Online shopping continues to grow in popularity. This past Cyber Monday was the biggest online shopping day ever in the US, and broke records in mobile sales.
Unfortunately, the ease and convenience of online shopping makes the holiday season the perfect time for cybercriminals to take advantage of unsuspecting online shoppers. Attackers commonly take advantage of online shoppers in three ways:
- Creating fraudulent email messages and websites (look for https://, not http)
- Intercepting insecure transactions
- Targeting vulnerable computers
Fortunately, many cyber-threats are avoidable. When you shop in person, it’s a habit to bring reusable bags, lock the car, and put away your cash or credit card when you’re done. Similar habits can protect you, your purchases, and your identity when you’re shopping online:
- Shop reliable websites. If an offer sounds too good to be true, it probably is! Don’t be fooled by the lure of great discounts from less-than-reputable websites or fake companies. Use the sites of retailers you know and trust, and get to their sites by directly typing a known, trusted URL into the address bar instead of clicking on a link.
- Beware of seasonal scams. Fake package tracking emails, fake e-cards, fake charity donation scams, and emails requesting that you confirm purchase information are particularly common this time of year. Use known, trusted URLs instead of clicking on links.
- Don’t respond to pop-ups. Ignore pop-up offers and deals. Just close them. Don’t respond, click on the links, or call the phone numbers. Similarly, don’t respond to popups saying that you need to buy anti-virus software or software to “clean your infected computer.” These are all scams.
- Conduct research. There are a lot of fake and malicious companies out there this time of year. When considering a new website or online company for your holiday purchases, read reviews and see if other customers have had positive or negative experiences with them. Also verify the website has a legitimate mailing address and a phone number for sales or support-related questions. If the site looks suspicious, call and speak to a human.
- Pause before clicking on links or opening attachments. Do this even if they appear to be from people you know, legitimate organizations, your favorite retailers, or even your bank. Messages can easily be faked. Use known, trusted URLs instead of clicking on links. And only open known, expected attachments. When in doubt, throw it out!
- Pay by credit card, not debit card. Credit cards offer protections that may reduce your liability if your information is used improperly. Debit cards typically do not have the same level of protection. A related tip is to use a separate credit card for your digital transactions. While this won’t prevent theft, it will limit your exposure and make online fraud easier to detect.
- Disable Bluetooth, wireless, and Near Field Communications when not in use. This will reduce the risk of thieves intercepting your data. Some stores and other locations also look for devices with wireless or Bluetooth turned on to track your movements while you are within range.
- Use a unique password for each account. Having separate passwords for every account helps to thwart cybercriminals. At a minimum, separate your work and personal accounts and make sure that your critical accounts have strong passwords – and multi-factor authentication if possible.
- Check your credit card and bank statements regularly. These are often the first indicators that your account information or identity has been stolen. If there is a discrepancy, report it immediately. Also check your credit report at least annually. The Federal Trade Commission provides information about getting free credit reports and what to do if you find discrepancies.
- Stay safe with text alerts. Most banking apps and sites provide the option to set alerts, such as a text message for every transaction over a specified dollar amount or a daily text summary of your current balance. Set these alerts to help you spot signs of unusual activity.
- Secure your home Wi-Fi. To prevent eavesdroppers and data thieves, enable strong encryption on your home wireless network – WPA2 is recommended. Set a strong passphrase (12 characters or more), change your network’s name (SSID) from the default to something not obviously belonging to you, and limit who has administrative access to your home network. Finally, log into your wireless router periodically to check for software updates (many home routers don’t auto-update).
- Get savvy about Wi-Fi hotspots and public computers. Treat all Wi-Fi hotspots and public computers as compromised, even if they appear to be safe. Limit the type of business you conduct on them, including logging into key accounts, such as email and banking, and shopping. And set your devices to “ask” before joining new wireless networks so you don’t unknowingly connect to an insecure or fraudulent hot spot.
This list was compiled by the Systemwide Security Awareness Group.