This is a guest post by James Bore
About James Bore
James is a chartered security professional and has worked in IT and security for over two decades. Founder of Bores.com. He covers everything from consulting for enterprises to awareness training for individuals, and teaching children to stay safe online, pick locks, and use secret codes.
Safe Shopping Online
While most internet safety messages talk about phishing, identity theft, and similar attacks, the risks of shopping online often get overlooked. Even when they are spoken about, some of the advice is less than useful.
It’s easy for criminals to build a convincing site, or clone an existing shopping site. One of the key points that’s been repeated over the years is to trust sites which show a padlock. The problem is that all this really means is the site has what’s called an “SSL certificate” to protect your communication with it, not that it’s genuine in any other way.
So, if you can’t trust the technology to prove that a site is genuine, or not, we need to consider other things to watch for.
Check the Site
Emails, texts, and even online adverts may not take you to genuine sites or real offers. If in any doubt, or if the message is unexpected, then going directly to the site, by typing in the website address you’ve used in the past, is always safer. If it’s not a site you’ve used before, search for it by name, and follow the search results. Although be aware that being high in search results does not mean a site is real.
Any time you’re visiting an online shop you haven’t used before, check feedback from independent sites. Consumer review sites are a good source for these. –And while they may still have false reviews they at least try to spot and minimise them. A series of bad reviews, or exclusively overwhelmingly positive reviews with very little commentary, are a sign that you may want to find a different site.
Card Payments
You’ll occasionally see advice about using credit cards for online purchases. –Doing this can be useful, as credit cards provide a degree of protection and allow refunds in certain circumstances. It also means that, unlike a debit card, if your details are stolen then your main bank account isn’t accessible. For better results, use a credit card with the lowest spending limit you can, so that any losses are kept as small as possible in the event of credit card theft.
A guide to credit and debit cards and the Consumer Credit Act 1974.
An alternative to credit cards when you’re concerned with your card details being stolen is ”single-use” cards. Certain “challenger” banks and other services will allow you to create virtual card details to be used once, and then immediately cancelled. Using these means that, even if someone does steal your card details, they won’t be able to use them. They’re also a great option for trial subscriptions if, like me, you tend to forget to cancel.
You can also use online platforms, such as PayPal, Apple Pay or Google Pay, which may provide their own dispute resolution system.
Card payments are also the time when the secure “padlock” in the browser matters. You should never put any card details or other sensitive details into a site without the padlock symbol.
Too Good to be True
With a well-designed scam site, it can be very difficult to tell that it is not genuine. Genuine certificates, domain names which are convincing, cloned content from real branded sites, all of these things can make a fraudulent site highly realistic. It may be possible to work out that the site is fake, if you know what you’re looking for. But spending time researching, reading through source code, checking domain name registrations and other methods takes time. Doing that sort of investigation work every time you’re trying to buy something online is soon going to become frustrating.
Instead of looking into the technical clues and methods for finding out if a site is genuine, there are some other methods to use. It’s worth looking out for any of the signs mentioned below, and building a habit of suspicion and further investigation if you notice them.
Unusual Domain Names
While not a guarantee, it’s worth noting the majority of online shopping sites will have well-recognised domain name endings, such as .com or .co.uk. Anything else shouldn’t necessarily ring alarm bells, but should get you looking carefully for other evidence.
Offers Too Good to be True
Any discount or offer that seems irresistibly generous needs to ring alarm bells. Companies will not to offer 50-80% discounts on products that are in high demand. Fraudsters will use these offers to try and trigger excitement and an emotional response, which limits critical thinking and makes people more likely to buy before they think things through. Any time something seems to be too good to be true, take a minute to step away and give yourself time to process.
View this post on Instagram
Urgency
Another common trick is to try and build in a sense of urgency to convince people to buy. This plays on a bit of human psychology where we are more affected by the potential loss of something, than the potential gain of it. Presenting a limited offer with only a few hours to buy at a huge discount is a very effective way to override critical thinking and convince targets to pay or provide card details before they can become too suspicious.
What Are the Scams?
There are a couple of different scams that these online shops will use. One is simply trying to gather card details, or personal details, to use for identity theft and card fraud. These tend not to be subtle, as they are detected quickly and taken down fairly early on.
The second is a little more careful in its approach, taking payment and never providing the products, or even providing substandard or counterfeit versions. These can last a little longer, as they aren’t detected as quickly, and they will often spend time trying to convince ‘customers’ that there’s some problem with delivery.
Fraud is the fastest growing form of crime in the UK, and the most likely form of theft to affect you. There is a lot of advice available online and it’s worth looking at.
It’s also important if you have encountered any of these frauds to speak about them with the authorities and with family, friends and work colleagues. Reluctance to talk about these crimes is part of what makes them so successful.
While there are laws against it, the under-resourcing of anti-fraud efforts and the extremely low rate of conviction (or even investigation) means that the best method is to be aware of the risks and the signs to watch out for. In short, not to become a victim.
See Unsporting Behaviour in JD Sports data breach regarding data breaches, what they mean for you and what you can do to ptoect yourself and take action if you become a victim of fraud due to it.
