They see you when you’re shopping, they know when you click “pay” – cybercriminals, that is. With Black Friday and Cyber Monday deals flooding the internet, malicious actors have many opportunities to exploit users rushing to purchase gifts for family and friends. And according to Ars Technica, thieves have devised a new way to steal payment-card data from online shoppers, just in time for the holiday shopping season.
So, what makes this particular scam different from other credit and debit card scams? Many e-commerce sites will choose to offload payment card charges to third-party payment service platforms, or PSPs. However, cybercriminals have developed fake payment service platforms that highly resemble legitimate PSPs. Rather than infecting a merchant’s checkout page with malware that skims the information after it’s been inputted by the user, cybercriminals infect the merchant site by adding a line or two of code, which redirects the user to a fake PSP at the time of purchase.
What makes this scam so stealthy? Apart from swapping legitimate payment processing sites with fraudulent ones, cybercriminals closely mimic the traits of real e-banking pages to further trick the user into believing that their purchase is secure. For example, the fake payment processing page checks all the fields once the user completes them or informs the user if the field is invalid. Once the fake PSP collects the data, it redirects the unsuspecting user to the legitimate PSP and includes the purchase amount after successfully stealing the victim’s information.
Payment-service platforms are common in the world of e-commerce, particularly for smaller websites that don’t have the resources to harden their servers against sophisticated attacks. As a result, users need to be on high alert for these malicious schemes. Check out the following tips to help prevent your data from being swiped by cybercriminals.
- Be on the lookout for suspicious activity. This particular scam redirects users from the fake PSP back to the legitimate payment site after their information has already been accepted. If you’re being asked for personal or financial data more than once, the site has likely been infected with malicious code.
- Review your accounts. Be sure to look over your credit card and banking statements and report any suspicious activity as soon as possible.
- Place a fraud alert. If you suspect that your data might have been compromised, place a fraud alert on your credit. This not only ensures that any new or recent requests undergo scrutiny, but also allows you to have extra copies of your credit report so you can check for suspicious activity.
- Use a comprehensive security solution. Safeguard yourself from cybercriminals with a comprehensive security solution like McAfee Total Protection, which can help protect you from malware, phishing, and other threats.
And, of course, to stay updated on all of the latest consumer and mobile security threats, follow @McAfee_Home on Twitter, listen to our podcast Hackable?, and ‘Like’ us on Facebook.
Stay Updated
Follow us to stay updated on all things McAfee and on top of the latest consumer and mobile security threats.
