Cyber Monday: Dos and Don’ts for Merchants and Consumers

The Friday after Thanksgiving in the United States is referred to as Black Friday. It is the second busiest shopping day of the year, the unofficial beginning of the holiday season, and the day that marks when most retail businesses become financially profitable for the year. Since the early 2000s, the following Monday has been referred to as Cyber Monday. It marks the peak of online sales for the holiday season and recently surpassed brick-and-mortar as the busiest shopping day of the season. Cyber Monday also represents a shift in our next generation digital economy and also another method for thieves to take advantage of unsuspecting buyers and retailers. Hackers and cyber criminals thrive on digital information to propagate their malicious activities, and Cyber Monday has plenty of opportunity to capitalize on unsuspecting buyers. For merchants and consumers, here are a few things to look out for:

DO: Use Unique Passwords for all Online Accounts

When shopping online, and the website requires you to create an account, use a unique password for every site, and do not use the same password as banks, social media, or other retailers. If one location is breached by a cyberattack, then the password cannot be re-used at another location to propagate a crime. Understandably it is difficult to remember all the passwords and users should consider a password manager like Apple’s iCloud Keychain to help create random passwords and remember them automatically.

DO: Examine all “Too Good to be True” Email Offers

The most common attack vector for hackers today is phishing emails. Be aware of fake emails from popular websites with incredible deals. They are probably just a scam linking you to a fake website that looks like the real thing, just to steal your credentials (password) and possibly your credit card too. Always check the URL (link) in the email and make sure it goes to the correct site before clicking on it. You can easily see it by hovering over the picture or right clicking and selecting copy link. Then you can paste it into a browser and verify it is real verses clicking on the link in the email.

DO: Look for Secure Website Encryption

When visiting a web site for a purchase, make sure that when you click on the cart and check out, the website is encrypting the traffic using HTTPS. This ensures no one can snoop on the data you are transmitting or receiving. Checking to make sure the site’s communications are encrypted is as simple as looking for a “pad lock” in the URL browser address field or seeing if HTTP or HTTPS is present with a red hash. If you see the later, avoid purchasing any items since the vendor is not protecting your transactions electronically with encryption. This typically happens with smaller merchants or fake websites designed to steal your information.

DO: Update all Security Patches Before Shopping

Before surfing the web for the best deals, make sure your computer, laptop, tablet, and even cell phone are up to date with the latest security patches and operating system versions. Using search engines to find deals can unfortunately display malicious sites that can take advantage of operating system, browser, and application vulnerabilities like Adobe Flash and Oracle Java. Surfing to the wrong page with an exploit can cause havoc for your system; keeping up to date on patches helps ensure that a fake deal does not compromise your device.

DO: Beware of Fake Shopping Apps

Beware of fake shopping applications for use on your phones and tablets. Both Google and Apple are removing fake shopping applications that attempt to steal information and present fake advertisements from their app stores. These applications can be difficult to spot but here are a few clues:

• If it is an application from a major retailer and has little to no reviews, it is probably a fake. Most major retailers have applications that have been downloaded thousands of times. New fake ones just do not have the credibility in terms of reviews documented and are a simple clue.
• The developer’s name is in a foreign language or is listed by an individual and not a company.
• The application requests permission to access information on your device like photos, text messages or contacts that it really should not have.
• The application logo uses different colors or is not quite the same as the vendor you are looking for. For example, a Starbucks logo is always green and white. Variations would indicate a fake application trying to mimic the real deal.

DO NOT: Store Your Credit Card on Websites

If a website asks if you would like to store your credit card for future purchases, decline the setting. If a breach occurs into their credit card environment, then your card could be re-used by a cyber thief. Some websites like Apple, Amazon, and Microsoft require you to store your card credit in order to purchase products since re-occurring charges can occur for applications or music. Unfortunately, this is a risk we must accept in order to use their services, but in general, if there is no need to store your credit card, then don’t do it. Cyber Monday can offer some huge savings for consumers during the holiday season, and also presents an opportunity for merchants to deliver on customer service. Simple steps can protect you as a consumer and a merchant from the modern threats we face in this next generation digital economy. If you are a merchant and want to better understand the status of your application vulnerabilities or the state of your enterprise passwords, contact us today for a health check!