Checklist For Protecting Your Credit Card Information And Identity Online

I am an information security consultant and was a PCI Qualified Security Assessor for a number of years. I work with companies to help them lower their risk when it comes to protecting customer card data and personally identifiable information (PII). I have seen some pretty interesting things, some of which I would rather not share or will not share due to non-disclosure agreements. I will let you surmise what I mean by "interesting".

But an important part of the equation is consumer awareness and good practice when it comes to using credit cards, whether online or at retail establishments. Below is my first attempt at a checklist for consumers when using their credit cards to make purchases online. I assume that you are practicing basic safe computing by using a Firewall, Anti-virus, and Anti-Spyware software. There are 18 items and they are not in a specific order of importance.

Note:  For tips on protecting your payment card information for retail purchases such as restaurants, gas stations, or other retail establishments - see my previous article '15 Steps for Protecting Your Credit Card Information for Retail Purchases'

1. Avoid using your email address as your login name. Don’t use your email address as your login ID on web sites that you use your credit card to make purchases from. It’s a common practice now that web sites default to using your email address as the login name. This is for convenience and to help address the problem of users forgetting their login name. The problem is that if your login information is compromised on just one site, it could be assumed that you used not only the same login name (email address) but the same password too. Now all the attacker needs to do is to try this same login name and password on other sites.

2. Delete online accounts you no longer use. Remove your credit card information and your login account from sites you no longer frequent. It will only take a moment and it will reduce your exposure. If the site does not make this easy to do this online, call them or send them a letter with your request.

3. Change your password regularly. And I don’t mean once a year here. A reasonable time frame is probably every few months or even more frequently depending on your online buying habits. If the site does not make it easy to change the password, contact them for assistance on how to do this yourself online.

4. Use complex passwords. This goes without saying but I continue to be amazed when performing security audits at how many people use very simple passwords. Consider using passphrases instead of passwords and mix it up with numbers, upper and lower case letters, and other punctuation characters. If a web site doesn’t allow the use of characters other than numbers and letters in the password, complain! This just isn’t good security practice.  There are some great password management applications available that will make this easy to manage.

5. Don't log in using your SSN or account number. Do not log into sites using your full social security number or account number as the login ID or password. If any sites you use require this, contact them and demand that they change this practice. There is really no reason for this.

6. Perform initial web site registration for services that provide online access as a benefit. You likely have credit card, bank, medical, insurance, 401k, and other sites that make online access to your accounts possible as an additional benefit. You may not even be aware that you have online access to your account as a counterpart to your standard account management method. The first time sign-in to some sites may use a portion of your social security number or other personal information as part of the initial sign up confirmation process. If you don’t plan on using such sites, contact the company and request that they disable online access to the account. If you do plan on using the site, perform the initial login as soon as you can and assign a complex password to the account. Also, as mentioned above, avoid using your email address as your login name.

7. Read the security and privacy policies of web sites that you use for card transactions. A number of large well known sites clearly stipulate that they are not responsible if your account or data is compromised and that there is no expectation of security or privacy on their part. Most users of these sites are probably not aware of this. Consider the consequences of using such sites.

8. SSL doesn’t mean your data is secure or that the company follows best security practices. Don’t trust sites that have a security and privacy statement that simple says “this site is protected with the latest SSL security technology so your information is secure”. This really bugs me to see this as a security statement on a web site. SSL only protects your information in transit between your web browser and their web server during your session. This means nothing when it comes to protecting your information once it is saved to their server, or leaves their server to be processed or stored elsewhere. Read their policy on protecting your information after the transaction.

9. Don’t make online card transactions from an untrusted computer. This includes Kiosks, Internet Cafes, or even a friends computer. You just don’t know what might be running in the background capturing your transaction information.

10. Use online payment services. Use an online payment service to reduce the number of merchants that have your credit card numbers. These services reduce the possible ‘attack surface’ of your card information by keeping your credit card and identity information with the payment service, not with each of the merchants.

11. Don’t ignore warnings from your web browser. They appear for a reason and you should read them. Don’t get in the habit of clicking Ok or Cancel before you know what the warning is about. An error could be a sign of a malicious site redirect, man-in-the-middle, or phishing attack.

12. Use additional security features offered by the site. If the site offers additional security features, like those that confirm the authenticity of the site and the user computer, use them. They help ensure that you are connected to the actual site you intended, not a spoofed site.

13. Watch for the lock. You’ve probably been reminded of this hundreds of times. But it’s worth mentioning it again. If there is no lock, then the site is not using SSL. If the lock indicator does appear but it looks “broken” or there is a line across it, then there is a problem with the web sites SSL certificate. Click on the lock for more information about the problem.

14. Avoid logging in from the main page of web sites. There are some sites that provide login fields on their main web site page which are not initially secure (no lock displayed). This, they claim, is for user convenience. In most cases, the actual login will usually then be carried out encrypted with SSL, but not until you enter your login information and click login. This behavior is inconsistent with the idea of ensuring that the site is secure (you see the lock) before providing your login information. A simple workaround is to click on the login button without providing a login name and password. You will see a login error but you will immediately be redirected to a secure login page where you can login as usual.

15. Do not use the ‘remember me’ feature for sites in which you use credit cards. For many sites, this means that they will store a persistent ‘cookie’ on your computer so they will know it’s you the next time you connect to the site. If your system were to be compromised, that ‘cookie’ is all that’s needed to login to your account without a login name and password. Note that this is different than the new feature of some sites that let you 'register' a computer as a system that you normally use to login. Also, after an online card transaction, remember to always click on the “log out” button and then close the browser window.

16. Do not use a debit card for online purchases. Most credit cards provide some form of protection in case fraud were to occur. For example, you are usually not liable for any fraudulent purchases if you notify the card company quickly. But you don't normally get these protections and liability limits if you use one of the many types of debit cards available that can also be used as if they were a credit card. They are not truly a credit card.

17. Check your credit report often. Many victims first learn of fraudulent accounts created on their behalf while reviewing their credit report. One of the tell-tale signs is a new address showing up in your credit report that is obviously not yours. At a minimum, you should be requesting your free credit reports from or by phone at 1-877-322-8228 every 12 months.

18. Check your card statement as soon as it arrives. Many victims first learn that their card has been used fraudulently while reviewing their monthly statement. Be diligent and read it as soon as it arrives. Also, if you don't get your statement around the time it normally arrives, be concerned. Contact the card company to make sure the delay is on their end, and that someone didn't fraudulently change the address on the account.

Contents Copyright (c) 2007, 2008, 2009 Kenneth M. Smith

If you have found this check-list helpful, please let me know. You may forward a link to this post to anyone on any planet. You may reproduce this article as long as the author is credited and a link to this blog ( is provided. If you would like to use this article for commercial purposes, please contact me by leaving a comment below.

Posted via email from ken5m1th

Tokenization - "check-in" your sensitive data #basc2010

During my presentation on tokenization at the Boston Application Security Conference I mentioned repeatedly that the application that calls the tokenization process should not have the ability to de-tokenize.  This is important because, increasingly, this system is going to be closer to the initial point of data capture.  In the case of an e-Commerce site this means closer to the consumer, like a public-facing web application.  A publicly accessible web application should not have the ability to directly access a full credit card number after a transaction has occurred.  And when I say ‘ability’ I mean that the functionality or code to accomplish this cannot be implemented and no connection to a system that could provide access to a full card number should exist.  It is not sufficient to simply limit this type of activity to a privileged user or process running on this system if you truly want to realize the full benefit of tokenization.    

I also made the point during my presentation that the applications that your typical internal users have access to should not have the ability to de-tokenize, access decryption keys, or even access the encrypted data.  Any of these applications that your internal consumers have access to should only have access to the token value.  The intent of tokenizing is to reduce the storage and the use of sensitive data across the organization, therefore reducing the attack surface and liability of protecting that data.  If you are limiting the access to the de-tokenizing process that is running on the same system that all of your users have access to then you are completely dependent on this access control configuration.  That entire system remains in-scope for the storage of the original sensitive data because this capability exists. 

The best way to summarize these points is to think about the tokenization process as “checking in” sensitive data.  Remember the Roach Motel ads?   In this case, sensitive data checks in – but doesn’t check out (to your standard user or system).  For those exceptions to this rule, users that must have access to the sensitive data directly, they should be provided with access to systems and data in a method that is out-of-band and requires strong authentication, authorization, and auditing. 


Posted via email from ken5m1th

This Fast & Furious game isn't going anywhere

Blue Screen of Death on a Fast and the Furious video game at the arcade.

Posted via email from ken5m1th

If you get this 'AV8SCAN' (fake) warning screen please don't click on "Start Protection"

Screen shot of the AV8SCAN fake AV warning screen.  Fortunately this person knew enough to not click on the "Start Protection" button.

The domain name of this is


Posted via email from ken5m1th

Hey Microsoft - doesnt your marketing dept use spell check?

I'm not sure about you but I don't want anyone to optimie my data center.

Posted via email from ken5m1th

Poor ad placement can make you look like a flop, a great example I just found

Ad placement is pretty important.  At MSN today there is a heading titled "Biggest Flops". When I clicked on it you are presented with this page.

Is this MSN admitting that they are a flop?  Hmmm.


Posted via email from ken5m1th

At #MassTLC the product of the year votes were taken by text message realtime

And the winner is Aurora, maker of a small and foldable UAV/drone

Posted via email from ken5m1th

Verizon Wireless made a booboo from 2006-08 printing exp date on receipts?

Kinda what this settlement notice implies but VZW denies any liability. Specifically, the claim applies only to transactions made with debit cards used with a PIN.

Posted via email from ken5m1th