How
to Stay
Cyber Safe This Holiday Season
With
the holiday season upon us, it is important to maintain awareness of
the many threats posed by cyber-criminals this time of year
As
the popularity of online shopping continues to increase, so does the
number of potential unsuspecting victims for cyber-criminals to
exploit. Scammers may target victims through a variety of methods,
including via emails, compromised websites, spoofed websites, phone
calls, text messages, or unsecured Wi-Fi networks. To help combat the
threats posed aby cyber-criminals this holiday season, review the following list of common scams, tips, and best practices:
Be
Wary of Links and Attachments in Unsolicited Emails
Around
the holidays, users may receive emails from known retailers regarding
sales and coupons, or claiming to be order confirmations or shipping
notices. Cyber-criminals can easily steal retailer branding to make
fraudulent emails appear legitimate and may contain links or
attachments that install malware or lead recipients to spoofed
websites that steal user credentials. These emails may attempt to
convey a sense of urgency - Limited Time Offer! - to prevent users
from thoroughly inspecting the email for red flags. Users are advised
to navigate directly to retail websites by typing the legitimate URL
into their browser instead of clicking on links in emails, and
refrain from entering login credentials on websites visited via a
link in an email.
Avoid
Pop-Up Advertisements and Shortened URLs
Users
are encouraged to use pop-up blockers to avoid unintentionally
clicking on a pop-up ad that could introduce malware onto their
system. Additionally, URL shorteners can be employed to trick users
into visiting a malicious website. URL shorteners are often used on
social media sites and other outlets to save space and for visual
appeal. Users are advised to use a URL expander to reveal the true
destination of shortened URLs prior to visiting the site.
Look
Out for Holiday-Themed eCards and Messages Meant to Install Malware
In
the past, users reported being targeted with various Thanksgiving
Day-related scams. In some cases, spoofed emails were sent appearing
to originate from legitimate organizations and contained the subject
line “Thanksgiving
eCard.”
Additionally, an Emotet banking trojan campaign was observed using
Thanksgiving lures, such as the subject lines “Happy
Thanksgiving Day Greeting Message”
and “Thanksgiving
Day Card.”
As malicious actors commonly leverage public interest during the
holiday season to conduct financial fraud and disseminate malware,
users are reminded to exercise caution with unexpected or unsolicited
emails, especially those with a holiday theme.
Do
Your Online Shopping at Home
Avoid
using public computers, such as those at a library or hotel, or
public Wi-Fi connections to log into personal accounts or conduct
online shopping. Public computers could be infected with malware
designed to steal your information and hackers can intercept network
traffic traveling over unencrypted Wi-Fi signals. If you must connect
to public Wi-Fi, use a virtual private network(VPN), to secure
information transmitted between your device and the internet.
Additionally, users are advised to refrain from using work computers
to make online purchases, as cyber threats could endanger company
and/or customer information.
Enable
Multi-Factor Authentication (MFA) on All Accounts
Be
sure to enable MFA
(authentication
by combining at least two of the following: something you know,
something you have, and something you are) on every account that
offers it as this will greatly reduce the risk of account compromise
via credential theft. Even if a cyber-criminal obtains a user’s
username and password, they will be unable to access that user’s
account without their second factor. We
encourages
users to choose authentication apps, hardware tokens, or biometrics
as a second factor over SMS-based authentication, due to the risk of
SIM-swapping.
The website TwoFactorAuth.org maintains a comprehensive list of
websites that offer MFA.
Choose
Credit Over Debit
When
shopping online or at stores that do not yet support chip-and-PIN
payments, it is advised to use credit cards over debit cards. While
both payment methods pose a risk if compromised, debit cards do not
carry the same consumer protections as credit cards, which limit the
victim’s liability if fraudulent purchases are made using their
payment card data. Magecart
attacks,
in which malicious code is injected into online payment webpages, are
becoming more prevalent as the opportunity to steal payment card data
from physical point-of-sale terminals has diminished.
Avoid
Connecting Devices to Public Charging Stations
Public
charging stations supplied with power cables or USB ports located in
stores, airports, libraries, and schools may seem like a convenient
way to charge your mobile devices on-the-go, but can you be sure that
your device and data will be safe if you connect? These kiosks can
contain concealed computers that attempt to extract data such as
contact information, photos, and videos from connected devices,
unbeknownst to the users. Additionally, malicious or compromised
charging stations can expose devices to the risk of a malware
infection. Even if the charging station is not malicious, the
manufacturer or owner of the kiosk may require users to input their
email addresses or phone numbers in order to charge their devices,
potentially exposing them to unwanted marketing campaigns, phishing
emails, and scam calls.
Verify
Charities Before Donating
It
is common around the holidays to donate to charities, particularly
those that provide goods and/or services to those individuals in
need. Users may be prompted to donate via solicitations received
through email or social media; however, these may be promoting fake
charities or impersonating legitimate charities. Prior to donating,
ensure you are visiting the charity’s legitimate website to donate.
Beware
‘Secret Sister’ Gift Exchange Scam
Many
people enjoy participating in group gift exchanges this time of year,
however, beware of potential scams. Social media posts promoting a
“SECRET SISTER" gift exchange has resurfaced recently, promising between 6 and 36
gifts in exchange for sending one gift. While this type of
chain-letter appears innocent, it is actually illegal and considered
a pyramid scheme. The scam begins by requesting the name and address
of the recipient and their friends. This holiday season only
participates in gift exchanges with individuals you know personally
and refrain from sharing too much personal information online.
