Retailers brace for Black Friday cybersecurity onslaught

With Alibaba to haul US$38.4 billion in sales on Singles’ Day this year, Black Friday is the next highly-anticipated shopping holiday of the year.

In terms of cybercrime, it’s also one of the most high-risk times of the year, with cybercriminals seizing on the peak shopping frenzy to attack retailers and customers alike.

Amid the high volume of sales, threat actors can take advantage of the glut of retail emails to seed spear-phishing attacks, while increased transactions provide a smokescreen for the use of stolen payment information, with less risk of detection.

“Two common patterns are multiple transactions of a low-priced item— a 99 cent holiday gift, for example— in order to test if the credit cards are active and also multiple purchases of one high-value item that can easily be resold,” Ray Hillen, Managing Director of Cybersecurity at Agio, told TechHQ. 

The rise of automation only sharpens the cybercriminal’s toolset for compromising data— one of the more sophisticated approaches involves deploying an army of ‘Grinch bots‘ to harvest details of customer accounts, robbing victims of their loyalty points and gift card values. Popular and limited edition products are purchased in abundance and resold in secondary markets for a higher price.

Each year, however, retailers and customers alike must be prepared for both a return of tried-and-tested methods and changing trends. In 2019, Hillen expects an increase in fraudulent websites and typo-quatting that lure customers away from legitimate sites, with the aim of mimicking the real thing, and compromising payment data as it’s entered.

“Additionally, bad actors send phishing emails to call centers and customer service with malicious attachments or links labeled as an invoice or fraudulent charge on credit card statement impersonating customers.”

Even though the majority of emails sent to customer service are not from trusted senders, there is immense pressure for representatives to look through them to ensure no customer complaint falls through the cracks during the seasonal spike. 

Safety measures 

For the safety of company and customer data, organizations can look into anti-phishing platforms to alert organizations of emails containing malicious content. Experts are also calling for more sophisticated encryption on web traffic for improved security, yet this trend may pose new challenges for existing phishing detection tools.

Besides more resilient and intelligent cybersecurity systems, many believe it comes down to more training and awareness among both retail staff and customers to combat threats.

Earlier this month, for example, the United States Computer Emergency Readiness Team (US-CERT) issued a warning regarding a forthcoming rise in Holiday Shopping, Phishing, and Malware Scams.

“As this holiday season approaches, the Cybersecurity and Infrastructure Security Agency (CISA) encourages users to be aware of potential holiday scams and malicious cyber campaigns, particularly when browsing or shopping online,” it warned. 

“Cyber actors may send emails and e-cards containing malicious links or attachments infected with malware or may send spoofed emails requesting support for fraudulent charities or causes.”

Staying on high alert during the shopping season and aware of the modus operandi of cyberthreats can prevent organizations from falling into million-dollar traps and having a blue Christmas.

In this digital economy, the convenience and appeal of online shopping is driving businesses to go online and involve further parties in their retail supply chain, and with the trust of their customer data; “third party risk will continue to grow as more retailers outsource functions of their operations and customer service and rewards programs,” said Hillen.

“While data privacy is always a concern, retail operations can be interrupted if a critical link in the supply chain is broken. Hence, retailers need to understand the cyber operational maturity of their providers and have a backup plan.”