Online card skimming detections increased by 150% from May to November 2021.
Cybercrime is a well-tuned machine that costs trillions of dollars annually. On sites on the dark web, hidden from law enforcement and the majority of consumers, cybercriminals buy and sell vast amounts of stolen data and whatever tools are needed to acquire it.
"It is estimated that such websites are circulating today 24 billion usernames and passwords obtained illegally” says Phil Muncaster from the team at global digital security company ESET.
Among the most sought after are bank card data, which are then purchased en masse by fraudsters to carry out identity fraud.
In countries that have implemented chip and PIN systems (also known as EMV), it is difficult to convert this data into cloned cards. Thus, they are commonly used online in card-not-present (CNP) attacks. Fraudsters use them to buy luxury goods and sell them, or potentially buy gift cards in bulk – another popular way to launder illicit funds. It is difficult to estimate the size of the market for these cards. However, the operators of the world's largest illegal market recently "retired" after first collecting around US$358 million.
With that in mind, Muncaster from ESET summarizes the five most common ways hackers can get your credit card data – and how to stop them:
Table of Contents
Phishing
Phishing is one of the most popular techniques used by cybercriminals to steal personal information from consumers. At its simplest, it's a scam in which the hacker masquerades as a reputable entity (eg a bank, e-commerce provider, or technology company) to trick you into revealing your personal information or downloading a unknowingly some malware.
They often encourage users to click on a link or open an attached file. Sometimes this leads the user to a phishing page – where they will encourage you to enter personal and banking information. Phishing is said to have reached an all-time high in the first quarter of 2022.
And of course, these scams have evolved in recent years. Instead of an email, today you may receive a malicious text message (SMS) from a hacker pretending to be from a company, government agency, or other trusted organization.
Scammers may even call you, again pretending to work for a reputable source, in order to obtain your card details. SMS phishing (smishing) more than doubled year-on-year in 2021, while voice phishing (vishing) also skyrocketed, according to estimates.
Malware
Cybercrime is a huge market, not only for personal data but also for malware. Over the years, various types of malicious code have been designed to steal information. Some record your keystrokes – for example, as you enter your card details on an e-commerce or banking website.
How do cybercriminals get these tools onto your machine? Emails or phishing emails are a popular method. Malicious online advertisements are another method. In other cases, they may hack popular websites and wait for users to visit them.
Drive-by-download malware is installed as soon as you visit the compromised website. Information-stealing malware is also often hidden inside malicious mobile apps that look legitimate.
Digital skimming
Sometimes hackers install malware on payment pages on e-commerce websites. This is invisible to the user, but intercepts your card details as you type them.
There isn't much that users can do to stay safe, except to only shop from known companies and websites, which are likely to be more secure.
Online card skimming detections increased by 150% from May to November 2021.
Violations of data
Sometimes hackers steal card details directly from the companies you work with. It could be a healthcare provider, an e-commerce store, or a travel agency.
This is a more efficient course of action on the part of hackers, because with one attack they gain access to a huge amount of data at once, whereas with phishing campaigns they have to steal from people one by one – although these attacks are usually automated.
The bad news is that 2021 was a record year for data breaches in the US.
Public Wi-Fi
When you're out and about, it can be tempting to surf the web for free using public Wi-Fi hotspots – in airports, hotels, coffee shops and other public places.
Even if you have to pay to access the network, it may not be safe if hackers have done the same. They can use this access to steal your information as you type it.
How to keep your credit card information safe
Fortunately, there are many ways to reduce the risk of your card details being stolen.
Phil Muncaster from ESET summarizes some basics to get you started:
• Be vigilant: never reply to spam emails, click on links or open attachments. They may be riddled with malware. Or they could lead you to phishing pages where they encourage you to enter your details.
• Don't divulge details over the phone, even if the person you're talking to sounds convincing. Ask where they are calling you from and then call that organization back to check – and don't use the contact numbers they give you.
• Do not use public Wi-Fi networks, especially without using a virtual private network (VPN). If you need to use a public Wi-Fi network, don't do anything that requires entering your card details (eg online shopping).
• Do not store your card details on online shopping or other websites, even though this helps save time on future visits. This will reduce the chances of your card details being taken if that company is breached or if your account is compromised.
• Install anti-malware software, including anti-phishing protection, from a trusted vendor on all laptops and other devices.
• Use two-factor authentication on all sensitive accounts. This reduces the chances of them being compromised by hackers with stolen passwords.
• Download applications only from legitimate stores (Apple App Store, Google Play).
• If you shop online, only shop on websites with a secure HTTPS connection (a padlock should appear in your browser's address bar next to the URL). So there is less chance of data interception.
Finally, it's good practice to keep track of all your bank and card accounts.
If you spot any suspicious transactions, notify the bank immediately. Some apps now allow you to "freeze" all spending on specific cards until you determine if there has been a security breach.
There are many ways criminals can get hold of our card details, but there's also plenty we can do to keep them at bay.
