Safe Online Transactions

I woke up this morning to a flurry of (legitimate) text messages from Amazon asking me to confirm a login attempt to my Amazon account overnight, which was allegedly made by a (presumably) malicious actor trying to gain access to my account. While the malicious actors' attempts were unsuccessful, it has triggered a review of my Amazon account this morning, including a password reset and a change of #multifactor access using an authenticator app and not text message/email address (which are inherently less secure). I encourage you to exercise extreme caution with #blackfriday and #cybermonday. Steps you can take: 1) Don't click on email or SMS links or access sales offers. Phishing skyrockets during sales periods. If you see a deal, go directly to the retailer’s official website by typing it into your browser manually, or, if you're a shopaholic, use a saved and trusted browser favourite/bookmark instead. 2) Switch on Multi-factor Authentication on any retailer website where you are storing payment details, and in fact on any website that has the functionality. These include popular platforms such as Amazon and eBay, but most reputable retailers also offer this functionality. 3) Stick to trusted retailers: If you’ve never heard of the site, and the price looks unbelievable, it probably is. Check reviews, business details such as ABN's and ACN's, and whether the site has proper contact details. 4) Use strong, unique passwords (and a password manager): Password reuse is a goldmine for attackers. A password manager makes this effortless. 5) Beware “too good to be true” deals: If it’s 80% off and only available for 'the next 5 minutes', then it's probably a bait. High-pressure countdowns are commonly used in scam pages. 6) Use secure payment methods: Credit cards, PayPal, and Apple/Google Pay provide fraud protection. Avoid direct bank transfers and debit card payments for online purchases. 7) Check the site security: Look for https:// (with the 's', not just 'http'). Remember, though, that HTTPS alone doesn’t mean a site is legit; however, it is one signal that helps. 8) Keep your device updated: Make sure your phone and laptop have the latest #patches. Old software means easy exploits. 9) Avoid public Wi-Fi: Free Wi-Fi is often a gift to attackers, because if you connect to it, it provides a #cybercriminal the means to be between you and a legitimate site, and they gain access to any traffic in between. Use a mobile hotspot from your phone if you have to. 10) Monitor your bank accounts: Check your statements and email notifications for unusual activity. A few years ago, my bank accounts showed a plethora of luxury purchases which, for a change, weren't my partner's or mine (I'm kidding, we shop at Kmart). The bank reversed them the same day. The earlier you catch fraud, the easier it is to stop. https://lnkd.in/gfG_QGBn Novera

The holiday shopping season is one of the most active—and vulnerable—times of the year for consumers. With record online traffic, criminals ramp up phishing attempts, fraudulent websites, and account-takeover attacks. A single lapse in judgment can expose your personal data, financial information, and even your identity. Cyber safety is no longer optional; it’s a discipline. Here are several detailed practices to help you stay protected while shopping online this holiday season: 1. Prioritize Secure Websites Before entering any personal or payment information, confirm the website uses HTTPS, not HTTP. The “S” stands for secure, meaning data is encrypted in transit. Be cautious of websites with poor spelling, mismatched domain names, or no clear contact information—these are common red flags for fraudulent retail pages. 2. Strengthen Your Password Hygiene Weak or repeated passwords remain one of the biggest vulnerabilities. Use complex, unique passwords for retail, banking, and email accounts. Better yet, consider a password manager and enable multi-factor authentication (MFA) wherever possible. MFA is one of the most effective barriers against account takeovers. 3. Avoid Public Wi-Fi for Financial Transactions Public Wi-Fi networks—airports, malls, cafés—are notoriously easy to exploit. Criminals can intercept traffic or create fake “look-alike” networks. If you must connect, use a VPN or switch to your mobile hotspot to ensure your data remains encrypted and private. 4. Buy Only From Reputable Retailers Fraudulent storefronts surge during the holidays. Stick with trusted brands or verified online marketplaces. If a price seems unrealistic, it likely is. Always check reviews, confirm the URL, and look for customer service information before making a purchase. 5. Continuously Monitor Your Accounts Set aside a few minutes each day during the season to review your bank statements, credit card activity, and transaction alerts. Early detection of suspicious activity can prevent a small unauthorized charge from becoming a larger financial or identity-theft issue. 6. Choose Credit Over Debit Credit cards offer built-in fraud protections and do not provide direct access to your bank balance. If your credit card number is compromised, your bank account remains safe and your liability is limited. For an added layer of protection, use virtual credit card numbers if your provider offers them. Staying safe online isn’t about being fearful—it’s about being prepared. A few intentional steps can dramatically reduce your risk while still allowing you to enjoy the convenience of online holiday shopping. Wishing everyone a safe, secure, and enjoyable holiday season.

You're at checkout on Flipkart. The cart is ready. Payment details are filled in. Then you wait. Five seconds. Ten. The OTP still hasn't arrived. You retry. Wrong OTP. Too late. Transaction failed. That story is deeply familiar to anyone who shops online in India. This friction has quietly cost millions of completed transactions across e-commerce platforms for years. Flipkart, Axis Bank & PayU decided to fix it properly together. Their biometric authentication for card payments replaces SMS OTPs with Face ID or fingerprint verification, a mechanism already embedded in every modern smartphone. The result is instant approval with zero SMS dependency and a checkout experience that finally feels effortless. Beyond convenience, device binding and enhanced security checks reduce SIM-swap fraud and OTP interception risks, two of the most common attack vectors in India's payment landscape. Flipkart's decision to lead this transition says a lot about where their priorities sit. Better experience and better security, delivered together at scale. As fraud values crossed ₹1,400 crore in FY2024, this launch is timely, meaningful, and very welcome. #Flipkart #AxisBank #PayU #DigitalPayments #Fintech #ECommerce https://lnkd.in/dheCmSBx

How Secure Are Our Digital Payments? A Deep Dive into POS Machine Security Digital payments are an integral part of life in India today. From paying the sabjiwala to the dudhwala, we rely heavily on QR codes and POS machines from platforms like Paytm PhonePe BharatPe and JioPay Business But recently, I started wondering: How secure are these transactions? Is my payment data encrypted end-to-end? Could it be intercepted, or is it truly safe? To get answers, I didn’t stop at curiosity—I went deep into the technology behind it. Here’s what I did: 1. Accessing the Hardware I started by reverse-engineering a POS machine. Using advanced techniques like JTAG, UART, and SPI probing, I examined the hardware layer, focusing on the MediaTek ARM chipset and Dosilicon flash chip. However, due to the no-lead design of the DIP package, direct probing wasn’t possible. So, I performed a chip-off technique, physically extracting the flash chip for deeper analysis. 2. Firmware Analysis After dumping the firmware from the EEPROM chip, I tested its integrity: • Entropy Check: Confirmed strong encryption with high randomness levels. • File Security: Sensitive files, including certificates and keys, were securely encrypted. Using Ghidra, I reverse-engineered the binary files to understand the underlying code. I was impressed to find the use of safe coding practices, with no shortcuts that could compromise security. 3. End-to-End Security From hardware to software, every element of the system demonstrated robust security mechanisms. The POS machine is designed to prevent tampering and protect payment data, ensuring that encryption remains intact throughout the process. What This Means for Us This research gave me a sense of relief: our digital payments are secure. The meticulous design of these systems—from hardware protection to software encryption—ensures that your sensitive payment data stays safe. Why It Matters We often take convenience for granted, but trust in the technology behind it is crucial. After seeing the depth of security firsthand, I’m confident that our payments are well-protected. Have you ever thought about the security of your payments? Let’s talk—I’d love to hear your perspective! #DigitalPayments #POSSecurity #CyberSecurity #ResearchJourney #SecureTransactions #India

The holidays are coming, and while for many people that means twinkly lights, cozy nights, and festive times with loved ones, it’s also a peak season for fraud. Increased spending, rushed decisions, and enticing online deals create the perfect opportunity for scammers to take advantage of unsuspecting consumers. Don’t let these grinches ruin your holidays. In the coming weeks, I’ll be sharing tips for spotting some of the most prevalent scams of the season, along with tips for consumers and how Microsoft and other industry leaders are responding to these threats. With Black Friday coming up, we’ll start with credit card safety. According to the FBI, credit card fraud alone cost consumers $173 million in losses last year. Before you start shopping, check out these tips to stay safe and smart this season: 👀 𝗠𝗼𝗻𝗶𝘁𝗼𝗿 𝘆𝗼𝘂𝗿 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀: Check your statements and transaction history daily and set up real-time alerts with your bank or card issuer to catch suspicious activity immediately. 💳 𝗦𝗵𝗼𝗽 𝘀𝗺𝗮𝗿𝘁: Only enter payment details on secure sites (look for https:// and a padlock icon). Never click on ads or links in unsolicited emails or text messages – this is a common phishing tactic. 🚩 𝗪𝗮𝘁𝗰𝗵 𝗳𝗼𝗿 𝗿𝗲𝗱 𝗳𝗹𝗮𝗴𝘀: Slow down! Look out for poor spelling and grammar on websites and requests for unusual payment methods (crypto, gift cards, etc. – more on this later). Remember, if an online deal looks too good to be true, it probably is! 🔒 𝗦𝘁𝗿𝗲𝗻𝗴𝘁𝗵𝗲𝗻 𝘆𝗼𝘂𝗿 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆: Enable multi-factor authentication on all your account sites, use a password manager, and make sure all your devices are updated with the latest security patches. 📦 𝗔𝘃𝗼𝗶𝗱 𝗱𝗲𝗹𝗶𝘃𝗲𝗿𝘆 𝘀𝗰𝗮𝗺𝘀: If you receive a text message about an “undeliverable package” or other delivery problem, do not click any links or call any numbers in the message – reach out to the delivery company directly. ⏱ 𝗔𝗰𝘁 𝗳𝗮𝘀𝘁: Report any suspicious transactions immediately, freeze your card, and dispute any fraudulent charges. File complaints with the FTC or IC3.gov. 🎁 The best gift you can give yourself this season? Peace of mind! Stay tuned as we tackle gift card fraud, gaming scams, tech support scams, and fake ads. #TisTheSeasonForScams

Have you ever wondered what really happens when you "Add banking card" on an app? Some apps in Algeria let users to save their card details for quick, one-click payments, but this convenience comes with a price. Unlike other networks, SATIM doesn’t allow card info to be stored on app servers, as part of their official security guidelines. This rule is in place to help protect against unauthorized access and fraud. But with online payment fraud on the rise in Algeria, we’re seeing a concerning trend: some apps may be bypassing this rule and storing card details anyway. And while these apps may reassure users by saying, “We’re PCI-DSS certified,” even the biggest names, like Capital One and JP Morgan Chase, have suffered major breaches despite following these standards. PCI-DSS compliance is helpful, but it’s not a guarantee against leaks. Complex cyber attacks and security gaps can still expose sensitive information. In the past few weeks, many users in Algeria have suffered from online payment fraud. Could unauthorized storage of card data be part of the problem? With SATIM recently experiencing outages, it’s fair to ask whether these risky storage practices are contributing to the issue. Apps that let you “Add Your Card” might actually be adding to the risk. Knowing where your data is stored and choosing not to save sensitive info might be the best way to stay safe from e-payment frauds. Protect your info, think twice before adding and storing your card on apps. #SecurityAwareness #OnlinePaymentRisks #DataProtection #SATIM #PaymentFraud

It's important to recognize that you are continuously targeted by scammers, fraudsters, and cybercriminals who are attempting to exploit your vulnerabilities. These threats often come in the form of urgent messages designed to create panic, such as fraudulent alerts from financial institutions. Whether or not you have an account with the institution, these tactics are intended to prompt a hasty response, potentially leading you into their trap. When you receive such a message, it's crucial to remain calm and deliberate in your response. Consider the following steps: Verify the Relationship: - Ask yourself, "Do I have a product or account with this bank?" - If the answer is no, this is likely a phishing or smishing attempt. - If the answer is yes, do not click any links in the message. Instead, contact your bank or financial institution directly to verify the legitimacy of the alert and get guidance on next steps. Assess the Communication Method: - Consider whether it's typical for your financial institution to contact you via text or email with a link. Most reputable institutions will not ask you to provide sensitive information through these channels. Cross-Check with Other Communications: - If the message mentions an attack, check your email or other secure communication channels for any corresponding alerts from your financial institution. By asking these critical questions, you can significantly reduce your risk of falling victim to a scam. Additionally, follow these best practices to safeguard your personal information: - Avoid Password Reuse: Never use the same password across multiple sites or accounts. - Strengthen Your Email Security: Enable Multi-Factor Authentication (MFA) and consider using an authenticator app to add an extra layer of protection. - Monitor Financial Activity Regularly: Routinely review your bank and credit card statements for any unauthorized transactions. - Set Up Transaction Alerts: Opt in for notifications for every transaction on your bank accounts and credit cards. While no security measure is completely foolproof, taking proactive steps can greatly reduce the chances of a fraudster succeeding. Doing nothing only increases your vulnerability. These are somethings I continue to advocate as a participant in the fraud prevention space. I have to continue to remind myself, that what I think is obvious is not obvious to all. Hence we need to continue to improve literacy around this topic. #FraudPrevention #CyberSecurity #StaySafeOnline #DigitalSecurity #ScamAlert #OnlineSafety #PhishingAwareness #SMShing #CyberAwareness #FraudAwareness #FightFraud #StopScams #SecurityTips #BeVigilant

This weekend, a family member got scammed. She's not careless. She's actually pretty cautious. But she got a text alert that her debit card had been used at Target for a large purchase. The message looked legitimate. It had her bank's name. It created urgency. And it offered a simple solution: click here to resolve it. So she did. The link took her to a website that looked exactly like her bank's site. She entered her information, thinking she was securing her account. Problem solved. Except it wasn't her bank's website. And the compromised card number? Well, they got it directly from her, on a fake site she believed was protecting her. Listen, there's no shame in this. According to the FTC, imposter scams drove nearly $3 billion in losses in 2024. Total fraud losses topped $12.5 billion, up 25% from 2023. These are professional criminals running sophisticated operations. Here's what makes these attacks so effective: they weaponize our instinct to protect ourselves. The criminals create the problem and offer the solution in the same message. But community banks have a genuine advantage here. You know your customers. When Mrs. Johnson starts behaving differently, whether it's clicking unusual links, making atypical transactions, or asking strange questions, your people notice. That front-line teller who's known her for years can spot behavioral changes that automated systems miss. Believe it or not, "that doesn't sound like something Mrs. Johnson would do" is a legitimate fraud control when you actually know Mrs. Johnson. Big banks can't compete with that. What should we do about it? Train staff to recognize social engineering beyond the transaction itself. Make it easy for customers to verify communications - put clear instructions on every statement. And educate proactively: your bank will never text you a link to resolve fraud. For all of us: slow down. These scams work because they create artificial urgency. When you get that urgent message, pause. Close the text. Call your bank directly using the number on your card. You're trusted in your community and you know your customers. Use those relationships to protect people. That's not just good security - it's good stewardship.

𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗟𝗮𝘆𝗲𝗿𝘀 𝗶𝗻 𝗕𝗹𝗶𝗻𝗱𝗣𝗮𝘆'𝘀 𝗦𝘁𝗮𝗯𝗹𝗲𝗰𝗼𝗶𝗻𝘀 𝘁𝗼 𝗟𝗼𝗰𝗮𝗹 𝗖𝘂𝗿𝗿𝗲𝗻𝗰𝘆 𝗣𝗮𝘆𝗺𝗲𝗻𝘁 𝗣𝗿𝗼𝗰𝗲𝘀𝘀 This breakdown outlines the robust security measures implemented by BlindPay to ensure safe and compliant transactions when converting USDC to local currencies. 🛡️ Blockchain Wallet Screening BlindPay supports integration with various blockchain wallet infrastructures, including: - Multi-Party Computation (MPC) wallets - Externally Owned Accounts (EOA) - Account Abstraction (AA) wallets For every wallet interacting with BlindPay, our trusted partner CUBE3 AI conducts thorough verification: - Checks for government sanctions - Screens for potential fraud associations This proactive approach helps maintain the integrity of our platform and protects our users from inadvertently engaging with high-risk wallets. 🪪 KYC/B and Transaction Screening As a provider of regulatory and compliance infrastructure, BlindPay prioritizes a robust verification process: 1. All users must complete our automated compliance procedure, powered by our partner AiPrise. 2. The level of Due Diligence determines user transaction limits: > Higher Due Diligence = Higher limits > Lower Due Diligence = Lower limits This tiered approach ensures appropriate risk management while offering flexibility to our diverse user base. 👀 Transaction Monitoring Our system employs continuous vigilance during the off-ramping process between blockchain wallets and bank accounts: - Automatic detection of suspicious behavior - Immediate notification triggering for flagged activities - Initiation of an in-depth due diligence process when necessary If our investigation confirms suspicious activity, we take two critical steps: - File Suspicious Activity Reports (SARs) with relevant authorities - Block future payments from the flagged user This multi-layered security approach demonstrates BlindPay's commitment to maintaining a secure, compliant, and trustworthy platform for all our users.

🎯 Don’t Let Cybercriminals Steal Your Cyber Monday! 🎯 It’s #CyberMonday, one of the busiest online shopping days of the year, and while you’re hunting for deals, the #cybercriminals are hunting for you. Trust me, they’ve been waiting for this. With billions of stolen emails and passwords floating around on the dark web from recent data breaches, these bad guys are primed and ready to strike. So here’s the deal: their whole game plan is to get you to click that link or visit a fake website that looks legitimate. But if you’re not careful, that click could lead to malware, stolen credentials, or worse. 💡 Here’s why Cyber Monday is prime time for cybercriminals: • 🛑 Phishing Frenzy: Expect emails that look too good to be true—fake deals from “Amazon,” “Best Buy,” or “Walmart.” Their goal? To steal your login information or install malware. • 💻 Malware Mayhem: Clicking on a malicious link could infect your computer, leading to ransomware attacks or theft of sensitive data like your bank account login. • 🔐 Fake HTTPS Websites: Don’t let the lock symbol fool you. Cybercriminals are creating their own “secure” sites to trick you into entering personal information. 💡 Here’s how to stay safe this Cyber Monday: • 🔒 Use a Credit Card: Always use a credit card when shopping online. It’s much easier to dispute fraudulent charges than it is to recover stolen money from your bank account. • 🛑 Think Before You Click: If it looks too good to be true, it probably is. Go directly to the retailer’s official website to verify the deal. • ✉️ Avoid Suspicious Emails: Don’t click on links in emails from senders you don’t know. Type the retailer’s URL directly into your browser. • 📱 Enable Two-Factor Authentication (2FA): Add an extra layer of security to your accounts to keep hackers out. • 🧠 Adopt a CyberSecure Mindset: Most cybercrime during the holiday season could be prevented with simple steps like these. This holiday season, don’t let the bad guys ruin your joy—or your bank account. I had the privilege of discussing this very topic with Scott Couch on Fox 17 Nashville, and I can’t stress this enough: staying safe online starts with awareness. Most cybercrime victimization can easily be prevented with the right knowledge and a few controls. 👉 Visit www.stealthfamily.com and www.cybersecuremindset.com for more tips on protecting yourself and your family this holiday season. Let’s make this holiday season about giving, joy, and family—not dealing with cybercrime. #CyberMonday #CyberSecurity #StaySafeOnline #FraudPrevention #PhishingScams #CyberSecureMindset #StealthFamily #HolidayShoppingSafety Stealth Family Corey Munson Marc Evans, CFE Mark Bruns Kevin D. Calvin Groeneweg, RN C-AL Jeff TaylorTrae Bodge Christopher Hamilton Alfred Najem Maxwell Brouse Darren Mott, FBI Special Agent (Ret.), "The CyBUr Guy" Darren R.