In Plain English:
Keeping Your eMoney Safe
By Elissa Shevinsky
I remember the first time I made a purchase online. It was the mid-nineties, and I had bought a jar of Manic Panic hair dye. I couldn’t believe that it was safe to put my credit card online. I did it anyway.
It turns out that international hackers weren’t that interested in teenage girls buying Goth fashions, and I came to feel secure making online transactions. But times have changed. Hackers have become more aggressive, more pervasive and more sophisticated.
We need our banking institutions — credit cards, ATMs and online banking — to be safe. But the truth is, fraud (credit card fraud and other financial hacks) is escalating fast. Large companies like Target and Home Depot have been hacked, and it’s your data that’s getting stolen.
Even banks can’t keep their financials secure. In 2014, one ring of sophisticated hackers stole nearly $1B from banks including JP Morgan. Even the White House has reportedly had its data breached by international hackers.
It is clear that we can’t rely on companies, banks or the government to be our sole protection from the bad guys. It’s also up to you to keep your money safe. Knowing this, what can you do to protect yourself and your finances?
Ten Ways to Safeguard Your Money
Here are ten observations — small habits really — that I've used to
practice safe online money. Some are extreme; others casual.
Do what works best for you.
Use your credit rather
than your debit card
When your credit card information is stolen, the hackers have stolen your future credit. That’s pretty easy to get back from the bank — and less scary than having your actual cash stolen. In contrast, it can take several days or longer for the bank to restore cash to your debit-card account. In the meantime, you don’t have access to that money. This issue can be avoided by using credit cards for your purchases. If you don’t have a credit card, it’s worth putting in the time and effort to get one.
Store your money somewhere secure
Don’t use your debit account as a savings account. Instead, keep just enough money in your debit and checking accounts to cover expenses. Use more than one checking account, if you need your cash reserves to be highly liquid. (There are banking regulations around how frequently you can withdraw money from savings accounts.) All that a hacker needs to get access to your banking funds is the routing number, the account number, and a check number. Keep the information about those accounts private, as much as possible and check your statements regularly.
Store your money for safekeeping somewhere else, like a savings account or stocks, bonds, and other investment vehicles.
Don’t save your credit card
info on websites.
When you make purchases online, companies encourage you to save your account information. It is usually in the form of a check box at the end of the transaction, saying something like “Save My Info.” This makes the checkout process more convenient, but it comes at a risk. The risk is trusting your credit card data — and related data, like your full name and address — with that company. If (ha! or when) that company gets hacked, then your credit card data gets stolen as well. It’s safer to enter your information every time you make a purchase online.
Note that many websites use a third-party processor such as Authorize.Net or Paypal. In this case, you are redirected to a third-party where you enter your card data. The merchant never sees the card data; they only get the money. As a result, if the website is hacked, there is no card data to lose.
Avoid phishing attacks
Hackers send out emails posing as your bank. This is known as “phishing.” Like fishing, but misspelled. These phishing emails can look exactly like they came from your bank, and lead to websites designed to look like your bank’s website. The goal is to trick you into thinking they are your bank. If you click on those links and attempt to log in, then you will share your login information with hackers. These phishing attempts are easy enough to avoid — always go directly to your bank’s website by typing in the URL. Also avoid giving out any personal banking information to individuals over the phone.
Use your bank settings
Your bank account has settings, just like any other kind of account. These settings can help you prevent fraud. Specifically — you can disable international wire transfers and put caps on other wire transfers. This can help prevent or limit fraud. Ask your banker about options to limit possible fraud. (They might look at you funny, because most people don’t worry about fraud until it’s already happened. Just smile and nod, knowing you are doing the smart thing.)
Be careful with ATMs and anywhere that you swipe your card.
Sophisticated hackers can use technology known as “skimmers” to copy your credit card information. This post by security researcher Brian Krebs gives a very thorough overview of the different skimmers and how they work.
Skimmers are pieces of hardware (bogus card readers) that can be installed — often invisible, unless you know what to look for — on ATMs and other places where you swipe your debit card. What’s important about skimmers is that they allow bad guys to copy and use your debit cards, even if you have not physically lost your card. The latest trick is to install these skimmers on the card readers that you use to get access to an ATM machine at a bank, after hours. According to Krebs, these bank scammers are also installing cameras in an effort to get your pin number. Covering your pin number with your hand (or your briefcase/handbag) as you type it in can help- but there are now overlays for keyboards that look just like the original. These keyboard overlays capture your keystrokes (in other words, your password.) So it can be hard to completely eliminate the risks at the ATM.
Some skimmers are easily fooled, and will accept your library card or other ID card. If the card reader accepts your library card, then it’s probably a skimmer!
Skimmers can be hard to avoid entirely, if you are using ATMs. Minimizing the amount of cash in your debit account can minimize your risks. You can also make less frequent trips to the ATM, but carrying large sums of cash comes with a different set of risks. It can be hard to avoid scammers entirely, which brings us to item #7…
Check your statements
This is a low tech solution but it works really well. If you don’t check your statements, then you may not notice if your account is compromised. The first step in damage control is knowing that a breach has happened!
Develop a relationship with your bank
Friendliness and a basis of trust will make things easier in the event of fraud. Work with a small bank or credit union, if that option is available to you. If you are working with a larger bank, then get to know your local bankers. The burden is partly on the consumer to prove that fraud happened on an account. A positive history and some trust with your financial institutions will make it easier to get through difficult (and honestly, bureaucratic) experiences like having your credit card stolen.
If you want to be extra careful…
If you’d like to be extra careful, use a special laptop (or tablet) just for online banking. A non-trivial amount of fraud happens because hackers or other third parties have compromised an entire computer or phone. They do this by getting you to install malware on your machine which lets them log your keystrokes (so they can learn all your passwords) or intercept your web browsing (so they can pretend to be your banking website, and steal your passwords.)
You need a new machine, not a used one — the whole point is that it has never been used for general web browsing. Go directly to the bank url. Don’t use this machine for web browsing, emails or downloads. Don’t use it to charge devices, as that can also be a method for transferring computer viruses or malicious code.
Using a separate machine just for your banking may seem extreme, but net books and tablets are relatively cheap these days. You don’t need the most powerful machine, since you’re only using it to log into your bank(s). Now you’re hardcore!
Of course, be careful with your WiFi — don’t use public WiFi (like Starbucks) for sensitive transactions (like banking or credit card transactions.)
Have backups
Specifically backup credit cards (or debit cards, if you don’t have credit) in case your primary credit card is compromised. This will let you continue with business as usual while you deal with the headache of having your accounts restored.
We’re living in wild times, financially speaking. The tools that we rely on for our financial transactions are imperfect, and bad guys all over the world are after your money. The truth is that even the top security experts in the world have had their credit cards stolen — at least, if they shopped at Target, Home Depot or any other company that lost customer data. These experts know that it’s impossible to prevent hacks but they can take steps to minimize their risks. And now you can too.
