Dangers Of Shopping Are Evolving

Holiday shopping is dangerous. You could be tackled by other shoppers as you reach for the latest video game. You might go blind staring at your computer screen as you spend hours looking for a gift that is not only perfect, but will also arrive on your doorstep in time for you to smack a bow on it. There are other dangers, though -- and the risks are changing.

Shopping at brick-and-mortar stores is not necessarily any safer than shopping online anymore. In fact, Don Jackson, director of threat intelligence for PhishLabs, told Dark Reading this week that he would rather hand his credit card data to a Web form than to a salesperson.

Why the shift in threat posture? One reason for that is the spate of point-of-sale malware that has made headlines all year. Another is that retailers often work harder to secure their e-commerce sites than their brick-and-mortar shops.

That's not to say that e-commerce sites aren't without their risks. Yet, the kinds of risks are changing. Attackers are moving away from carding and starting to favor account takeover, as new research shows.

"This year, we have determined fraudsters are leveraging more sophisticated attack vectors, focusing increasingly on account takeover, as opposed to the common tactic of credit card cycling," says Ryan Wilk, director of customer success at NuData Security, in a report released Tuesday. "This shows us that thieves are beginning to value user accounts with payment information attached more than credit card details themselves. This puts additional burden on the e-commerce organization to protect their communities."

Researchers at ThreatMatrix are finding the same pattern. In a report last week, Alisdair Faulkner, chief products officer for ThreatMatrix said, "In addition to payment fraud this holiday shopping season, our biggest concern is the spike in the number of account takeovers we are seeing on retail websites. ThreatMetrix data shows an upswing in account takeover activity in the wake of recent massive data breaches -- and most retailers will be caught unprepared.

“Previously, guest checkouts represented the highest risk, but due to the prevalence of data breaches and the convenience of storing credit cards to make mobile purchases easier, fraudsters have found it just as easy to use a stolen username and password as it is to use compromised credit card information that has a shorter life span before being shut down."

The "convenience of storing credit cards to make mobile purchases easier" that Faulkner mentions becomes a greater concern as more shoppers use mobile devices to make purchases. Iovation predicted this week that about 40% of all retail transactions made between Black Friday and Cyber Monday this year will be made from mobile phones and tablets. This segment has been steadily increasing for years. Just five years ago, Iovation found that only 3% of the online retail transactions between Black Friday and Cyber Monday came from mobile devices.

Are you planning to get sore feet trudging around the shopping mall this season, or get sore fingers trolling the Internet? Do security risks affect your decision? Let us know in the comments below.