Buyer Beware: Five Cybersecurity Consumer Tips for the Holiday Season

Last year, news that US retailer Target’s point-of-sale systems were compromised resulting in the theft of more than 40 million payment card numbers hit Australian headlines. A steady stream of breach stories throughout the year further raised awareness of the issue in this part of the world. But given there are no mandatory breach disclosure laws in this country, you may be wondering ‘If my details were stolen, how would I even know?’ Practically speaking, you’re probably thinking ‘What can I do to protect myself this festive season?’

With the silly season quickly approaching, consider me Buddy the Cyber Elf, here to spread Christmas cheer by sharing some simple cybersecurity tips for all to hear.

Buddy the Cyber Elf says you can take simple precautions to make your personal data safer.

1.Be password smart

I am going to share one of my wife’s dirty little secrets … are you ready? She uses the same password for multiple sites. I know, right?

It doesn’t matter how many times I tell her to use different passwords and rotate them, she doesn’t listen. She usually says something like “Why would hackers care about my Pinterest password? Do they want to see what projects I have planned or cupcakes recipe I want to try out?” I calmly and in a totally non-sarcastic manner tell her that it is indeed highly unlikely that hackers want to access her Pinterest account. However, they would like to have her Pinterest credentials because of the likelihood they could use them on other sites that would be a source of financial value.

Human beings are creatures of habit. For example, we all have a favourite coffee cup, we like a particular brand of running shoe (I’m a Brooks man myself), put on our pants with the same leg first every time (left leg for me), and towel dry after a shower or bath in the same pattern (that’s personal). This is basic human behaviour. Hackers know this, and fully expect (and even count on) people to use the same credentials on sites like Pinterest as they do for online banking site, PayPal, Facebook or online gaming. So by harvesting credentials from softer, low-value targets, they will gain valuable intelligence that will allow them to compromise harder, higher-value targets.

To combat this type of attack, don’t use the same password over and over again on multiple sites. Some good tips are to pick a theme, and use word permutation. For example, in the past I have used comic book character names and phrases, and I’ve replaced letters with numbers or special characters. This concept yields passwords like W0!v3r3neSn1kt, H@mmer0fTh0r!, L0n3w0lfandCub!, Th3Gr33nLant3rn and Th3Sh@d0wkn0ws. These are much easier to remember than random strings of letters and numbers, and you can easily rotate them every 90 days (there are plenty of comic book characters to choose from).

You might also use a password journal or a tool like Password Safe or KeePassX. These resources will aid you in maintaining passwords and other personal security information, but remember that they become a single point of failure—so don’t drop your password journal on the bus.

2. Use credit cards instead of debit cards

During payment card transactions, the point-of-sale (POS) or ecommerce systems don’t make a distinction between debit and credit card numbers. If you are conducting a “card present” transaction (meaning you are in physical possession of the card and swiping it at a payment terminal), the data the terminal reads is the same whether you run the transaction as a credit or debit purchase. With both debit and credit transactions in Australia, the POS terminal requires your personal identification number (PIN) for authorisation. (I don’t want to frighten you too much, but if the POS terminal has been compromised, your PIN is also susceptible to theft).

For ecommerce or card-not-present transactions (meaning the vendor does not physically have the card in their hands), the only information the vendor usually needs is the primary account number (PAN), the expiration date, and a card verification code (the little three-digit number on the back of Visa, MasterCard, and Discover cards, and the four-digit code on the front of American Express cards). I say “usually” because some ecommerce sites only require the PAN and the expiration date.

So, if you use your debit card to do your holiday shopping, and one of the places you shopped at gets breached, your debit card number will be taken. If attackers use that number fraudulently, the money will be GONE from your bank account. The bank will eventually refund it to you, but it can take weeks or longer, depending on the holidays and the number of refunds they have to do. In contrast, it is exponentially easier for a credit card company to make the necessary adjustments to your credit card balance, which does not require an electronic transfer of funds to your bank account. These refunds are generally faster than debit card adjustments and more importantly, do not impact your bank balance.

3. Check your statement daily

While each of the major card brands and most banks have fraud monitoring systems, they must parse through massive amounts of data from every cardholder in the world. Additionally, carders (hackers who steal, buy, sell, and exploit stolen payment card data) build intelligence into their fraud execution patterns to try and avoid detection. This has proved a significant challenge for financial institutions.

You can speed up this process by checking your account transaction logs daily during the holiday season. Just about every bank provides internet banking and a mobile application, so doing this has become pretty simple. You know where you shop and what you buy. So if a transaction appears that you are not familiar with, call your bank’s fraud hotline (the number is usually printed on the back of your card) immediately. Who knows, you may be one of the first people to report the fraud and help the authorities catch some bad guys!

4. Track your packages

As more consumers do more shopping online, shipping theft has become a very common and lucrative crime. Criminals monitor neighbourhoods to determine when courier companies make deliveries and when people leave to go to work, take kids to school, etc. Then, when the deliveries are dropped off at the door, they swoop in behind the trucks and swipe the packages.

Preventing this type of crime isn’t rocket science. Pay attention to when packages are scheduled to be delivered and make sure somebody is home to receive them. If you can’t be there, ask a friend or a neighbour to watch for deliveries and pick them up for you. Also, be aware of vehicles that don’t seem to belong in your neighbourhood and report any suspicious activity to your local police.

5. Anticipate a breach and change your passwords and cards after the holidays

Based on the number of payment card breaches recently, there is a high probability that more will follow this holiday season. Assume that somewhere you shop or dine will be breached. Change your passwords for your financial service providers and, though it may seem a little extreme, think about proactively requesting new cards for whichever cards you used for your holiday shopping. This will be inconvenient and require some effort, but if you plan for it you can make the changes with relative ease.

Unfortunately, none of these suggestions is 100% guaranteed to prevent a data breach or stop you becoming a victim of payment card fraud. But they will decrease the chances and help to lessen the impact on you. The responsibility for protecting your data is in the hands of merchants and service providers. Hopefully they are doing their due diligence and being responsible custodians of your information.

Have a safe, happy, and healthy holiday season!

This article is brought to you by Enex TestLab, content directors for CSO Australia.