At present, in Latvia, when the majority of goods and services can be purchased only online due to the Covid-19 restrictions, e-commerce is experiencing extraordinarily rapid growth. Last year, only 15.5% of companies sold goods or services online, according to data from the Central Statistical Bureau. This year, under the influence of the pandemic, that number may have at least doubled. Companies are actively opening online stores, seeing opportunities for growth in the current situation, while for some companies this is also a matter of survival. However, when many new online stores appear and people actively shop online, cybercriminals become more active, attempting to exploit vulnerabilities in online-store security and shoppers’ inattention. It is estimated that during the pandemic, cyberthreats—involving attempts to break into corporate networks or emails containing infected attachments—increase by as much as 30%.
Kārlis Bergmanis, an IT engineer at ESET security software, shares five tips on how owners can protect their online stores and residents can avoid becoming victims of cybercriminals.
1. Know the main cyberthreats
As the year’s major holidays approach, phishing is one of the most common methods used by cybercriminals. Phishing means stealing or obtaining a user’s identity and personal information, such as bank-account details, a credit-card number, a password and other information, in order to generate income. Cybercriminals send phishing emails to employees who administer an online store’s email accounts, and any email user may receive them. These messages usually urge recipients to open invoices for goods in the attachment as quickly as possible. Such messages should be read carefully, and attachments should be opened only if there are no suspicious signs. Otherwise, there is a risk of infecting the computer with both cryptocurrency malware and the so-called Trojan horse, which awaits commands from the criminals’ servers. “The most dangerous threats at present are ransomware, which encrypts data and demands a ransom for unlocking it. If, for example, a customer database, an online store or other company data is encrypted, and no backups are available, most companies will go bankrupt within six months of the attack,” says K. Bergmanis.
2. Take care of data protection
A company’s priority is sales, but successful long-term operations also require attention to data protection. Implementing solutions in a timely manner helps avoid the terrible consequences of cybercrime, such as the loss of customers’ bank passwords, data encryption or even the “hacking” of an online-store platform. To avoid this, both online-store administrators and online shoppers should use antivirus software that can filter email to stop malware, thereby protecting computers and email from dangerous viruses, phishing and spam. “Online stores that enable e-banking services need to pay particular attention to protecting their trading platform. Buyers who pay for services and goods online must also bear in mind that basic precautions alone will not be enough. Cybercriminals’ methods have become much more ‘sophisticated’, so often only antivirus software can detect cyberattacks and unsafe websites,” says the ESET IT engineer.
3. Recognise fake accounts and invoices
Another tool used by cybercriminals is the distribution of fake invoices or bank accounts. This mostly affects people and companies looking for the cheapest offers online. The operators of such online stores often fail to take the necessary precautions to maintain their systems. It is relatively easy for cybercriminals to gain access to an online store’s email server and email account, allowing them to monitor correspondence between the company and the customer. Immediately before payment, cybercriminals can send an email from another, very similar mailbox, asking the recipient to transfer the required amount for goods or services to an entirely different bank account. “The recommendation is always to check whether the bank account stated on the invoice sent by email is the same as the one listed on the online store’s website. If you have doubts, it is safer to call the company providing the goods or services and ask for the bank-account number. This way, you can be sure that the invoice email you received is not a trap sent by fraudsters,” advises K. Bergmanis.
4. Make sure the store is trustworthy
If you want to find a new online store offering the goods or raw materials your company needs at an attractive price, it is advisable to check its reliability. Residents shopping at an online store for the first time should do the same. The easiest way to verify an online store’s reliability is to check reviews on the salidzini.lv or sudzibas.lv review platforms. The results will show, for example, whether there are victims who tried to purchase goods from the store but ultimately never received them. Another way is to check whether the website uses a secure HTTPS certificate, which encrypts sessions between the server and the client. If messages such as “Your connection is not private” or “The certificate is not trusted” appear in the web browser before you access the website, you should avoid visiting that page, and especially avoid purchasing goods from it. When ordering goods from less secure online stores, there is a high probability that you will not receive them. In addition, malicious criminals may obtain your payment-card details during the purchase.
5. Report observed threats
Online stores that learn about cyberthreats affecting customers, such as phishing or malicious emails sent to customers in the company’s name, must inform customers immediately and urge them not to open these emails. If such an email has been opened, you can advise customers to check their computers for malicious threats using free tools such as the ESET Online Scanner. “To avoid such situations, we always recommend that companies managing online stores find out whether their email-service provider can provide additional protection for the company’s mailboxes. Residents, meanwhile, should remember that when they receive suspicious emails, regardless of the apparent sender, they must not open the attachments and should inform the relevant company about such messages,” says the ESET IT engineer.
Source:
eset.com
