Credit Card Information Safety

Why Card Safety Matters When You Shop Online

Online shopping offers people comfort and saves time. That is why it is so common. Especially since the coronavirus outbreak, online shopping has played a big part in our lives.

As more people shop online, attackers follow them there. They build new attacks to steal customer data or to profit from the cards directly. Of course, companies take measures, but this is not a game with two players. Customers should also protect themselves and their credit cards from attackers.

Measures to Be Taken

Suppose you are shopping or banking online. Here is what you can do to keep your credit card safe.

Before Process:

• Use antivirus software and keep your systems up-to-date.
• Get one card and make your online purchases with that card. In this way, you will risk only one credit card. Then, monitor that card’s activity and call the card issuer if there is suspicious activity.
• Turn on the setting that sends a message after each purchase. That way, you will know straight away when someone uses your credit card.
• Some banks offer a particular credit card for online purchases. That will make it easier to monitor the activities done by that card. You can get one of those cards.
• Use a long, unique password for each site, ideally from a password manager. Turn on multi-factor authentication for your bank and your shopping accounts. Change a password straight away if it may have been exposed. Forced periodic changes are no longer advised, as NIST SP 800-63B explains.

During Process:

• Some e-commerce sites let you buy as a guest. That means you do not have to create an account. This saves you from storing your details in an account profile.
• A website where you shop may offer to keep your credit card information. You should decline that offer and enter the details again each time you shop.
• Check that the website uses HTTPS instead of HTTP. HTTPS encrypts the data between you and the site, so people watching the network cannot read it. But HTTPS does not prove the site is genuine. The US Federal Trade Commission (FTC) warns that scammers also encrypt their fake websites, so check the web address carefully.
• Prefer your mobile data or a trusted network for payments. The FTC says public Wi-Fi is usually safe today because most sites use encryption. On public Wi-Fi, use only HTTPS sites. Watch out for fake hotspots with look-alike names, and keep your device updated.
• You can use virtual credit card numbers if your bank provides them. A virtual credit card number is a temporary number that you can use for your online purchase straight away. This gives you privacy.

Attacks to Gain Credit Card Information

Magecart Attack

This attack generally targets the websites where users pay by card, but attackers can target other websites for other valuable user credentials too. The main idea is to inject malicious JavaScript code into the website’s source code and steal what customers type. One example is the Magecart e-skimmer attacks on US restaurants.

How do attackers carry out a Magecart attack? Here are the common steps:

1. Attackers initially compromise the target.

2. Attackers can inject malicious code into the place of the favicon code, HTML comments, or other parts of the source code. Another way of doing that is by injecting malicious code into third-party scripts. When the relevant page or script is called, the malicious code runs.

3. When the relevant page or script is called, then the malicious code scans the page and looks for the purchase form. As the user enters credentials, the malicious code collects them.

4. The last job is that the collected information should be sent to the attacker.

BIN Attack

The BIN (Bank Identification Number, also called IIN) is the first six or eight digits of the card number. It identifies the bank that issued the card. Visa and Mastercard began assigning eight-digit BINs in April 2022. The remaining digits identify the account, and the last digit is a check digit.

Attackers can find BINs in several places, such as stolen card data sold on carding forums and sites. A script then generates the rest of the card number.

The attacker puts each new card number through a card validation test to see if it is valid. Some websites can be used for this test, and they are easy to find online. Our glossary entry on the BIN attack shows how banks and merchants detect it.

The attacker can continue until a valid credit card is found. Then they use that card information for financial gain.

Phishing Attacks

Phishing attacks are very common and easy for attackers to carry out. Attackers try to trick you so that they can harvest your information.

Be careful with any purchase you start by clicking a link in an email or a message. Scammers often copy real brands’ discount emails. Open the shop’s site or app yourself instead of clicking the link.

If you want to learn how to spot phishing emails, you can read our guide to detecting phishing emails.

How to Tell If Your Credit Card Is Stolen

You might have taken the measures, but attackers could still get your credit card information. Detecting if other people use your credit card is key to stopping them from spending your money.

Here are some detection tips:

• Your card might be rejected while making a payment.
• There might be some purchases in your history that you cannot remember.
• You may get an error saying you went over your credit card limit.

What to Do After Credit Card Fraud

Generally, banks will call you if something is suspicious (e.g., a purchase is made from a distant location). However, bank staff may miss a fraud that you notice. Here is what you should do then:

1. Tell your card issuer straight away, so it can block the card. Report quickly: in the US, the FTC says the most you may owe for unauthorized credit card charges is $50.
2. Inform the police so they can begin an investigation. In the US, if your identity was also misused, IdentityTheft.gov from the FTC gives you a report and a recovery plan.
3. If a purchase has been made from an e-commerce site, contact the support team of that site.
4. Change your passwords (for both credit card and online accounts).

Shop Online With a Plan

Financial gain is one of the main motives behind cyber attacks, so credit card fraud is a common goal for criminals. Online shopping is part of daily life today. Use one card for online purchases, turn on payment alerts and call your bank as soon as you see a charge you did not make.