I hate clicking links in strange emails to web sites where I have to log in, so I never do. For example, if an email suggests I donate to a good charity, I either (1) go directly to the web site from an existing old bookmark (favorite) of mine, or (2) do a Google search to find the web site .. .. and then proceed from there.

Another safety thing I do is use "virtual account numbers" from Citi Cards Credit cards: you go to their website and get a random one-time useable credit card number. You give that number to the online vendor. That number can only be used once (it is random one-time). And the charge shows up on your regular Citi Bank credit card statement. See here for more info:
https://www.cardbenefits.citi.com/Products/Virtual-Account-Numbers
https://www.mybanktracker.com/credit-cards/faq/virtual-account-numbers-what-you-need-know-258440
Robt.