A Tuesday afternoon that told me everything about trust
A few months ago, a customer in Melbourne was about to place a fairly large order — a birthday hamper and a bouquet for her mother in Nugegoda. She had never bought from us before. Before she paid, she did four things: she checked our address on Google Maps, she Googled “Kapruka reviews”, she called our Colombo support line to confirm someone actually picked up, and she asked over chat whether the card charge would appear on her statement as “www.kapruka.com (Pvt) Ltd” so she could recognise it.
Only after all four did she pay.
That sequence — physical address, independent reviews, live human on the phone, predictable bank descriptor — is roughly what any careful shopper should do. And it is exactly the same list that a serious merchant should try to be visibly correct on. This post walks through both sides: what a shopper should look for to trust an online shop in Sri Lanka, and what a merchant actually has to do to earn that trust. If you want to build customer trust in online shopping, this is the ground floor.
What trust signals should you check before buying?
Trust online is not one thing. It is a stack of small signals that, together, tell you whether a business is real, competent, and reachable if something goes wrong.
Here are the signals I would check as a shopper, in the order I would check them:
- Domain and HTTPS. The address bar should show
https://and a padlock. Click the padlock — the certificate should be issued to a name that matches the business. - Physical address and phone number. A real Sri Lankan business will list a Colombo (or other city) address and a landline or hotline you can actually call during business hours.
- Company registration. Reputable shops mention their registered company name somewhere in the footer or “About” page (for example, “Kapruka Holdings PLC”).
- Payment options. Cards processed through 3D Secure, bank transfers via named local banks, and cash on delivery for local orders are all healthy signs. Crypto-only or “send us the money on a personal account” is not.
- Returns, refunds and delivery policy. These should be written down, dated, and specific — not vague.
- Independent reviews. Not just testimonials on the site itself. Search the brand name on Google, Trustpilot, and Sri Lankan Facebook groups.
- Support responsiveness. Send a pre-purchase question. If nobody responds in a reasonable window, that is your answer.
If a shop passes six of seven, you are probably safe. If it fails three or more, walk away.
The signal-to-meaning table
| Trust signal | What it actually tells you |
|---|---|
| HTTPS + valid certificate | Your card and login data are encrypted in transit |
| Registered company name in the footer | There is a legal entity accountable if something goes wrong |
| Landline / hotline that a human answers | Operations exist beyond the website |
| 3D Secure on Visa/Mastercard | Your bank verifies you with an OTP before the charge goes through |
| Written returns policy with timelines | Refunds are a process, not a favour |
| Independent reviews across multiple sites | Reputation is not manufactured on one page |
| Consistent bank statement descriptor | You can recognise the charge later and dispute if needed |
How can you tell if a Sri Lankan online shop is safe?
A few checks are specific to Sri Lanka and worth calling out.
Check the payment processor. Legitimate Sri Lankan online shops route card payments through gateways such as PayHere, Sampath CEFT, Commercial Bank’s IPG, or similar bank-backed processors. On the checkout page, the URL of the payment step usually changes to the processor’s domain. That is normal and healthy — it means your card details are being handled by a regulated bank gateway, not stored on the shop’s server.
Confirm 3D Secure kicks in. After you enter card details, you should receive an OTP from your card-issuing bank (Commercial, HNB, Sampath, BOC, Nations Trust, and so on). If a Sri Lankan shop takes a Visa or Mastercard payment without any OTP step, that is a red flag. 3D Secure is documented in the Visa Secure and Mastercard Identity Check programmes and is the single most important consumer-side card protection online.
Check the delivery model. A shop selling perishables like flowers or cakes should be explicit about morning versus afternoon dispatch cutoffs, and about which cities they deliver to on the same day. Vague delivery promises are the first thing to break during peak periods. When someone orders to send flowers in Sri Lanka for a same-day birthday, a real merchant will tell you the cutoff time before you pay, not after.
Cross-check with the Consumer Affairs Authority. Sri Lanka’s Consumer Affairs Authority is where you can file a complaint if an online seller misrepresents a product or refuses a legitimate refund. Knowing this exists — and knowing the shop is subject to it — is itself a piece of trust infrastructure.
Why do payment options matter for trust?
Payment options tell you more about a merchant than almost any other single signal.
- Cards via 3D Secure — the bank is in the loop, so disputes are possible.
- Local bank transfer to a registered company account — the account name should match the trading name.
- Cash on delivery for domestic orders — no risk until the parcel is in your hand.
- International cards for diaspora orders — routed through the same gateways, with the charge in LKR converted by your bank.
What you do not want to see: a checkout that asks you to transfer money to a personal savings account, or one that only accepts crypto, or one that emails you a “special payment link” outside the normal checkout. In four years of running Kapruka’s support inbox, almost every scam complaint we hear about other sellers involves one of those three patterns.
Electronics is the category where this matters most. If you are buying electronics in Sri Lanka online, the item is expensive, the seller pool is wide, and counterfeit or grey-market goods are common. Insisting on a card payment with 3D Secure gives you the option to raise a chargeback with your bank if the item never arrives or arrives clearly not-as-described.
What builds trust from the merchant side? (an operator’s view)
If you run a small online shop, the trust question flips. Instead of “how do I know this shop is safe?”, it becomes “how do I make it visibly obvious that mine is?” Here is what I have watched actually move the needle in my four years at Kapruka.
Answer the phone. A hotline that a human picks up within a couple of rings does more for trust than any badge on the homepage. Even a well-written contact form matters — the Kapruka customer support form is one of the highest-trafficked pages on the site precisely because customers want a paper trail before they buy.
Publish policies with specific numbers. “Refunds processed within 3-4 business days of approval” beats “we process refunds promptly”. Specific numbers signal that the process exists and is measured. Vague promises signal the opposite.
Keep your bank descriptor consistent. If your business trades as “ABC (Pvt) Ltd” but charges show up on statements as “PAYHERE-XYZ-9821”, every second customer will assume they have been scammed and open a dispute. Fix the descriptor with your acquiring bank.
Send transactional emails from a real domain. Order confirmations, dispatch notifications and refund confirmations should come from something@yourshop.lk, not from a Gmail address. Set up SPF, DKIM and DMARC so the emails do not land in spam.
Show the ugly stuff too. Publish the returns policy, the delivery exceptions, and the “what happens if the item is out of stock” flow. Hiding edge cases does not eliminate them — it just means customers discover them mid-order and lose faith.
Acknowledge that disputes will happen. No online shop, ours included, can guarantee zero disputes. Cards get charged twice by processors, couriers deliver to the wrong gate, cakes arrive with a cracked topper. What matters is not whether these happen — it is whether the customer is refunded or the item re-delivered without an argument. The measured version of that promise, published on the site, is what actually earns repeat orders.
A quick, honest limitation
Even a shop that passes every check can have a bad week. A supplier can run out of a SKU. A courier can lose a parcel between Colombo and Kandy. What separates a trustworthy shop from an untrustworthy one is not the absence of these events — it is the presence of a documented, funded process for making them right. If a shop cannot answer “what do you do when X goes wrong?” clearly, its trust signals are decorative.
Frequently asked questions
How can I tell if an online shop in Sri Lanka is safe?
Check for HTTPS, a Sri Lankan business address, a phone number that a human answers, card payments processed through 3D Secure, a written returns policy, and independent reviews on Google or Facebook groups. If six of these seven check out, the shop is likely safe.
What is 3D Secure and why does it matter?
3D Secure is a card authentication step where your issuing bank sends you an OTP to confirm a purchase. It matters because it proves your bank is in the transaction loop, which means you can raise a chargeback if the merchant fails to deliver. Any Sri Lankan online shop taking Visa or Mastercard should trigger it.
Why should I trust cash on delivery over card payment?
For local orders, cash on delivery removes payment risk entirely — you inspect the parcel before you hand over money. Card payment, however, gives you dispute rights through your bank if the item is defective or misdescribed. Both are legitimate; the right choice depends on order value and delivery distance.
How do I check if a website’s certificate is valid?
Click the padlock icon in your browser’s address bar. The certificate should be issued to a domain and organisation name matching the shop. If the browser shows a warning, or the certificate name does not match, do not enter card details.
What should I do if an online order goes wrong?
Contact the shop’s support first, in writing, with your order number. If unresolved within a reasonable window, raise a chargeback with your card-issuing bank or file a complaint with the Consumer Affairs Authority of Sri Lanka. Keep screenshots of the product page, order confirmation, and any correspondence.
Do positive reviews on the shop’s own website count as trust signals?
Not on their own. Testimonials hosted on the seller’s site are self-curated. Real trust signals come from reviews on independent platforms — Google Business, Trustpilot, Facebook communities — where the shop cannot delete a bad review.
Related reading on Kapruka
- Kapruka customer support — the form we monitor during business hours for pre-purchase questions and order issues.
- Birthday cake delivery in Sri Lanka — an example of a category where dispatch cutoffs and delivery windows are published upfront.
If you take one thing from this post: to build customer trust in online shopping, ignore the marketing on the homepage and check the boring operational signals — the address, the payment step, the returns policy, the person on the other end of the phone. Those are the things that survive a bad week, and they are the things a serious shop invests in.
About the author
Akthar is the Digital Marketing Manager at Kapruka Holdings PLC.
He has spent over four years at Kapruka working across marketing analytics, customer experience, and operations — with direct involvement in diaspora gifting logistics, payment integrations, and customer support workflows. The perspectives in his writing come from running these systems day to day, not from theory.
You can reach Akthar by email or connect with him on LinkedIn.