CRO / Trust
How to Build Trust on a New Ecommerce Store
// a stranger won't hand over a card to a store they don't trust
By Fracto Solutions
October 27, 2026
The short answer
A new store has no reputation, so first-time visitors have nothing to go on. Build trust with visible proof: real reviews, clear policies, honest contact details, professional design and a reassuring checkout. Several of those pages are legally required rather than optional, and the badge industry’s evidence for its own products is thin.
70.22%
19%
12 mo
Why is trust the deciding factor for a new store?
Because a first-time visitor has no reason to believe you yet. They do not know your brand, have not bought before, and are about to hand card details to strangers. Without reputation to lean on, visible signals are what get them over the line.
The most-cited number here needs handling with care. In Baymard’s current cart-abandonment data, updated September 2025, 19% of US shoppers who abandoned for a reason other than browsing selected “I didn’t trust the site with my credit card information”. Two caveats matter. Respondents could select several reasons, so the list sums well above 100% and no single item is a sole cause. And Baymard publishes no sample size for this round. You will see 18% quoted widely; that is a superseded earlier round of the same survey.
What that figure does support is that payment-security doubt is one of the larger reasons a checkout fails, sitting behind extra costs at 40% and slow delivery at 20%. For a store with no brand recognition to offset it, that is a real and fixable leak. This pillar covers the signals, and it connects to the product-page trust signals and reviews that reassure at the decision.
One claim we are dropping rather than repeating: you will often read that shoppers judge a site “in seconds” and that this is about trust. The underlying research is Lindgaard et al. (2006), which found that 50-millisecond judgements of visual appeal correlate with judgements after longer viewing. It measured aesthetics on static pages, not trust, not credibility and not purchase intent. First impressions clearly matter; attributing a trust judgment to that study does not hold.
What makes a store look untrustworthy?
Missing or hidden policies, no contact details, stock photos and thin copy, no reviews, spelling errors, a checkout that feels off, and surprise costs. Each plants a doubt, and for a store with no reputation a few are enough to lose the sale.
Shoppers scan for reasons not to trust you, and a new store often hands them several without realizing. No returns policy, a contact page with only a web form, zero reviews, and a generic template all read as “maybe not real”. The fixes are mostly cheap and fast, which makes this one of the highest-return areas to audit on a young store.
On surprise costs specifically: the FTC’s Rule on Unfair or Deceptive Fees, 16 CFR Part 464, effective 12 May 2025, requires upfront total pricing, but its scope is live-event ticketing and short-term lodging only, so it does not bind general ecommerce. What does bind you is FTC Act §5 on deceptive pricing, and in the EU, Consumer Rights Directive Article 6(1)(c), which requires the total price inclusive of taxes plus delivery charges before the order is placed.
What are the core trust signals?
Social proof, clear policies, real contact details, consistent professional design, and recognizable payment cues. Together they answer the three questions every first-time buyer has: is this real, is it safe, and what if it goes wrong?
Think of them as answering specific fears rather than decorating the page. We should be honest that there is no measured ranking of trust signals by conversion effect, so the order below is our judgment from client work rather than a published hierarchy.
Trust signal
Why it reassures
Where it goes
Reviews and customer photos
Real people bought and kept this
Product pages, homepage
Clear policies
You will be treated fairly if it goes wrong
Footer, product, checkout
Real contact details
There is an accountable business here
Footer, contact, about
Professional design
This brand is legitimate
Whole site, consistently
Payment and security cues
Your card data is safe
Checkout, near payment
Each answers a specific first-time-buyer fear. The ordering is our judgment; no published study ranks these by conversion.
Do trust badges actually help?
The honest answer is that nobody has shown it convincingly, and the evidence that exists is mixed. We would rather say that than repeat vendor case studies as research.
We looked for an adequately powered, independently verifiable A/B test isolating a badge’s conversion effect and did not find one. WiderFunnel published a negative result, a 1.6% decrease from adding a McAfee badge. Academic work cuts against the premise too: Kirlappos, Sasse and Harvey (TRUST 2012) found 38% of experienced ecommerce users failed to notice any seal present. And the lift figures that circulate, from Holabird Sports, Decor Steals and others, are TrustedSite case studies, and TrustedSite sells trust seals.
The one finding worth taking seriously is Baymard’s qualitative observation that users raise security concerns more readily on unfamiliar stores than on Apple or Walmart. That is about familiarity, not about seals, and Baymard’s own 2023 round found a homemade seal outperformed every established SSL seal bar one, which tells you what badges are actually measuring. The detail, including why we no longer name a specific seal, is in do trust badges work.
Which pages does the law actually require?
More than most new merchants realize, and treating them as optional trust gestures is the mistake. This is general information rather than legal advice, but the obligations are concrete enough to list.
A privacy policy, with no size threshold. California’s CalOPPA requires any commercial site collecting personal information from California residents to post one conspicuously. GDPR Articles 13 and 14 make it mandatory in the EU and UK, in plain language.
Cookie consent, separately. ePrivacy Directive Article 5(3) and UK PECR regulation 6 require prior consent for non-essential cookies. A privacy policy does not discharge this, and it is the most commonly enforced gap in EU and UK ecommerce.
A 14-day right of withdrawal for EU and UK distance sales, under Consumer Rights Directive Article 9(1). This is a statutory right, not a returns policy you choose, and you cannot shorten it. Article 10(1) is the part that bites: fail to tell the consumer about it and the window becomes 12 months and 14 days.
Business identity. e-Commerce Directive Article 5 requires your name, geographic address, email and trade-register details to be easily, directly and permanently accessible. In the UK, company name, number, place of registration and registered office are required too. The footer identity block you think of as a trust signal is a statutory disclosure.
Shipping timing. In the US, the FTC’s Mail, Internet, or Telephone Order Merchandise Rule, 16 CFR Part 435, requires shipment within the time you stated or, if you stated none, 30 days, with a cancel-and-refund option otherwise.
The practical upside is that doing these properly also does the trust work. The detail on writing them is in About and policy pages that build credibility.
How does trust affect checkout specifically?
Checkout is where money and card details change hands, and Baymard’s testing found that perceived security there runs on feel rather than technical reality. A clean, professional checkout with clear payment cues reassures; a technically secure but scruffy one does not.
Baymard’s wording is that the average user’s perception of security is “largely determined by their gut feeling”, directed “to a large extent” by how visually secure the page looks, and that “the visual reinforcement must be distinct and unique for the credit card fields”. That work is from 2016, updated with 2023 data, and it is qualitative observation of perception rather than a measured conversion effect.
One line worth drawing clearly, because the same research implies it: users cannot assess your encryption, so “looking secure” and “being secure” are separate things. Make the payment section visually distinct and actually use a reputable hosted checkout. Dressing an insecure checkout to look safe is the version of this advice that regulators would treat as deceptive. Getting it right also reduces cart and checkout abandonment.
If you want an order of work, ours is: publish the legally required pages properly, add real reviews to every product, put a geographic address and a working contact route in the footer, then look hard at the checkout. That sequence front-loads the things that are both obligations and reassurance, and it leaves the cosmetic items last, which is the opposite of how most new stores approach it.
How do I build trust before someone is ready to buy?
Be consistently credible everywhere a first-time visitor lands: honest content, visible proof, real contact, and a professional presence on and off your site. Trust accumulates, so every touchpoint either adds to it or chips at it well before add-to-cart.
Most of the impression is formed before the product page. A coherent brand, a genuine social presence, real reviews, and no red flags across the site add up to a visitor who arrives at checkout already willing to buy. We cannot put a number on that, and we are not going to pretend otherwise, but the fixes are cheap and the failure modes are obvious once you look at your own store the way a stranger would. It is the same find-the-friction approach behind our growth-strategy pillar.
We audit your store for the doubts that quietly cost first-time sales, and remove them.
We go through your store the way a cautious first-time buyer would, missing policies, thin contact details, no proof, a checkout that feels off, and fix the trust gaps that lose sales before anyone sees your products properly, then measure the lift.
It’s the same measurement-first discipline behind our conversion optimization and web development work, where we rebuild the buying path and measure the result .
// we would rather show up in your reporting than in your inbox
Frequently asked questions
Why do new stores struggle to convert?
Because they have no reputation, so first-time visitors have nothing to go on. In Baymard’s current data, 19% of US shoppers who abandoned for a reason other than browsing cited not trusting the site with their card information, though that is a multi-select question so it is one reason among several rather than a sole cause.
What's the single most important trust signal?
There isn’t one, and no published study ranks trust signals by conversion effect. In our experience social proof and clear policies do the heaviest lifting, because they answer ‘is this real and good’ and ‘what if it goes wrong’. That is our judgment from client work, not a measured result.
Do security badges at checkout help?
The evidence is weak and mixed. No adequately powered independent A/B test isolates a badge’s effect, one published test found a 1.6% decrease, and academic work found 38% of users did not notice seals at all. The lift figures circulating online come from companies that sell seals.
Which pages am I legally required to have?
A privacy policy (CalOPPA in the US, GDPR Articles 13 and 14 in the EU and UK), separate cookie consent under ePrivacy Article 5(3), a 14-day withdrawal right for EU and UK distance sales, and published business identity under e-Commerce Directive Article 5. Fail to disclose the withdrawal right and the EU cancellation window becomes 12 months and 14 days.
How does checkout affect trust?
Heavily. Baymard’s testing found perceived security runs on gut feeling and visual cues rather than technical reality, and that reinforcement needs to be distinct around the card fields. Make the payment section visually clear and use a reputable hosted checkout: looking secure and being secure are separate problems.
Sources
Checkout abandonment: Baymard Institute, cart abandonment rate list, page updated 22 September 2025. Average documented abandonment is 70.22% across 50 separate studies. Among US shoppers who abandoned for a reason other than browsing, 19% selected “I didn’t trust the site with my credit card information”, behind extra costs at 40% and slow delivery at 20%. Two things to hold onto: respondents could pick several reasons, so the figures sum well above 100% and no single one is a sole cause, and Baymard publishes no sample size for this round. An earlier round of the same survey reported 18%, which is the figure still circulating widely. https://baymard.com/lists/cart-abandonment-rate
Perceived security at checkout: Baymard Institute, “Perceived Security of the Payment Form”, published 5 October 2016 and updated with 2023 data, from moderated in-lab usability sessions. Baymard’s wording: the average user’s perception of a site’s security is “largely determined by their gut feeling”, directed “to a large extent” by how visually secure the page looks, and “the visual reinforcement must be distinct and unique for the credit card fields”. This is qualitative observation of perceived security, not a measured conversion effect, and it predates universal HTTPS and hosted wallets. https://baymard.com/blog/perceived-security-of-payment-form
Trust seals: Baymard Institute site-seal survey, fielded 9 to 11 January 2013 via Google Consumer Surveys, 2,510 US adults with 1,286 answering on actual seals, randomised answer order. The question asked which badge gave the best sense of trust, which is stated preference rather than recognition or behavior, and 49% answered “don’t know” or had no preference. A later Baymard round in 2023 found a homemade seal outperformed every established SSL seal bar one, which is strong evidence that seals measure familiarity rather than security. An independent CXL survey in October 2016 (2,100 US respondents) put PayPal first instead, and its authors note that how people say they would behave and how they do behave are not the same. https://baymard.com/blog/site-seal-trust
Do badges lift conversion? No good public evidence. We found no adequately powered, independently verifiable A/B test isolating a trust badge’s conversion effect. GoodUI aggregates seven tests and states its own power target is not yet met. WiderFunnel published a negative result: adding a McAfee badge decreased conversions by 1.6%, which its author attributes to placement. Academic work cuts against the premise: Kirlappos, Sasse and Harvey, “Why Trust Seals Don’t Work”, TRUST 2012, 60 experienced ecommerce users across six sites, found 38% of participants failed to notice any seal present. The lift figures that circulate (Holabird Sports, Decor Steals, Scrubs & Beyond and similar) are TrustedSite case studies, and TrustedSite sells trust seals. https://discovery.ucl.ac.uk/1353955
First impressions: Lindgaard, Fernandes, Dudek and Brown, “Attention web designers: You have 50 milliseconds to make a good first impression!”, Behavior & Information Technology 25(2), 2006, 115 to 126. The study measured visual appeal ratings of static web pages on a sliding scale, and found that 50-millisecond judgements correlate with judgements after longer viewing. It did not measure trust, credibility, purchase intent or conversion, and it did not use live stores. We cite it for visual appeal only. https://www.tandfonline.com/doi/abs/10.1080/01449290500330448
Pages that are legally required, not optional: in the US, CalOPPA (California Business and Professions Code §22575) requires any commercial site collecting personal information from California residents to post a conspicuous privacy policy, with no revenue or volume threshold; the FTC Mail, Internet, or Telephone Order Merchandise Rule, 16 CFR Part 435, requires shipment within the stated time or, absent one, 30 days. In the EU and UK, GDPR Articles 13 and 14 make the privacy notice mandatory and Article 12(1) requires plain language; the ePrivacy Directive Article 5(3) and UK PECR regulation 6 require prior consent for non-essential cookies, which a privacy policy does not satisfy; the Consumer Rights Directive 2011/83/EU Article 9(1) gives a 14-day withdrawal right, and Article 10(1) extends the window to 12 months and 14 days if you fail to inform the consumer of it; and e-Commerce Directive Article 5 requires name, geographic address, email and trade-register details to be easily, directly and permanently accessible. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32011L0083
Stated as Fracto’s position, not research: that trust is cumulative rather than driven by one signal, that a specific About page beats generic brand copy, and that a visibly professional checkout matters more than any badge. We found no published data on About-page traffic share or its conversion effect for ecommerce, and no measured ranking of trust signals. These are our conclusions from client work; the figures above are sourced, these are not.