With the holiday shopping season in full swing, more than 174 million Americans shopped online and in stores from Black Friday to Cyber Monday. That weekend may be in the past, but there are still plenty of opportunities for threat actors to exploit poor cybersecurity practices.

As retailers continue to push out deals to consumers over the next month, fraudsters will seek opportunities to breach personal information, spread malware and prey on the abundance of data being shared during the hectic holiday season. For example, in 2016, researchers from IBM X-Force identified a phishing campaign that sent emails from an address that appeared to be from Amazon.com. The emails contained fake tracking numbers and attachments to embed ransomware onto users’ computers.

When using mobile payments, online shopping, or setting up new technology and devices, organizations and consumers alike should be hypervigilant to keep their networks and information safe.

Our elite team of security professionals, IBM X-Force, is monitoring malicious activities closely — not only during the shopping season, but 24 hours a day, seven days a week, 365 days a year — to help customers, fellow researchers and the public better understand the latest security risks and stay ahead of emerging threats.

Online Shopping Safety Tips for the Holiday Season

The X-Force team, which manages 35 billion events per day, offered the following tips to help organizations and consumers keep their information and networks safe while shopping online during the 2017 holiday season.

Safeguard Credit/Debit Information

When taking advantage of those holiday deals, never save credit or debit card information on retail sites or in your web browser. Always look for the green lock icon in the browser address bar to ensure a secure connection to websites.

Pass the Phrase, Please

While shopping online, use different passphrases for each site and be sure to mix letters, numbers, special characters and even spaces. For example, “H0w D1d I G3t Stuck In Th1s Ch1mney?” or “Two:Billi0n CO0kies & Glasses 0f Milk!” You can also use a password manager to store passphrases in a digital vault so you don’t have to memorize them on your own. In addition, never use the same passphrase as your email account.

Email Scammers Don’t Take Holiday Vacations

Scammers often prey on the surge of online shopping to send fake emails that look like customer service follow-ups. Make sure to pay extra attention to emails that look suspicious. When in doubt, go directly to the trusted retail site instead of clicking on potentially malicious links.

Security Recommendations for Connecting New Devices

The X-Force team also recommends taking the following security precautions when setting up new devices.

Don’t Forget the Batteries

A decade ago, batteries were the biggest concern — but before the kids start unwrapping, don’t forget to secure those smart devices. Many of today’s toys need software updates, patches and configuration of permissions before use. Drones, robots and even connected teddy bears may require access to video, audio and social media platforms and should be configured to limit your family’s exposure appropriately.

Protect Devices From Themselves

Before connecting any new technology to a home network this holiday season, make sure the router is protecting devices that can’t protect themselves. By using a Domain Name System (DNS) service such as Quad9 at the router level, any smart device that requires internet access is provided with additional security and privacy automatically.

Prevent Personal Assistants From Snooping

Thinking about introducing a virtual assistant to your household? Be sure to mute the microphone on the assistant when not in use, and avoid linking any important bank or credit accounts to the device.

Get Creative With Security Questions

When setting up those new tech gifts, opt for security and password reset questions that aren’t public to make it harder for fraudsters to get their hands on your information. For example, don’t use your mother’s maiden name, which could be easily found online. Even answers to opinion-based questions, such as favorite movie or food, can be found on social media. For increased security, lie about your answers or use passphrases as the answers.

Be Open to Biometrics

Before firing up new phones and tablets, consider implementing biometric authentication, which uses physical characteristics such as fingerprints or behavioral characteristics such as voice recognition. Biometrics and two-factor authentication add a layer of protection and make it harder for cyber Grinches to get their sticky fingers on your personal information.

Carrying Over Cybersecurity Awareness Into the New Year

While it’s particularly important to be mindful of cybersecurity precautions during the holiday season, security awareness should be part of your everyday routine. There is often a noticeable increase in threats during the holidays, but cybercriminals are looking to capitalize on opportunities to execute attacks year-round. By putting these security measures into practice now, consumers and organizations will be able to better protect themselves heading into the new year and beyond.

Interested in emerging security threats? Read the latest IBM X-Force Research

More from Fraud Protection

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

How Security Teams Combat Disinformation and Misinformation

“A lie can travel halfway around the world while the truth is still putting on its shoes.” That popular quote is often attributed to Mark Twain. But since we're talking about misinformation and disinformation, you’ll be unsurprised to learn Twain never said that at all. In fact, no one knows who first strung those words together, but the idea that truth spreads slowly while lies spread quickly is at least several hundred years old. The “Twain” quote also serves to…

A View Into Web(View) Attacks in Android

James Kilner contributed to the technical editing of this blog. Nethanella Messer, Segev Fogel, Or Ben Nun and Liran Tiebloom contributed to the blog. Although in the PC realm it is common to see financial malware used in web attacks to commit fraud, in Android-based financial malware this is a new trend. Traditionally, financial malware in Android uses overlay techniques to steal victims’ credentials. In 2022, IBM Security Trusteer researchers discovered a new trend in financial mobile malware that targets…

New DOJ Team Focuses on Ransomware and Cryptocurrency Crime

While no security officer would rely on this alone, it’s good to know the U.S. Department of Justice is increasing efforts to fight cyber crime. According to a recent address in Munich by Deputy Attorney General Lisa Monaco, new efforts will focus on ransomware and cryptocurrency incidents. This makes sense since the X-Force Threat Intelligence Index 2022 named ransomware as the top attack type in 2021. What exactly is the DOJ doing to improve policing of cryptocurrency and other cyber…