Press Centre

Internet Shopping - Enhancing Your Security Online

Texas Office of Security
December 2008

THE HOLIDAYS ARE APPROACHING - HELP PROTECT YOURSELF AND SHOP SMART! The holiday shopping season is upon us, and the volume of online shopping is increasing. According to some estimates, holiday e-commerce spending totaled $29 billion in 2007, an increase from $24 billion in 2006. While online shopping can be convenient and time-saving, you must shop smart and take precautions to mitigate the risks. The following tips may help to make for a safer online shopping experience:

• Enhance the security of your computer. Install a firewall and make sure your computer has the most current anti-virus and anti-spyware software before you begin your online shopping. Set your default settings on your computer to auto update.

• Use strong passwords. When creating passwords for online accounts, use at least eight characters including numbers, special characters, and upper and lower case letters. Don't use the same passwords for online shopping websites that you use for logging onto your computer. Never share your login and/or password.

• Guard the security of your transaction. When submitting your purchase information, look for the lock icon on the browser's status bar and make sure that https or shttp appears in the website's address bar. The s stands for secure.

• Don't email your financial information. Clear-text emails are not a secure method for transmitting financial information such as credit card, checking account, or Social Security numbers.

• Keep a paper trail, and check your credit card and bank statements regularly. Print and save records of your online transactions including the product description and price, the online receipt, and copies of every email you send to or receive from the seller. Read your credit card and bank statements as you receive them, and be wary of unauthorized charges.

• Don't respond to pop-up messages. If you receive an email or pop-up message while you're browsing, don't reply or click on the link in the message, especially if it asks for personal or financial information. Legitimate organizations don't ask for this information in these ways.

• Don't respond to pop-up messages. If you receive an email or pop-up message while you're browsing, don't reply or click on the link in the message, especially if it asks for personal or financial information. Legitimate organizations don't ask for this information in these ways.

• Check the privacy policy. Know what information the merchant is collecting about you, how it will be used, and if it will be shared or sold to others. You can do this by checking the web site to ensure that a privacy policy is posted and that you're comfortable with the way your personal information is treated under that policy. Look for seals from privacy enforcement organizations like TRUSTe (www.truste.org) or the Better Business Bureau (www.BBBOnLine.org). Be suspicious if you're asked to supply personal information not needed to make a purchase, such as your Social Security number, mother's maiden name, or other personal information.

• Limit your online shopping to merchants you know and trust. If you have questions about a merchant, verify it with the Better Business Bureau (www.bbb.org) or the Federal Trade Commission (www.ftc.gov).

• Pay by credit card. Credit or charge card transactions are protected by the Fair Credit Billing Act. Debit cards are covered under the Electronic Funds Transfer Act, but the potential protections provided depend upon when you report the error, loss, or unauthorized use. Under the Fair Credit Billing Act, in the event of unauthorized use of your credit or charge card, you generally would be held liable only for the first $50 in charges. Some companies offer an online shopping guarantee that ensures that you will not be held responsible for any unauthorized charges made online, and some cards may provide additional warranty, return, and/or purchase protection benefits.

• Use temporary account authorizations when available. Some credit card companies offer virtual or temporary credit card authorization numbers. This kind of service allows you to use a secure and unique account number for each online transaction. These numbers are often issued for a short period of time and cannot be used after that period. Contact your credit card company to see if they offer this service.

• Know who you are doing business with before placing your order. Confirm the online seller's physical address and phone number in case you have questions or problems.

If you have problems during a transaction, you can contact the seller, buyer, or site operator directly. If those attempts are not successful, you may wish to file a complaint with the following entities:

• The Attorney General of Texas: www.oag.state.tx.us/consumer/identity_theft.html

• The Attorney General of Texas Consumer Protection Division: www.oag.state.tx.us/consumer

• The Better Business Bureau: www.bbb.org

• The Federal Trade Commission: www.ftc.gov

For more information about secure online shopping, please visit the following sites:

• OnGuard Online: www.onguardonline.gov/topics/online-shopping.aspx

• US-CERT: www.us-cert.gov/cas/tips/ST07-001.html

• StaySafeOnline: www.staysafeonline.org

• Federal Trade Commission: www.ftc.gov/opa/2008/11/smartshopping.shtm and www.ftc.gov/bcp/menus/consumer/tech/online.shtm

• National Consumer League's Internet Fraud Watch: www.fraud.org/tips/internet/phishing.htm

• WatchGuard: www.watchguard.com/infocenter/editorial/18714.asp

• Online Cyber Safety: www.bsacybersafety.com/video

For previous issues of the Monthly Cyber Security Tips Newsletter, please visit www.dir.state.tx.us/security/reading. For more information on Internet security, please visit the SecureTexas website - www.dir.state.tx.us/securetexas. SecureTexas provides up-to-date technology security information as well as tips to help you strengthen your part of Texas' technology infrastructure. Report serious information security incidents as quickly as possible to your agency's Information Security Officer and to DIR's 24/7 Computer Security Incident Notification hotline: (512) 350-3282.