Incidents of Banking Trojans stealing payment data have doubled in 2022 compared to 2021 reaching 20 million attacks or overall growth in the number of detections of 92%, based on recent data from cybersecurity solutions company Kaspersky. Apart from banking credentials theft, cybercriminals also employed phishing exploiting Buy Now Pay Later (BNPL) services.
These are some of the findings from Kaspersky’s “How customers got scammed amid the Black Friday season in 2022.” Cybercriminals take advantage of the sale season when consumers use different types of payment methods. And with e-commerce becoming the norm, online payment methods have become even more attractive for cybercriminals to exploit.
Once injected, banking Trojans will harvest and saves data the user enters into the website’s forms. This means cybercriminals get access to a credit or debit card number, expiration date and CVV, and the victim’s site login credentials. Having obtained this information, the attackers may use it to empty the user’s bank account, use their card details for purchases or sell the data in the Dark web stores.
APT groups use spam emails to launch attacks — Kaspersky
SandStrike spyware spreads through VPN — Kaspersky
In 2022, Kaspersky experts also found numerous examples of phishing pages for the first time abusing BNPL services. These tools allow customers to split the cost of the purchase into several interest-free installments. These services appeal to consumers, especially youngsters, and have proven to be particularly popular during shopping periods such as Black Friday.
To enjoy the best holiday shopping this year, Kaspersky recommends the following:
- Protect all the devices you use for online shopping with a reliable security solution. Do not trust any links or attachments received by mail; double-check the sender before opening anything.
- Double-check e-shop websites before filling out any information: is the URL correct? Are there any spelling errors or design bugs?
- In order to protect your data and finance, it is best practice to make sure the checkout page is secure, and that there is a locked padlock icon beside the URL.
- If you want to buy something from an unknown company, check reviews before making any decision.
- Despite taking as many precautions as possible, you probably won’t know something is amiss until you see your bank or credit card statement. So, if you’re still getting paper statements, don’t wait until they hit your mailbox. Log in online to see if all of the charges look legitimate – if not, contact your bank or credit card company immediately to fix the situation.