 23, 2025, identified common issues with product quality, shipping delays, customer service, returns, refunds, and website usability.

These complaints don’t make Temu a scam, but they show why shoppers should treat low prices and unfamiliar sellers with caution.

What is Temu and who owns it?

Temu is an online marketplace where third-party sellers list low-cost products. Its product range includes clothing, beauty products, electronics, home goods, toys, pet supplies, and other everyday items.

Temu is owned by PDD Holdings, a company founded in China. PDD Holdings previously listed Shanghai as its main office, but it has listed Dublin, Ireland, as its principal executive office since 2023.¹ In the US, Temu operates through Whaleco Inc., which is part of PDD Holdings.

PDD Holdings also owns Pinduoduo, a major shopping app in China. Temu’s link to the same parent company matters because Pinduoduo has faced privacy and security concerns in the past.² Those concerns have shaped how some regulators, researchers, and shoppers view Temu. The app safety section below explains the issue in more detail.

Why is Temu so cheap?

Temu keeps prices low by connecting shoppers with sellers that often source products directly from manufacturers. The company also benefits from large-scale production, low-cost manufacturing, and aggressive discounts that help attract shoppers.

Temu prices can vary by country because of shipping costs, local fulfillment, and import rules. Some US orders became more expensive after trade changes affected low-value imports. See Do you have to pay import charges on Temu orders? for more details.

Does Temu actually deliver your orders?

Yes, Temu does send orders. Temu shows estimated delivery dates at checkout and on the order confirmation page, and shoppers can track orders through Temu’s app or website. Temu offers standard shipping and may also offer express shipping on some orders.

Temu delivery time depends on whether the item ships from a local warehouse or directly from overseas. It also varies by seller and shipping method. Many standard orders take about one to three weeks, but the checkout estimate is the best guide for a specific order.

Temu has expanded US-based fulfillment since 2024, which can help some orders arrive faster and reduce customs-related delays for US shoppers. If an order doesn’t arrive, check the tracking page first. Then request help through Temu’s order support or Purchase Protection options.

Temu is legit, but scammers still misuse its name. Shoppers should also understand how safe Temu’s website, app, payments, data practices, and products are.

Is Temu safe?

Temu is safe enough for basic shopping if you stick to the official Temu website, pay with a secure payment method, and limit the data you share. The main safety concerns involve app permissions, data collection, inconsistent product quality, and privacy or consumer protection issues raised by ongoing legal scrutiny.

The table below gives a quick overview of the main safety areas before we cover each one in more detail.

Is Temu safe to buy from?

Temu is generally safe to buy from if you understand that it’s a marketplace with third-party sellers. Its checkout process uses standard security measures, but product quality and seller reliability can vary.

Temu says it conducts regular security audits and updates. It also says it uses Secure Sockets Layer (SSL) technology to encrypt data during transmission. In practice, Temu’s website uses TLS certificates for HTTPS connections.

Temu also offers a Purchase Protection Program for common order problems. The program covers items that don’t match the listing, arrive damaged, arrive late, get lost in transit, or can’t be delivered. Temu may ask you to send the item back before it issues a full refund. Temu returns are available for most items within 90 days from the date of purchase, with some exceptions.

These measures help create a more secure online shopping experience, but they don’t guarantee that every listing is accurate or every seller is reliable.

Is it safe to pay with a card on Temu?

Yes, it’s generally safe to use a credit card on Temu. Temu says its payment links are PCI certified and that it follows the Payment Card Industry Data Security Standard (PCI DSS) when handling credit card information. Temu also says it uses payment security systems such as Visa Secure, Mastercard Identity Check, American Express SafeKey, Discover ProtectBuy, and JCB J/Secure.

These names refer to standard card payment protections. PCI DSS sets security rules for companies that handle card data. Visa Secure, Mastercard Identity Check, American Express SafeKey, Discover ProtectBuy, and JCB J/Secure are 3D Secure systems. They may ask your card issuer to verify some purchases before payment goes through.

Temu works with major payment providers, including Visa, Mastercard, PayPal, Apple Pay, and Google Pay. It also works with HackerOne’s bug bounty program, which lets security researchers report vulnerabilities.

So what can you do on your end? Use a credit card when you can. Credit cards are often safer for online shopping because they don’t pull money directly from your bank account and may offer stronger fraud protections than debit cards.

How safe are Temu products?

Product safety on Temu is inconsistent. Many items arrive as described, but some marketplace listings include poor-quality, mislabeled, counterfeit, or unsafe products.

BEUC, the European Consumer Organisation, reported that 15 months of testing by consumer groups found issues with some Temu toys, baby products, cosmetics, electric heaters, jewelry, shoes, clothing, and food-contact materials. Reported problems included detachable toy parts, missing ingredient lists, fire and electric shock risks, phthalates, cadmium, nickel, lead, and PFAS.³

Consumer Reports reviewed more than 100 baby product listings across Amazon, Target, Temu, and Walmart. The investigation found prohibited products on Temu, including pajamas that did not list brand names, and baby product listings that omitted key safety details, such as crib weight limits. Temu told Consumer Reports it removed several unsafe listings, strengthened requirements for children’s products, and launched a more accessible safety alerts and recalls center.⁴

Seoul authorities also found toxic substances in products sold on platforms including Temu. Sandals from Temu contained lead in the insoles at more than 11 times the permitted level, while some children’s clothes from Temu reportedly contained up to 622 times the legal limit for toxic substances.^5,6 Temu told AFP it removed the listings and started an internal investigation.

For a comparison with another low-cost marketplace, read our guide to whether AliExpress is safe.

Is the Temu app safe?

The Temu app appears safe for ordinary shopping, but privacy-conscious users should treat it with caution. Temu says it follows international standards verified through the Mobile Application Security Assessment (MASA). DEKRA, an independent testing and certification company, provides MASA assessments that review areas such as app data privacy, encryption, access control, internet transmission security, device permissions, and vulnerability updates.

The app has faced scrutiny because of Pinduoduo, another shopping app owned by PDD Holdings. In 2023, Google suspended Pinduoduo from the Google Play Store for security concerns after malware was found in versions distributed outside Google Play.² CNN also reported that after PDD Holdings restructured, most of the team involved was transferred to Temu.⁷

Grizzly Research later claimed that the Temu app contained tools for aggressive spyware activity.⁸ Temu denied the allegations and argued that Grizzly Research had a financial incentive to publish negative claims because it was shorting the company’s stock.⁹ That conflict of interest doesn’t automatically make the claims false, but it’s a reason to weigh them against independent technical analysis.

The analysis from the Swiss National Test Institute for Cybersecurity (NTC) found no clearly critical vulnerabilities or evidence of malicious activity in the Temu app. The NTC also found that Temu’s permissions were broadly in line with a typical e-commerce app and less problematic than some competitor apps.¹⁰

The NTC still flagged technical concerns. The app can dynamically load JavaScript-like code, which lets developers change some app behavior after installation without a standard app store update. The report noted that dynamic code loading is not unusual by itself, but Temu’s use of an unknown, proprietary runtime made the app harder to predict and test.¹⁰

The analysis also found extra encryption layers beyond standard protections such as TLS. Extra encryption can help protect user data from unauthorized access, but it can also make independent review harder. Because the NTC could not always decrypt and inspect the transmitted data, it could not conclusively determine what data the app processed and sent to Temu’s servers.¹⁰

If you’re concerned, use Temu through your browser instead of the app. The NTC notes that browser access can reduce the attack surface and limit opportunities for permanent user surveillance, especially in business or government contexts and for people with higher exposure to privacy risks.¹⁰

What data does Temu collect from you?

Temu collects a broad range of data to run accounts, process orders, prevent fraud, personalize shopping, and deliver products. Its privacy policy groups this data into three main categories: information you provide, information from third-party sources, and information collected automatically.

Data you provide can include your:

• Email address or phone number
• Shipping address
• Billing and payment-related details
• Purchase history
• Customer support messages
• Chats with merchandise partners
• Reviews, photos, videos, and uploaded content
• Promotion, giveaway, or survey information

Temu may also collect information from third parties. These sources can include data providers, marketing and advertising partners, public sources, payment processors, logistics providers, social media services, third-party mapping platforms, merchandise partners, and their business partners.

Temu also collects data automatically when you use its website or app. This data can include your device model, operating system, internet service provider, language settings, advertising identifiers, browsing and purchase history, cart activity, email interactions, crash reports, performance logs, approximate location, IP address, cookies, and similar tracking technologies.

Some of this data collection is normal for e-commerce. Temu needs your address to ship orders and payment information to process purchases. The privacy concern comes from the volume of data collected, the use of advertising identifiers, and the sharing of information with affiliates, service providers, advertising and analytics partners, business partners, and merchandise partners.

Temu says users can control some privacy settings, such as browser cookies. However, its privacy policy notes that the service may not work properly if you disable cookies.

Does Temu steal or sell your information?

Temu’s privacy policy doesn’t show that the company steals user data. Temu says it doesn’t sell personal information “in the traditional sense,” but it does share data with advertising, marketing, and analytics partners. Some US privacy laws, including California’s CCPA, can treat certain types of data sharing for targeted ads as a sale or sharing of personal information.

Temu has also faced privacy lawsuits. One class action lawsuit alleged that Temu used its in-app browser to track users’ activity on third-party websites and collect private data without proper consent.¹¹ Temu has denied the allegations.⁹ We’ll cover Temu lawsuits and legal scrutiny in more detail below.

What are the risks of Temu?

The main risks of using Temu involve data privacy, app scrutiny, product safety, legal disputes, and scammers who impersonate the brand. These risks don’t mean every Temu order is unsafe, but they explain why shoppers should take basic precautions.

Temu lawsuits and legal scrutiny

Temu faces legal scrutiny in the US and Europe over data collection, consumer protection, counterfeit products, and product safety. A Temu lawsuit can refer to several types of cases, including state attorney general lawsuits, consumer class actions, and federal or EU enforcement actions.

Several US states have sued Temu over privacy and consumer protection concerns. Arkansas sued Temu in 2024 over alleged deceptive practices and illegal access to personal information.¹² Arizona sued Temu in 2025, with claims that the platform violated the Arizona Consumer Fraud Act and put users’ privacy at risk.¹³ Kentucky sued Temu in 2025 over alleged unlawful data collection, privacy violations, and counterfeiting of Kentucky brands.¹⁴

Texas sued PDD Holdings and Whaleco Inc. in 2026 over alleged deceptive marketing and illegal data harvesting.¹⁵ Texas later resolved its data privacy claims with Temu. Under the settlement, Temu agreed to store Texas residents’ data on US servers, limit access from China, and submit its apps to annual third-party security testing.¹⁶ Temu did not admit wrongdoing as part of the settlement.¹⁷

Temu also faces consumer data lawsuits. A 2023 Temu class action lawsuit alleged that the app collected more user data than needed and used deceptive practices to access that data. Another class action alleged that Temu tracked user activity through its in-app browser. Temu denied the allegations and told CBS Chicago that it does not sell customer data to third parties.⁹

In Europe, the European Commission fined Temu €200 million (about $233 million) in May 2026 under the Digital Services Act. The Commission said Temu failed to properly assess systemic risks linked to illegal products on its platform, including unsafe baby toys and faulty chargers.¹⁸

The US government has also taken federal action against Temu. In September 2025, the FTC announced that Whaleco Inc., which operates Temu, would pay $2 million to resolve allegations that it violated the INFORM Consumers Act by failing to give shoppers required information and tools to help them avoid and report stolen, counterfeit, or unsafe goods.¹⁹ The Justice Department said Temu agreed to a $2 million civil penalty and injunction to resolve the case.²⁰

Similar concerns have followed other foreign-owned apps, including questions about whether RedNote is safe.

Temu data breach claims

Temu data breach claims have appeared more than once. In 2024, a hacker claimed to have stolen 87 million Temu records, but Temu denied that its systems were breached.²¹

In 2026, Cybernews reported a separate claim involving 310 million Temu accounts. Temu again denied the claim and said the circulated data was not from its systems.²²

At this point, public evidence does not confirm a verified leak of Temu’s customer account database. If you’ve used Temu and worry that your details may appear in leaked datasets, change reused passwords and consider using a dark web monitoring tool.

Unethical labor practices

Temu has faced forced labor concerns. In 2023, the House Select Committee on the Chinese Communist Party said there was an “extremely high risk” that Temu’s supply chains were contaminated with forced labor. The committee said Temu relied on tens of thousands of mostly China-based sellers and lacked a meaningful system to ensure compliance with the Uyghur Forced Labor Prevention Act, or UFLPA. The UFLPA restricts imports of goods made wholly or partly with forced labor from China’s Xinjiang region.²³

The report also criticized Temu’s use of the US de minimis provision, which allowed many low-value packages to enter the US with less customs scrutiny. According to the committee, Temu’s business model shifted responsibility for forced labor compliance away from the platform because Temu did not act as the importer of record for goods shipped to the US.²³

Temu has denied wrongdoing in response to allegations about its business practices. The concerns still matter because low prices can make it harder for shoppers to see how products are sourced, checked, and shipped. Similar questions have followed other low-cost shopping platforms, so read our guide on Shein safety if you want to compare the two platforms.

Scammers impersonating Temu

Scammers use Temu’s name in fake texts, emails, social media posts, and look-alike shopping sites. Temu says its official email domains are temu.com, temuemail.com, temumail.com, temuofficial.com, temufavor.com, usa.temu.com, and emea.temu.com

Messages that appear to come from other domains, pressure you to act fast (a smishing tactic), or send you to fake shopping websites may be part of Temu-related scams. If a message asks you to pay a fee or log in through an unfamiliar link, treat it as a scam.

How to buy from Temu more safely

Follow these steps to protect your privacy, payment details, and account, and to choose safer products when you buy from Temu:

• Shop on the website if you’re concerned about the app. The NTC found no proof of malicious activity in the Temu app, but it advised caution with apps that use wide-ranging permissions. If the app makes you uncomfortable, use Temu through your browser instead.¹⁰
• Use an anonymous email address. Create a separate email address for your Temu account to keep shopping emails away from your main inbox. iPhone users can also use Apple’s “Hide my email” feature.
• Limit app permissions. Deny access to your contacts, camera, microphone, photos, and precise location unless a feature needs that access. Limiting permissions helps reduce how much sensitive data the app can access.
• Pay with a credit card, virtual card, or PayPal. Avoid saving your card in your Temu account. A virtual card or payment service can reduce the impact of account takeover because scammers won’t get direct access to your main card details.
• Turn on two-factor authentication. Two-factor authentication adds a second login step, such as a code sent to your phone or email account. The extra step helps reduce the risk of account takeover if your password is exposed.
• Create strong passwords. Don’t reuse your email, banking, or social media password on Temu. Use a unique password that would be hard to guess and store it in a password manager.
• Choose products carefully. Low-risk items, such as home accessories, carry less safety risk than electronics, baby products, cosmetics, heaters, or protective gear. Read reviews, product descriptions, measurements, and safety labels before you buy.
• Check seller reviews. Avoid sellers with very few reviews, especially if every review sounds generic. Prioritize sellers with detailed reviews, customer photos, and a consistent order history.
• Scan links and texts before you click. If you receive a Temu deal, customs notice, or refund message, test the URL with NordVPN’s link checker and check suspicious texts with the scam text checker.
• Protect your internet traffic on public Wi-Fi. A VPN encrypts your internet traffic between your device and the VPN server, which helps protect your activity on unsecured networks. NordVPN’s next-gen antivirus can also help detect malicious links and files before they cause harm. You can also use its tracker blocker to reduce some forms of web tracking.
• Watch for signs of identity theft. If your Temu account, email account, or payment card gets compromised, act fast. Review recent orders and contact your bank if you see unauthorized charges.
• Keep your cyber hygiene habits simple. Update your devices, review privacy settings, delete accounts you no longer use, and avoid storing payment details in shopping accounts.

If you’ve taken these precautions and still don’t trust the app, use Temu only through the website or delete your Temu account.

Disclaimer: The trademarks referenced are for illustrative purposes only. NordVPN is not affiliated with, sponsored by, or endorsed by the owners of those trademarks. The information in this article was accurate as of the date of publication and is subject to change.