Is Shein legit or a scam?
Shein is a legitimate business. Founded in China and now headquartered in Singapore, the platform has become one of the world’s largest fast-fashion destinations, with hundreds of thousands of clothing and accessories listings at low prices. Transactions work as expected — customers place orders, make payments, and typically receive their purchases without issue.
So is Shein a scam? No, but “Is Shein safe?” is still a fair question to examine.
Is Shein safe?
When it comes to online safety, Shein is a mixed picture. This section covers website security, app security, payment safety, and data privacy.
Is the Shein website safe?
Shein is a safe website. It operates over HTTPS and uses SSL/TLS encryption to protect data in transit between your browser and its servers. SSL/TLS encryption means the information you enter — including login credentials and payment information — travels in an encrypted form that’s difficult for third parties to intercept.
So is Shein a secure website? Yes, it meets the baseline security standards expected of any major e-commerce platform. Even so, Shein displays pop-ups and links to third-party sites, and not every external site it links to will meet the same security standards. Treat any pop-up that redirects you away from shein.com with caution.
Is the Shein app safe?
The Shein app is safe to use. It applies the same security measures as the website and supports secure payment options like PayPal. The app is available through the Apple App Store and Google Play Store, both of which vet apps for known security issues before listing them.
Is it safe to use a credit card on Shein?
Shein uses SSL/TLS encryption during checkout and processes payments through PCI DSS-compliant systems. PCI DSS (the Payment Card Industry Data Security Standard) is the security framework that governs how merchants handle card data. Shein states that it doesn’t store the credit card information you enter into the payment fields during checkout.1
A credit card is still a better choice than a debit card for online shopping. Credit cards offer stronger fraud protection — if an unauthorized charge appears, you can dispute it through your card issuer without the funds leaving your bank account first.
What information does Shein collect about its users?
Shein collects a wide range of customer data. According to its privacy policy, the data collected includes:
- The contact details of the user, such as their name, email address, and phone number.
- Browsing behavior on the platform, such as pages the user has visited, the links they’ve clicked, and time they spent on the site.
- User purchase history, including orders, returns, and refunds.
- User location data, inferred from their IP address.
- Device information, such as browser type, operating system, and device identifiers.2,3
Shein states that it may share customer data with third-party service providers — such as payment processors, logistics companies, and analytics partners — to operate its business. Sharing data with service providers is standard e-commerce practice.
Shein’s privacy policy also says it doesn’t sell user data to third parties “as that term is generally understood,” but it acknowledges that sharing identifiers such as cookies and other tracking technologies with partners and affiliates for targeted advertising may be interpreted as a “sale” or “sharing” under certain privacy laws. Users can opt out of this through the “Do not sell or share my personal information” link at the bottom of Shein’s website.3
Is Shein trustworthy? Shein’s history of data breaches and privacy fines
On the whole, Shein operates as a legitimate retailer, but its record on data protection is uneven. Its trustworthiness depends largely on how much you weigh the following incidents against the convenience of shopping there.
In 2018, Shein suffered a data breach that exposed the sensitive data of approximately 39 million customers. In 2022, the New York Attorney General fined Shein’s parent company Zoetop $1.9 million for failing to notify affected customers and misrepresenting the scale of the breach.4
Regulatory scrutiny extends beyond the US. For users in the EU, Shein is subject to the General Data Protection Regulation (GDPR), which sets strict rules on how companies collect and handle personal data. Despite that, France’s data protection authority, the CNIL, fined Shein €150 million in September 2025 for placing advertising cookies on users’ devices without their consent. The CNIL found that Shein deposited cookies on users’ devices as soon as they landed on the site, before they had the opportunity to accept or refuse them.5
The European Commission also launched formal proceedings against Shein under the Digital Services Act in early 2026, following multiple requests for information throughout 2024 and 2025.6 The CNIL fine and these proceedings point to serious concerns about how Shein has handled user data, and they’re worth factoring into your decision to shop there.
Beware of fake Shein websites and impersonation scams
One of the most significant risks associated with Shein has nothing to do with the company itself — it’s the wave of Shein scams carried out by criminals impersonating the brand. These Shein scam operations come in several forms:
- Fake storefronts. Fake shopping websites use domain names that incorporate or slightly misspell “Shein” — for example, “shein-deals.com” or “sheiin.com.” These sites mimic the look of the real platform to collect payment details from shoppers who don’t notice the difference.
- Fake social media ads. Scammers run paid ads on social media that look like official Shein promotions, often advertising extreme discounts or limited clearance sales. These ads link to fraudulent storefronts rather than shein.com.
- Phishing emails and SMS messages. Fraudulent messages impersonate Shein to send fake order confirmations, delivery updates, or refund notifications. They contain links designed to harvest your login credentials or payment details. Shein has publicly warned that unauthorized individuals have promoted fake mystery boxes on social media and that it does not sell or endorse products through unofficial channels.7
- Fake coupons and discount offers. Criminals distribute fake coupon codes through social media, messaging apps, and email. These offers lead to phishing pages that prompt users to enter their Shein login or payment details.
PRO TIP
Scammers also target shoppers through browser tools, so use caution with third-party extensions that interact with your payment or account information. PayPal Honey, for example, is a browser extension that automatically finds and applies coupon codes at checkout. Many shoppers wonder, “Is Honey legit?” It’s widely used and considered reputable, but not all shopping extensions meet the same standard. Before installing any extension, check its permissions and read its privacy policy.
To avoid Shein scams, go directly to shein.com by typing the URL into your browser rather than clicking links in emails or messages. Always check that the URL in your address bar matches shein.com exactly before entering any personal information.
How to shop on Shein more safely
Several online safety tips can help reduce your risk when shopping on Shein.
Check reviews
Before adding an item to your cart, check the reviews. They’re not just about product quality. Customers who have already purchased an item may offer useful insights about problems they encountered during ordering or payment.
Use a VPN on public Wi-Fi
Public Wi-Fi networks — in cafes, airports, or hotels — are often unsecured, which makes it easier for someone on the same network to intercept your data. If you shop on Shein while connected to a public network, your login credentials and payment details could be exposed and used for data theft.
A VPN encrypts your internet traffic, so even if someone intercepts it, they can’t read it. NordVPN, for example, routes your connection through a secure server and encrypts your data before it leaves your device. As a general rule, avoid accessing accounts that involve sensitive data on unsecured networks without a VPN active.
Protect your account with a strong password and 2FA
Use a strong, unique password for your Shein account — one that mixes lowercase and uppercase letters, numbers, and symbols, and that you don’t use anywhere else. If remembering complex passwords is a challenge, a password manager like NordPass can generate and store them securely so you only need to remember one master password.
Also, enable two-factor authentication (2FA). 2FA requires a second form of verification in addition to your password — usually a code sent to your phone or generated by an authenticator app. You’ll find the option to enable 2FA in your Shein account settings. With both a strong password and 2FA in place, your account is harder to access without your knowledge.
Use secure payment options
Prefer a credit card or PayPal over a debit card when shopping on Shein. Credit cards give you stronger fraud protection if an unauthorized charge appears, and PayPal keeps your card number separate from Shein.
Spot the warning signs of a Shein scam
Watch for these red flags:
Links in emails, social media ads, or messages that claim to be from Shein but push you to click through instead of visiting the site directly
A URL with misspellings or extra words in the domain, such as “shein-deals.com” or “sheinofficial-sale.net”
Offers that look too good to be true, like deep clearance sales or exclusive coupons promoted through unofficial channels
Update your Shein app regularly
Keep your Shein app updated so your browsing and purchasing stay smooth and secure. Outdated versions may have unpatched vulnerabilities, and updates often include security patches that close them. They may also introduce improvements to the shopping experience.
Disclaimer: NordVPN and NordPass have been developed by related entities, both part of the same corporate group. Shein is a trademark of Roadget Business Pte. Ltd. Shein and other trademarks referenced are for illustrative purposes only. NordVPN is not affiliated with, sponsored by, or endorsed by the owners of those trademarks.
Online security starts with a click.
Stay safe with the world’s leading VPN
References
1 SHEIN. (n.d.). Payment & taxes. https://m.shein.com/eur/How-to-Pay-a-278.html opens in a new tab
2 SHEIN. (2026, April 9). Privacy notice. https://eur.shein.com/Consumer-Privacy-Notice-s-101.html opens in a new tab
3 SHEIN. (2026, March 31). SHEIN privacy notice. https://us.shein.com/Consumer-Privacy-Notice-s-101.html opens in a new tab
4 Office of the New York State Attorney General. (2022, October 12). Attorney General James Secures $1.9 Million from E-Commerce SHEIN and ROMWE Owner Zoetop for Failing to Protect Consumers’ Data [Press release]. https://ag.ny.gov/press-release/2022/attorney-general-james-secures-19-million-e-commerce-shein-and-romwe-owner-zoetop opens in a new tab
5 Commission Nationale de l’Informatique et des Libertés. (2025, September 3). Cookies placed without consent: SHEIN fined 150 million euros by the CNIL. https://www.cnil.fr/en/cookies-placed-without-consent-shein-fined-150-million-euros-cnil opens in a new tab
6 European Commission. (2026, February 17). Commission launches investigation into Shein under the Digital Services Act. https://ec.europa.eu/commission/presscorner/detail/en/ip_26_420 opens in a new tab
7 SHEIN ZA [@sheinza_]. (2024, October 17). SCAM ALERT!!! Dear SHEIN Fam, it has come to our attention that there are unauthorized individuals falsely promoting SHEIN mystery boxes on South African social media [Photograph]. Instagram. https://www.instagram.com/p/DBN2ZN9NBh5/ opens in a new tab
Online security starts with a click.
Stay safe with the world’s leading VPN
