With the holiday shopping season in full swing, more than 174 million Americans shopped online and in stores from Black Friday to Cyber Monday. That weekend may be in the past, but there are still plenty of opportunities for threat actors to exploit poor cybersecurity practices.

As retailers continue to push out deals to consumers over the next month, fraudsters will seek opportunities to breach personal information, spread malware and prey on the abundance of data being shared during the hectic holiday season. For example, in 2016, researchers from IBM X-Force identified a phishing campaign that sent emails from an address that appeared to be from Amazon.com. The emails contained fake tracking numbers and attachments to embed ransomware onto users’ computers.

When using mobile payments, online shopping, or setting up new technology and devices, organizations and consumers alike should be hypervigilant to keep their networks and information safe.

Our elite team of security professionals, IBM X-Force, is monitoring malicious activities closely — not only during the shopping season, but 24 hours a day, seven days a week, 365 days a year — to help customers, fellow researchers and the public better understand the latest security risks and stay ahead of emerging threats.

Online Shopping Safety Tips for the Holiday Season

The X-Force team, which manages 35 billion events per day, offered the following tips to help organizations and consumers keep their information and networks safe while shopping online during the 2017 holiday season.

Safeguard Credit/Debit Information

When taking advantage of those holiday deals, never save credit or debit card information on retail sites or in your web browser. Always look for the green lock icon in the browser address bar to ensure a secure connection to websites.

Pass the Phrase, Please

While shopping online, use different passphrases for each site and be sure to mix letters, numbers, special characters and even spaces. For example, “H0w D1d I G3t Stuck In Th1s Ch1mney?” or “Two:Billi0n CO0kies & Glasses 0f Milk!” You can also use a password manager to store passphrases in a digital vault so you don’t have to memorize them on your own. In addition, never use the same passphrase as your email account.

Email Scammers Don’t Take Holiday Vacations

Scammers often prey on the surge of online shopping to send fake emails that look like customer service follow-ups. Make sure to pay extra attention to emails that look suspicious. When in doubt, go directly to the trusted retail site instead of clicking on potentially malicious links.

Security Recommendations for Connecting New Devices

The X-Force team also recommends taking the following security precautions when setting up new devices.

Don’t Forget the Batteries

A decade ago, batteries were the biggest concern — but before the kids start unwrapping, don’t forget to secure those smart devices. Many of today’s toys need software updates, patches and configuration of permissions before use. Drones, robots and even connected teddy bears may require access to video, audio and social media platforms and should be configured to limit your family’s exposure appropriately.

Protect Devices From Themselves

Before connecting any new technology to a home network this holiday season, make sure the router is protecting devices that can’t protect themselves. By using a Domain Name System (DNS) service such as Quad9 at the router level, any smart device that requires internet access is provided with additional security and privacy automatically.

Prevent Personal Assistants From Snooping

Thinking about introducing a virtual assistant to your household? Be sure to mute the microphone on the assistant when not in use, and avoid linking any important bank or credit accounts to the device.

Get Creative With Security Questions

When setting up those new tech gifts, opt for security and password reset questions that aren’t public to make it harder for fraudsters to get their hands on your information. For example, don’t use your mother’s maiden name, which could be easily found online. Even answers to opinion-based questions, such as favorite movie or food, can be found on social media. For increased security, lie about your answers or use passphrases as the answers.

Be Open to Biometrics

Before firing up new phones and tablets, consider implementing biometric authentication, which uses physical characteristics such as fingerprints or behavioral characteristics such as voice recognition. Biometrics and two-factor authentication add a layer of protection and make it harder for cyber Grinches to get their sticky fingers on your personal information.

Carrying Over Cybersecurity Awareness Into the New Year

While it’s particularly important to be mindful of cybersecurity precautions during the holiday season, security awareness should be part of your everyday routine. There is often a noticeable increase in threats during the holidays, but cybercriminals are looking to capitalize on opportunities to execute attacks year-round. By putting these security measures into practice now, consumers and organizations will be able to better protect themselves heading into the new year and beyond.

Interested in emerging security threats? Read the latest IBM X-Force Research

More from Fraud Protection

Remote access detection in 2023: Unmasking invisible fraud

3 min read - In the ever-evolving fraud landscape, fraudsters have shifted their tactics from using third-party devices to on-device fraud. Now, users face the rising threat of fraud involving remote access tools (RATs), while banks and fraud detection vendors struggle with new challenges in detecting this invisible threat. Let’s examine the modus operandi of fraudsters, prevalence rates across different regions, classic detection methods and Trusteer’s innovative approach to RAT detection through behavioral analysis. A rising threat As Fraud detection methods become more and…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

The rise of malicious Chrome extensions targeting Latin America

9 min read - This post was made possible through the research contributions provided by Amir Gendler and Michael  Gal. In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome is one of the most widely used web browsers globally, with a market share of over 80% using the Chromium engine. As such, malicious…

What to do about the rise of financial fraud

6 min read - As our lives become increasingly digital, threat actors gain even more avenues of attack. With the average person spending about 400 minutes online, many scammers enjoy a heyday. Old impersonation scams continue to deceive people every day, as con artists and hackers are armed with advanced technologies and sophisticated social engineering tactics. According to the Federal Trade Commission, financial fraud increased by over 30% from 2021 to 2022, with total losses surpassing $8.8 billion. This ever-evolving threat will continue to…