How to Stay Cyber Safe This Holiday Season

How to Stay Cyber Safe This Holiday Season

With the holiday season upon us, it is important to maintain awareness of the many threats posed by cyber-criminals this time of year As the popularity of online shopping continues to increase, so does the number of potential unsuspecting victims for cyber-criminals to exploit. Scammers may target victims through a variety of methods, including via emails, compromised websites, spoofed websites, phone calls, text messages, or unsecured Wi-Fi networks. To help combat the threats posed aby cyber-criminals this holiday season, review the following list of common scams, tips, and best practices:

Be Wary of Links and Attachments in Unsolicited Emails

Around the holidays, users may receive emails from known retailers regarding sales and coupons, or claiming to be order confirmations or shipping notices. Cyber-criminals can easily steal retailer branding to make fraudulent emails appear legitimate and may contain links or attachments that install malware or lead recipients to spoofed websites that steal user credentials. These emails may attempt to convey a sense of urgency - Limited Time Offer! - to prevent users from thoroughly inspecting the email for red flags. Users are advised to navigate directly to retail websites by typing the legitimate URL into their browser instead of clicking on links in emails, and refrain from entering login credentials on websites visited via a link in an email.

Avoid Pop-Up Advertisements and Shortened URLs

Users are encouraged to use pop-up blockers to avoid unintentionally clicking on a pop-up ad that could introduce malware onto their system. Additionally, URL shorteners can be employed to trick users into visiting a malicious website. URL shorteners are often used on social media sites and other outlets to save space and for visual appeal. Users are advised to use a URL expander to reveal the true destination of shortened URLs prior to visiting the site.

Look Out for Holiday-Themed eCards and Messages Meant to Install Malware

In the past, users reported being targeted with various Thanksgiving Day-related scams. In some cases, spoofed emails were sent appearing to originate from legitimate organizations and contained the subject line “Thanksgiving eCard.” Additionally, an Emotet banking trojan campaign was observed using Thanksgiving lures, such as the subject lines “Happy Thanksgiving Day Greeting Message” and “Thanksgiving Day Card.” As malicious actors commonly leverage public interest during the holiday season to conduct financial fraud and disseminate malware, users are reminded to exercise caution with unexpected or unsolicited emails, especially those with a holiday theme.

Do Your Online Shopping at Home

Avoid using public computers, such as those at a library or hotel, or public Wi-Fi connections to log into personal accounts or conduct online shopping. Public computers could be infected with malware designed to steal your information and hackers can intercept network traffic traveling over unencrypted Wi-Fi signals. If you must connect to public Wi-Fi, use a virtual private network(VPN), to secure information transmitted between your device and the internet. Additionally, users are advised to refrain from using work computers to make online purchases, as cyber threats could endanger company and/or customer information.

Enable Multi-Factor Authentication (MFA) on All Accounts

Be sure to enable MFA (authentication by combining at least two of the following: something you know, something you have, and something you are) on every account that offers it as this will greatly reduce the risk of account compromise via credential theft. Even if a cyber-criminal obtains a user’s username and password, they will be unable to access that user’s account without their second factor. We encourages users to choose authentication apps, hardware tokens, or biometrics as a second factor over SMS-based authentication, due to the risk of SIM-swapping. The website TwoFactorAuth.org maintains a comprehensive list of websites that offer MFA.

Choose Credit Over Debit

When shopping online or at stores that do not yet support chip-and-PIN payments, it is advised to use credit cards over debit cards. While both payment methods pose a risk if compromised, debit cards do not carry the same consumer protections as credit cards, which limit the victim’s liability if fraudulent purchases are made using their payment card data. Magecart attacks, in which malicious code is injected into online payment webpages, are becoming more prevalent as the opportunity to steal payment card data from physical point-of-sale terminals has diminished.

Avoid Connecting Devices to Public Charging Stations

Public charging stations supplied with power cables or USB ports located in stores, airports, libraries, and schools may seem like a convenient way to charge your mobile devices on-the-go, but can you be sure that your device and data will be safe if you connect? These kiosks can contain concealed computers that attempt to extract data such as contact information, photos, and videos from connected devices, unbeknownst to the users. Additionally, malicious or compromised charging stations can expose devices to the risk of a malware infection. Even if the charging station is not malicious, the manufacturer or owner of the kiosk may require users to input their email addresses or phone numbers in order to charge their devices, potentially exposing them to unwanted marketing campaigns, phishing emails, and scam calls.

Verify Charities Before Donating

It is common around the holidays to donate to charities, particularly those that provide goods and/or services to those individuals in need. Users may be prompted to donate via solicitations received through email or social media; however, these may be promoting fake charities or impersonating legitimate charities. Prior to donating, ensure you are visiting the charity’s legitimate website to donate.

Beware ‘Secret Sister’ Gift Exchange Scam

Many people enjoy participating in group gift exchanges this time of year, however, beware of potential scams. Social media posts promoting a “SECRET SISTER" gift exchange has resurfaced recently, promising between 6 and 36 gifts in exchange for sending one gift. While this type of chain-letter appears innocent, it is actually illegal and considered a pyramid scheme. The scam begins by requesting the name and address of the recipient and their friends. This holiday season only participates in gift exchanges with individuals you know personally and refrain from sharing too much personal information online.

Posted in: