Compiled with the help of artificial intelligence, based on Spanish-language information. Source below the article.
Civil Guard issues warning over digital skimming
Shopping online has become a routine practice for a growing number of consumers, but it is also an ideal route for cybercriminals looking to seize any opportunity to defraud their victims. The Civil Guard has shared a post warning the public about the risks of digital skimming and how it can affect them. “It is a serious threat to e-commerce that consists of stealing bank card data directly from online payment gateways,” the force explains.
Europol has explained how the fraud works and what to do to protect yourself, or if you have already fallen victim. The scam involves obtaining information from the bank cards that customers use as a payment method in online shops. “It is also known as web skimming, online card skimming, e-skimming, formjacking or Magecart,” Europol notes.
How the fraud works
The cybersecurity attack occurs when cybercriminals manage to intercept the data entered during an online purchase. The most dangerous aspect of the scam is that the criminals can obtain this information without their victims realising, in other words without any irregularity being detected during the purchase process. “Affected customers are unaware that their card has been skimmed. From their perspective, they understand that the order has been processed and that the product will be sent to them, without ever suspecting any anomalies or irregularities in the purchase,” Europol says.
Europol divides the digital skimming attack into three phases. The first is illegitimate access, in which criminals “gain access to the support server of online shops or to the source code of tools developed by third parties”. To achieve this they exploit vulnerabilities, configuration errors or brute-force attacks.
Next, they install malware on the shop’s payment gateway. From that moment on, the data entered by customers is duplicated and the cybercriminals begin to obtain the consumer’s personal and banking information.
Advice for online retailers
Europol has issued a series of recommendations for those responsible for online shops so that they adopt a range of measures and make this kind of attack on their security system more difficult. These include using tools capable of detecting malware aimed at web services, and ensuring that staff can recognise “spearphishing” attacks and know how to respond to them. Retailers should also limit access to the shop’s administration panel to authorised IP address ranges, as well as “guaranteeing the regular installation of security patches and critical software updates”.
Finally, Europol recommends implementing Content Security Policies (CSP) and Subresource Integrity (SRI).
What’s happening in the Canaries – straight to your phone
News, weather alerts and practical updates – direct from the islands, in English. We live here and know what’s going on – before the international media catch up. Everything lands on our WhatsApp channel – no middlemen, no algorithm. Curated for families, expats and travelers.
Tenerife shifts FDCAN funds from roads to housing
PSOE warns Arrecife plan could ‘bury’ El Cable beach in concrete
Canary Islands faces loss of 20% of self-employed workers
Canary Islands to get 26 new substations by 2030
Canary Islands poverty rates stuck since pandemic
Court backs eviction over verbal room rental in Arona
Canary Islands pushes for 10-year residency rule for foreign buyers
Canary Islands public websites locked down over PHP security flaw
Supreme Court next stop for illegal Arguineguín homes
