"Never pay via a website with an address that does not start with HTTPS" would maybe be better? The padlock is the first step, and possibly the most impactful

"Never pay via a website with an address that does not start with HTTPS" would maybe be better? The padlock is the first step, and possibly the most impactful security check that a non-technical person can do. Recognising Fake webpages, XSS, CSP, malware, etc is very hard and impossible to expect from any visitor of a website.