What do the California State Controller’s Office, Hobby Lobby, Cancer Treatment Centers of America, Facebook, LinkedIn, Clubhouse, and ParkMobile have in common? According to IdentityForce, these seven entities, which include California’s independent fiscal watchdog, a few social networks and a contactless-payment parking app, were all subjected to major security breaches in the last month — and these are just the ones we know about so far.
In the past 30 days, breaches involving those seven entities resulted in the personal information of over 1 billion people being sold by criminals to other criminals. This includes 104,808 patients whose medical information was accessed by an unknown third party, over 500 million LinkedIn user profiles sold on the dark web and another 21 million customer records belonging to ParkMobile being exposed due to a third-party vendor’s software vulnerability.
Be aware that no reputable company is going to send an email requesting you provide them with your account login information.
The methods used in these breaches ranged from phishing scams, such as compromised emails and employees clicking on malicious links, to more sophisticated methods, such as accessing unsecured databases or discovering a cloud bucket misconfiguration.
You may be thinking that your small business is safe, that no one is going to spend the time going after your small business; unfortunately, this is not the case. In 2019, it was reported that on average, retailers experience 206,000 web attacks a month.
If you have ever watched a TV show about prison life, you probably remember hearing guards complain that inmates have nothing to do all day but plan how to inflict harm on the guards or other inmates. Well, the criminals hacking your email and scraping your databases are in the same boat; they have more time to spend figuring out how to compromise your business than you have to fight it, and they are profiting from it beyond the immediate identifiable losses you are suffering. Loss of consumer trust is hard to calculate and even harder to recover from.
While it may seem that preventing credit fraud is a daunting task, consider how the saying “Locks keep honest people honest” equally applies to online credit fraud. It only makes sense that your rookie hacker is going to go for the low-hanging fruit, such as a website that has a join page for a new social network or an order page for a product or service that is not protected by an SSL (Secure Sockets Layer) Certificate.
You might think that folks would know the value of having an SSL Certificate for their website these days, but far too often this is not the case. For anyone unsure about how to tell if a page has an SSL Certificate or not, if the URL begins with “http://” there is no SSL Certificate. If the URL begins with “https://” then the domain has an SSL Certificate.
If you are unclear as to whether or not you need an SSL Certificate yourself, it’s important to know that it can protect your website from phishing scams, data breaches and other threats. Besides that, they are inexpensive (sometimes free, depending on your web host), and they are absolutely necessary if you want to maintain your Payment Card Industry (PCI) compliance.
Additionally, when accepting payments online, you must be sure that your payment gateway is set up to detect such things as the IP address the order is coming from so that other checks, such as the matching of the country code with the telephone number or zip code, can be verified.
One should not be fooled by the amount of the purchase either; speaking from personal experience, these criminals will often begin by making a small purchase just to test if they have the proper information to guarantee the purchase goes through.
Some things are just better left to the professionals; utilizing a reputable merchant processing company that will ensure your company is PCI-compliant is a great step in minimizing fraud for your business. After all, you have likely heard the phrase “Charity begins at home,” but so does stopping credit fraud.
Speaking of home, the same California State Controller’s Office employee who clicked that link in the phishing attack could just as easily have fallen prey to such an attempt in their own home. The reality is, overall, most people are pretty lackadaisical about home internet security, frequently blaming the big social networks and corporations for their personal information being found available for purchase on the dark web. While these companies certainly deserve some blame, when the consumer uses the same easy-to-figure-out password for every internet site they log in to, it does not help things at all.
The same rules you apply at work, and that you hope merchants are applying when handling your data, should be applied at home. Do not click on links from people or companies you do not trust implicitly. Be aware that no reputable company is going to send an email requesting you provide them with your account login information. If you are ordering socks from a third-party vendor on Amazon and they ask for your social security number, back out.
We may not be able to eliminate credit fraud, but if everyone uses the tools available and a little common sense, we can certainly minimize the damage.
Jonathan Corona has 15 years of experience in the electronic payments industry. As MobiusPay’s COO, Corona is primarily responsible for day-to-day operations as well as reviewing and advising merchants on a multitude of compliance standards set forth by the card associations. MobiusPay specializes in merchant accounts in the U.S., EU and Asia. Follow them @MobiusPay on Twitter, Facebook and IG.
