How to stay safe while online shopping?

Shopping online is convenient, but even well-known stores can be targeted by fraud. Knowing what to check before paying and how to respond when something goes wrong can reduce the risk.

Before buying from an unfamiliar store, read our guide to checking whether a website is trustworthy.

The Risks

The risks we take shopping online varies. It’s not only about risking your banking details or credit card details. Payment details may be one of the highest on the list of concerns we have when shopping online but there are other risks as well.

1. Theft or misuse of personal information – Your name and contact details are almost always required when making purchases online. The risks here are identity theft, selling of your information to 3^rd parties and signing up for marketing communication you didn’t agree to.
2. Your location – Your location may be visible but note that you don’t have to be shopping online or entering details for this. Its just one of the always present risks we take when using any online or internet service.
3. Payment Details – The risks here or exactly as you may think which a is unapproved purchases and payments from your account.
4. Malware – Just like Location, you don’t have to be shopping online for this. This is a risk when you are using the internet. Malware can potentially render your device vulnerable to information theft, damage, or extortion.

Impact and Recourse

There are many sites that tell you what you should or shouldn’t do but few advise you how to deal with a situation after something has gone wrong. Most users only start taking online security serious after an incident. Steps below help guide you towards a resolution and hopefully give you confidence when navigating online.

Theft or Misuse of Personal Information

If personal information is exposed, act promptly. Change affected passwords, secure your accounts and contact the organisation involved. In South Africa, you may also have rights to ask how your information is processed under POPIA.

In extreme cases where identity theft is involved, you must report it to the authorities as soon as you become aware of it. This should safe guard you should your identity be used for any crime. Next, run your details through a reputable credit bureau and contest any account or record you have not agreed to.

If you are receiving loads of spam and marketing communication you did not agree too, if your country has a DNC or Do Not Contact service or agency, get your details on there. This is primarily for calls and texts. For emails you would need to take precautions for all mails you open and mark them as spam. Some emails will have an unsubscribe link at the bottom of the email which you can use. You may even do a lookup on a domain name and report it to the domain name host provider.

Your Location

Review the browser’s site permissions and your phone’s app permissions to restrict unnecessary location access. Clearing cookies does not necessarily reset every permission, and your IP address may still reveal an approximate area.

NOTE: The same would apply to apps asking for access to call logs, contacts and SMS’s that do not need to ever have access to these functions.

Payment Details

If you notice an unauthorised transaction, contact your bank or card issuer immediately using an official number or app. Ask about freezing the card, disputing charges and reviewing other activity. The ability to reverse a payment depends on the circumstances and the bank’s rules.

Credit cards may provide additional dispute protections in some circumstances, but reimbursement is not guaranteed. Debit-card and electronic-payment disputes may also be possible. Ask your bank which rules apply to the particular transaction.

For online purchases, consider a payment method with appropriate fraud protection and enable transaction alerts and multi-factor authentication wherever offered. Review card limits and virtual-card options provided by your bank.

Malware

Malware includes viruses, spyware and ransomware. If you suspect an infection, disconnect the affected device where practical and seek trusted security guidance. Avoid copying potentially infected files onto your usual backup drive.

If after all this you think your computer or device is still at risk, get an IT engineer to take a look at it. Alternatively, if you are able to, reinstall your operating system or reload your device to factory settings. This will delete all data on your device permanently if not backed up.

Statistics for Internet Crimes

2020 – Historical Internet Crime Reports by Country¹

These historical 2020 figures are included for context, not as current rankings or estimates of global cybercrime. Reporting coverage and definitions vary by country.

1. USA
2. United Kingdom
3. Canada
4. India
5. Greece
6. Australia
7. South Africa
8. France
9. Germany
10. Mexico

2020 – Reported US Victims by Age Group¹

Ways of Staying Safe Shopping Online

No article about online security is complete without covering tips and guides for prevention. These tips are intended for anyone. If you do not practice these measures, it won’t matter how secure your devices are.

Device Security

The device which you use needs to have adequate security before you even think about buying something online on it. There is so much content available online on this topic, but for now here are some tips I highly recommend.

• Make sure you have the most up-to-date anti-virus software, operating system (iOS, Unix, Microsoft Window etc), and web browser (Firefox, Edge, Safari, Chrome etc).
• Best practice is to not use a device that is shared or does not belong to you if you intend to enter any of your personal or banking information.
• Unusual behaviour on your browser or operating system is an indication of an infection and should not be ignored. This may be where tabs on your browser open up on its own, pop-ups ads on your screen, unable to uninstall an application and so on. Remember that any device you use needs to have a somewhat predictable behaviour by design. This is not always a sign of malicious software or a hacker, but it something you should be aware of when it comes to device security.

The Online Store

Legitimate small online shops can look different from established retailers. Check their business details, contact options, policies, reviews and payment methods before ordering. No single sign proves that a seller is genuine.

• Have a contactable local phone number.
• Have multiple channels for communication like phone, email, WhatsApp, Facebook and so on. Feel free to reach out to stores and see if they respond to your queries. That’s what they are there for.
• Search for the store on Google and see if someone has flagged them as being unsafe or fraudulent. Poor customer reviews are not an indication of being fraudulent unless explicitly stated. If there are poor reviews, did the business attempt to resolve this? Reviews should be looked at subjectively.
• Are the prices too good to be true? If it is too good to be true, then it probably is. If you see a brand-new laptop 80% off if you purchase NOW, then it’s probably a scam. Use common sense and match prices across different websites so you know the market value.
• Product information is important and should match the product picture and description. If you are not sure, search for the same product on other websites.
• After all this if you still have doubts, you could always ask on social media if anyone has purchased from that store.
• Look for HTTPS when entering personal or payment information. HTTPS encrypts the connection, but it does not confirm that a store is legitimate. Also check the domain name and the seller’s reputation.
• You could buy something cheap at first to test out the waters. This is if they tick of all other boxes.

Payment information

When it comes to the payment phase, you may be given an option of payment providers. Chose one which you have heard of or used before. This will redirect you to that company’s page or window to complete payment. Ensure that the browser is still using https://.

Recognised payment gateways may provide useful security controls, but a familiar logo alone is not proof of safety. Verify the payment page and avoid following unexpected links sent by email or message.

Once you start using your credit card or account for online purchases, make it a habit to regularly check your bank statement. Apart from reconciling your purchases, you may not receive notifications for payments under R100. There are scams that exists where hackers/syndicates target a broad number of accounts with smaller inconspicuous payments that often go unreported for this reason.  

Online Store Details

Use a long, unique password for each store account, ideally generated by a password manager. Enable multi-factor authentication if available.

Passwords should only be accessible to you and not even the store owner. This is the design of a well built system and it may not necessarily be something a customer would know.

Network

Public Wi-Fi can be risky, particularly on an imitation or untrusted network. Modern HTTPS protects much traffic, but using a trusted mobile connection for sensitive transactions is a sensible precaution.

Suspicious Email

Phishing messages may impersonate shops, couriers or banks. Rather than following an unexpected payment link, open the retailer’s known website or app directly and verify the offer.

Keep Any Record of the Transaction

You should be doing this anyway for warranty purposes but more so for online purchases in case you need to proof to your bank or online store of what you purchased in case of a dispute or claim.

Summary

This may seem like a long list of things to remember and do but it isn’t. It’s like driving, you need to make sure the lights, tyres, water, and oil are maintained before driving then while driving you need to always check your mirrors and observe the road speed, keep your driving distance, use your indicators and so on. But as a regular driver it’s second nature and not as much effort. It’s the same with shopping online. There are risks and learning to mitigate situations and understanding prevention protocols will give you the confidence you need to shop online.

If you’re a business owner considering an online store, Web Force can assist with eCommerce website design and setup. See our guide to choosing an online-store platform for a practical starting point.

¹Source: https://www.fbi.gov

For more general protection advice, read our online data privacy and security guide.