0

I am a private computer user with an internet connection. Assuming that my connection is a standard land line (that I legally own, I'm not free loading) and that my computer is up to date on operating system updates, and has a firewall, what should be done before I use it to buy something?

When looking for anti-virus software lots of different types of protection are offered. I'm not quite clued up enough to work out what I actually need.

Improve this question

5 Answers 5

Reset to default
2

Your first enemy when purchasing online is your own computer: a simple malicious plugin you may have installed within your browser may compromise your privacy dramatically (ZombieBrowserPack is a plugin developed originally as a POC and which you can install on Internet Explorer, Firefox and Google Chrome but can be manipulated remotely to steal authentication credentials, and even bypass two-factor authentication mechanisms such as the ones implemented by Yahoo and Google. It can also hijack your Facebook account, or get your bank account credentials if you perform an online purchase. You can imagine such a plugin purposed to fulfill this or that feature (shim) and doing something nefarious behind in the background.) So you need to scan regularily your computer against the presence of spyware and other types of malware by using firewalls, antiviruses and keep your connections encrypted.

Also, you better need to type the URL of the website you want to purchase on yourself instead of searching for it and clicking on it in a forum page, in an email sent to you (even from a trusted person as email addresses can be spoofed or even hacked using a simple but effective technique such as password guessing) because an attacker can craft a malicious link that will lure you to a website that looks like the one you were used to purchase on but actually is not. Note that a secure website you may purchase on must use secure connections (https) looking something like this:

enter image description here

Avoid using your laptop to purchase something online whereas you're in a public place where nefarious people may be interested in the codes you type to valid your transaction. Same advice is valid in case your purchase with your phone. Better to be patient to do the transactions once you're at home.

Be always careful: attackers are used to send emails pretending to be from your bank or any service you may use and provide you crafted links to click on and pay for something. Read the emails carefully and use common sense to see if you're not going to be trapped. Do not forget to save records of all your transactions (print them for example) just in case ...

Improve this answer
1

My bank recommended to me, as one of their customers, that you only use a credit card online, as opposed to a debit card, check card, or anything of the sort. Their explanation is that with the debit style of card, your account can be drained immediately in the event of fraud.

With a credit card, on the other hand, they can take steps to reverse the transaction before it affects your bank account.

Improve this answer
2
  • No problem: we welcome all banks and credit card companies here :)
    – schroeder ♦
    Sep 16, 2015 at 21:00
  • On a security forum? We most certainly do!
    – Edward Barnard
    Sep 16, 2015 at 21:01
0

Ensure that whatever service you are purchasing from uses HTTPS. This will prevent your credit card information (and any associated personal information) from being transmitted via plaintext.

Equally importantly, make sure that you trust the services that you purchase from. If you make a purchase from an untrustworthy source, there is nothing you can do to prevent them from misusing your information.

Improve this answer
0

There are many different ways someone could end up with your credit card information that you use for an online purchase. Some of them include:

  • Your computer can be compromised with a keylogger or malicious browser.
  • Your connection to a legitimate website could be compromised by a MITM attack.
  • The website could be a fake site that is hard to distinguish from the real site.
  • The website or its payment processor could be storing your CC information, and could be compromised someday in the future.

All of these scenarios are unlikely to occur, in general. That being said, there is a credit card feature I've used before that nearly solves all of those issues, called virtual credit card numbers. Your credit card company generates a temporary credit card number and allows you to set the expiration date and spending limit, and also allows you to limit it to a single vendor. If that card number is ever compromised, it is basically worthless.

Improve this answer
0

If you're using Bank of America, Citibank or Discover (possibly other services as well) look into one time use credit card numbers (virtual credit card numbers). You generate a new number when you want to make a purchase, if it is leaked somehow then it is useless because the bank will only accept that number once. Checkout this lifehacker article that probably explains this a little better: http://lifehacker.com/5831160/use-virtual-credit-card-numbers-to-shop-safely-online-keeping-in-mind-the-downsides

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .