By : Sharifah Roziah Binti Mohd Kassim
Introduction
Nowadays online shopping has become very convenient for Internet users to shop online. They can do the shopping at their homes without having to travel from shop to shop looking for a suitable product or queue in the cashier or get stucked in a traffic jam. The Internet offers a convenience that is not available from any other shopping outlets. Users can search or survey for products they wish to purchase online. They can also make comparisons of the product with other online merchants in terms of price and quality of the product. They can get reviews of the products or the online merchants at various online forums or online discussion groups.
However, with the increasing number of online fraud activities on the net, users must be aware that Internet has also become an avenue for fraudsters to access the personal information or credentials of innocent online shoppers such as username/password, credit card information. The information obtained can be misused for many malicious purposes, such as making illegal online purchases using the stolen credentials like username/password, credit card information belonging to innocent online shoppers or sell the stolen credentials to other fraudsters.
Nevertheless, to minimize the risks or threats associated to online shoppings, Internet users can implement some best practices and preventive measures in order to enjoy a safe online shopping. The best practices and preventive measures are as below:
Best Practices
- Make sure your computer is installed with an Anti-virus Software and is always updated with latest signature files. The Anti-virus software must be enabled for daily automatic updates. Spyware or adware hidden in software programs may also give attackers access to your data, so use a legitimate anti-spyware program to scan your computer and remove any of these files.
- Make sure your computer is running with latest security updates, patches and service packs, that can actually help to eliminate vulnerabilities. You can refer to your vendors for latest upgrades, patches and service packs.
- You must make sure your Internet browser is always upgraded to the most latest version that can correct any bugs or vulnerabilities that may present in older version of your browser. In addition, you need to review the browser's security settings and apply the highest level of security available that still gives you the functionality you need.
- It is best practice to disable pop up messages. You can set up your browser to disable pop-up messages. Most Operating Systems nowadays comes with pop up blocker and it is highly advised to enable the pop up blocker.
- You must create strong password for online account and never use the same password for other online accounts or for other applications, if any. Use at least eight characters, with combination of numbers, special characters, and upper and lower case letters and change the password regularly, for example every six months. Also never share your login and/or password with others.
- Never use public computers to conduct online transactions. Public computers may not be installed with an Anti-virus software or may not be running latest patches or upgrades or latest versions of browsers. Public computer may contain malware that steals your personal information such as your username, password or your credit card information.
- Be extra careful when using public wireless for online shopping. Attackers can monitor public wireless for credit card numbers and other confidential information that they can use for their personal gain. You should not connect to a wireless network without encryption enabled or Wireless Encryption Protocol (WEP) enabled but connect to access point with a strong encryption protocol such as WPA or WPA2 with mutual authentication 802.1 x protocols.
- Users must check the online merchant’s privacy policy. Find out what type of information the online merchant is collecting about you, how it will be used, and if it will be shared or sold to others.
- Make sure the online merchant website uses Secure Sockets Layer (SSL), which encrypts sensitive information. Look for the locked padlock icon at the bottom of your browser window to see if you're protected. If the padlock is closed, the information is encrypted. The location of the icon varies by browser; for example, it may be to the right of the address bar or at the bottom of the window. Some attackers try to trick users by adding a fake padlock icon, so make sure that the icon is in the appropriate location for your browser.
- Evaluate your software's settings. The default settings of most software enable all available functionality. However, attackers may be able to take advantage of this functionality to access your computer. It is especially important to check the settings for software that connects to the Internet (browsers, email clients, etc.). Apply the highest level of security available that still gives you the functionality you need.
- The online merchant you deal with must be reputable, established and trusted. Fake websites can be set up by fraudsters, that looks like the authentic online merchant’s website. This is done with malicious purpose to cheat Internet users. As such you must verify the legitimacy of the online merchants such as their contact information, company registration number or verify with the local Authorities or local Law Enforcement Agencies. You can also look for reviews about the online merchant on the net or you may also call up the online merchant at the contact information given on the website for verification purpose.
- Keep a record of your online transactions, including the product description and price, the online receipt, and copies of every e-mail you send or receive from the seller. Review your credit card and bank statements for unauthorized charges.
- Do additional checkings before purchasing products that are of high demand or expensive such as computers, jewelry, and electronics – require extra caution. This is especially important during the holidays in order to prevent yourself from being cheated of the products.
- If you find any signs of frauds in your online transaction such as delayed shipping or unsolicited offers, we advise you to immediately report the matter to a Law Enforcement Agency such as police for their further investigation together with relevant evident indicating the activity.
- You are also advised to report the online fraud activities to Cyber999 for their further analysis on fraud activities on the net.
To contact Cyber999, please refer at:
Postal Address:
Malaysian Computer Emergency Response Team (MyCERT)
CyberSecurity Malaysia, Level 7 Tower 1,
Menara Cyber Axis, Jalan Impact,
63000 Cyberjaya, Selangor Darul Ehsan, MALAYSIA
Business Hours : Mon - Fri 08:30 -17:30 MYT
Cyber999 Hotline : 1-300-88-2999 (monitored during business hours)
Handphone : +6019 - 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Fax : +603 - 8008 7000 (monitored during business hours)
Email : cyber999 [at] cybersecurity.my
Conclusion
As a conclusion, online shopping can be convenient, enjoyable and most of all safe if best practices as in the above are properly followed and implemented. This will help to prevent and minimize chances for online shoppers to become victims of online fraud activities. By reporting online fraud activities to respective Law Enforcement Agencies, Cyber999 facilitate Investigators/Analysts for further investigations in order to curb fraud activities on the net and provide safe online shopping environment for all Internet users.
References
https://www.msisac.org/awareness/news/2009-11.cfm
https://www.paypal.com/cgi-bin/webscr?cmd=xpt/Marketing/securitycenter/buy/OnlineShoppingTips-outside https://www.cybersafe.my/download/cybersafe/vol02.pdf