Holiday shopping cyberattacks: How to protect yourself

Let's get into this topic here. Holiday shopping scams from fake retailer websites and delivery texts to fraudulent payment schemes. Familiar scams are becoming more convincing with the help of AI. So how can we spot these scams ahead of holiday season? Let's go ahead and bring in Jay Passarelli. He's a threat researcher with Anomaly, and he has tips for us today. Jay, thanks so much for joining us. I know. Thank you for having me. So today, yes. Oh, no, you go ahead. I was going to say today, I would love to talk about two scams in particular, as you'd mentioned, the first one being fake messages and the second one being fake advertisements and storefronts. Because while we see these attacks year round, the pretext and the story that allows these to be more believable is typically in play for shoppers this time of year. And so what can we do here in this situation if we encounter this scam or believe that we are a victim of it? What can we do? What should we do in this situation? First of all, I think it might be helpful to say exactly what these scams are. So the first one with it being fake delivery messages, these typically come through text messages, emails, social media messages or even phone calls. And they're typically trying to impersonate banks, delivery services and retailers that we trust. And they have different stories, and it's important to understand that the stories can change. But, for instance, it could be a message that says you need to pay a small charge for your delivery, otherwise it won't be delivered, or that you need to update your address, otherwise it won't be delivered. It's important to understand that these attackers, these criminals, are trying to force you to interact with the message or channel that they gave you. And it's the same with the fake. Advertisements that you'll typically see on social media or through sponsored ads on a search, they are trying to push you down the route to get to a fake storefront, which is often impersonating big brands that we know and trust. And that's what the attackers or the criminals are trying to do. They're trying to borrow trust from these brands and use it against you. The first tips that I give to anyone that'll listen is simply slow down. If you get a text message or an email or a phone call, that's okay. It's not dangerous in itself. Do not interact with the link or the phone number. That's what the attacker or the criminal is wanting you to do. You should simply, first of all, take a break, take a breath. There's no urgency in it. No No retailer will want you to instantly do something. The second thing is to... independently verified the message or the advert that you may see. And this is as simple as instead of using the link that's presented to you, use a bookmark that you've done, write down the things that you've purchased. So you can go to the website or use the retailer's application to verify any of these requests or great deals that they might have. Thirdly, using password managers can really help this time of year. The great applications that allow you to create unique and strong passwords for all of the profiles that you may have on the internet. And also, another added bonus that may help flag fake websites is if you have credentials stored in a password manager and you are on a fake site, it typically won't allow you or it won't instantly put your password in for you, which could be a great red flag. And fourthly, a tip is to lean on friends and family this time of year. It's okay to not know everything. Maybe ask someone that you trust or knows a little bit more about technology than you do. They're the four tips that I would like your listeners to know about retail scams this time of year. So much for sharing those scams with us or those tips with us and what we should know. What should we do if we receive an urgent message about a missing package that is a scam? For example, that's the first thing to do is simply don't react instantly. That's what the scammers are wanting you to do. They're trying to force urgency and trying to spike a reaction to a fear of loss or a fear of missing out. So again, first thing is simply take a break and then verify independently with the service. So for example, if it was UPS that message just saying, we have this package, go to the UPS website, ring UPS through a number that has been verified. Don't simply use the channel that the criminal has given you. Jay, thanks so much again for joining us to talk about this. Any final thoughts for our viewers here as we make our way into holiday season Simply be safe and take a break. Don't react instantly. All right, Jay. Thanks again for your time today. We hope you have a great rest of your day. Thank you very much. You too.