It’s almost the most wonderful time of the year! Most people might consider that the December holiday season but for me it’s definitely Black Friday and Cyber Monday. Gone are the days of pitching a tent outside of Best Buy at 3am—you can now get all the awesome deals from the convenience of your couch!
The problem is, as with most large events on the Internet, there will be more people than usual looking for ways to cash in on unsuspecting shoppers. Using OpenDNS can help prevent you from falling victim to these attacks, but here are a few other tips on how to increase your safety and security while scoring some deals:
Check Where Your Emails are Coming From
As a savvy shopper I definitely love coupons. In my opinion, one of the best places to get coupons is via email. You have to be careful though–some of the deals really are too good to be true. Phishers are getting more advanced, and are always looking for better ways to trick people into clicking on their links. Sometimes determining whether an email is legitimate or a phish can be like deciphering the microscopic fine print that lists the exclusions on coupons.
One of the biggest indicators of a phishing email is where it’s coming from. Remember, these people make money off of tricking you. Many phishing emails look very legitimate and it often takes a diligent eye to spot a phish.
One of the first things that I do if I receive a suspicious-looking email is check the domain that the email came from. Most legitimate companies have their own domain from which all emails will be sent. In an email address, the part after the @ is the domain. The part before the domain is the local part, which is chosen, so it can say just about anything. Take a look at the below example:
The local part of the email address says macysshopping4, but remember that part can be chosen. Why would an email from Macy’s be sent from a Gmail account? A common phishing technique is to make the local part of an email address look legitimate to trick end users. The domain Macy’s coupons actually come from is @email.macys.com.
Email addresses can also be spoofed; a correct sending address does not necessarily mean the email is legitimate. Spoofing is when the sender email address is forged. Someone can forge sending you an email from shop@email.macys.com but it wasn’t actually sent by Macy’s. That is why you should also check the content of the email.
Check Before You Click
Did you know that before you click, most browsers will show where the link you are hovering over goes?
Similar to emails, webpages also have domains. When I hover over a link in this email the browser shows me the location the link will take me to before I click on it. If I know this email is from Macy’s, it makes sense that links within this email should take me to macys.com.
The domain for a webpage is different than an email domain. The subdomain, domain, and top level domain are between the protocol and path of a URL:
The protocol declares how your browser should communicate with the web server you are browsing, but we’ll talk about this later.
The subdomain is a subdivision of the main domain. In the above example, community is a section of the domain opendns. Every domain ends in a top level domain (TLD), TLDs form the root zone of the DNS system. It’s important to check that the domain of a web page correlates with the web page you are intending to visit.
The path refers to the file or directory on the webserver where a particular URL lives. Like with the local part of an email address, the path can be edited to say anything.
If you are in an email you believe is from Macy’s, which URL is most likely not a phish?
hxxp://www.macys.com/shop/womens-clothing
or
hxxp://www.xqnrr.com/macys/shop/womens-clothing?
If you chose the first URL you are correct. The domain of this URL is macys.com, which shows that this URL is hosted on the Macy’s domain and the path goes to the women’s clothing section. The second URL is hosted on the domain xqnrr.com but the path of the URL was made to look like it is a Macy’s website.
Confirm You are Using a Secure Connection
Before you enter any payment or personal information into a website, make sure your browser is using an SSL (Secure Socket Layer) connection. SSL provides a secure connection between a web server and your browser. This helps ensure that a third party cannot easily view your payment/personal information.
How can you tell if your browser has a secure connection? The URL will start with https:// and you will see a lock in the address bar:
An https:// at the beginning of a URL indicates that the data you are transmitting will be encrypted between the client (your browser) and the end server (the server the website you are accessing is hosted on) to better protect your information.
Paypal phishes are quite frequent; one way to spot a Paypal phish is that it will lack an SSL connection:
This specific phish also has the bonus of a spelling error which is also indicative of phishing pages and emails.
Also, be wary of pages that are asking you for unnecessary information. You shouldn’t need to enter your social security number to purchase a new iPad. Be cautious of the data you are providing/putting out on the World Wide Web.
Make Sure Your Computer/Device is Virus Free and Up to Date
Before the big shopping day you should confirm that the computer or device you will be using for shopping is not infected with malware or adware and that all updates have been completed.
If your computer has malware on it your information becomes very easy to steal. Certain types of malware install keyloggers on your machine that can record every keystroke and provide malicious parties with usernames, passwords, credit card numbers, and any other personal information that you type. Any type of malware or adware on your machine makes it less secure, so be sure to use up-to-date AntiVirus that scans your machine regularly for these types of infections.
Also make sure that all updates have been completed on your machine. Many updates, particularly for your operating system and browser, contain security patches that protect you from known vulnerabilities.
Use OpenDNS!
Our DNS service offers an added layer of security that will protect you from known phishing sites. If you do happen to come across a shady site while shopping you’ll see the OpenDNS block page rather than a page that can potentially steal your data or infect your machine.
Be Smart
The best way to be safe while shopping on the Internet is to be smart about what you are doing. Take the necessary precautions to make sure your computer or device is clean and updated. Also take the extra minute to confirm that the email or website you are viewing is safe. Sometimes being safe can be time consuming, but it will take a lot less time than you’d have to spend reclaiming stolen information, fighting fraud charges, or in extreme cases, reclaiming your identity.
