Introduction

Online shopping offers people comfort and saves time. That is why it is prevalent. Especially since the coronavirus outbreak, online shopping has played an essential role in our lives.

Credit card fraud has increased in online platforms because these platforms are used more. Attackers develop new attacks to gain information about the customers or directly profit from the credit cards. Of course, companies are taking measures, but this is not a game with two players. Customers should also protect themselves and their credit cards from attackers.

Measures to Be Taken

Suppose you are doing a process (online shopping or online banking), and here is what you can do for the safety of your credit card.

Before Process:

Use antivirus software and keep your systems up-to-date.
Get one card and make an online purchase from that card. In this way, you will risk only one credit card. Then, monitor that card’s activity and call the credit card vendor if there is suspicious activity.
Do the configuration that sends a message after each purchase. By doing that, you can automatically be informed when someone uses your credit card.
Some banks offer a particular credit card for online processes. That will make it easier to monitor the activities done by that card. You can buy one of those cards.
Strong authentication is essential (for both credit cards and websites where you use your credit card). Select a password that is not related to your personal life. Make them as complicated as you can. If you are concerned about forgetting your passwords, you can use a password manager or a password database. You should update your authentication information periodically.

During Process:

Some e-commerce sites provide purchases as a guest. That means you do not have to create an account. This will save you from entering information into the account profile.
A website that you shop online may offer you to keep the credit card information on the website. You must decline that offer and enter the required information again and again each time you shop online.
Do not forget to check whether the website uses HTTPS instead of HTTP. The ‘s’ comes from ‘secure,’ and HTTPS encrypts your network traffic, unlike HTTP. Fraudsters may be watching your network traffic. If they encounter encrypted content, they will not be able to get valuable information out of it.
Do not log in to a website or do online shopping while connected to a public network. It is easy to watch network traffic going on the same network. Attackers might be connected to the same network and steal your information.
You can use virtual credit card numbers if it is provided by your bank. A virtual credit card number is a temporary number that you can use for your online process immediately. This gives you privacy.

Attacks to Gain Credit Card Information

Magecart Attack

This attack generally targets the websites where the users use their credit cards, but attackers can target other websites for other valuable credentials of users too. The main idea behind this attack is to inject malicious Javascript code into the source code of the website and get critical information from the customers.

How do attackers make magecart attack? Here are the common steps:

1. Attackers initially compromise the target.

2. Attackers can inject malicious code into the place of the favicon code, HTML comments, or other parts of the source code. Another way of doing that is by injecting malicious code into third-party scripts. When the relevant page or script is called, the malicious code runs.

3. When the relevant page or script is called, then the malicious code scans the page and looks for the purchase form. As the user enters credentials, the malicious code collects them.

4. The last job is that the collected information should be sent to the attacker.

BIN Attack

BIN (Bank Identification Number) is the first six or four digits of the credit card number, and it indicates which bank that card belongs to. Other numbers are randomly generated numbers for each user, and those numbers are unique to users.

BIN numbers can be found from several sources (e.g., infiltrated credit card information on illegal websites) by the attacker, and continued parts can be generated by a script. The attacker can put the newly generated card number into a credit card validation test and see if it is a valid credit card or not. This validation process can be done from some websites. These websites can be found by simply searching them on the internet. The attacker can continue until a valid credit card is found and use that card information for financial gain.

Phishing Attacks

Phishing attacks are very common and easy to do for attackers. Attackers could try to deceive you so that they can harvest your information. You should be aware of phishing attacks and not purchase anything by clicking a link from an email or a message. If you see an email or a message having a discount by clicking a link, do not click it. Serious companies do not have campaigns like that. If you want to be more aware of phishing emails, you can read the blog post here.

How to Understand If Your Credit Card is Stolen?

You might have taken the measures, but attackers could get your credit card information somehow. Detecting if your credit card is used by other people is crucial for stopping your money from being spent.

Here are some detection tips:

Your card might be rejected while making a payment.
There might be some purchases in your process history that you cannot remember.
An error that indicates you exceeded your credit card limit may come to you.

What to do After a Credit Card Fraud?

Generally, banks will call you if something is suspicious (e.g., a purchase is made from a distant location). However, there could be a situation where bank personnel could not detect fraud, but you did. Here are what you should do after then:

Inform your credit card vendor to stop the activities of your credit card.
Inform police to begin the investigation.
If a purchase has been made from an e-commerce site, contact the support team of that site.
Change your passwords (for both credit card and online accounts).

Conclusion

Financial gain is one of the main motivations behind cyber attacks. Therefore, credit card fraud plays an essential role in the aim of cyber criminals. Online shopping is an inevitable need today. We must shop online with awareness of possible attacks and security measures.

C&C credit card fraud