The Canadian Centre for Cyber Security published guidance for safe online shopping ahead of the holiday buying season. The centre warned of increasing risk from AI, which is helping enable more robust scams.
According to the guidance, “threat actors use increasingly convincing techniques to steal personal and financial information, redirect payments and compromise online accounts.” These techniques put personal and business information and assets at risk.
With that in mind, the guidance outlines common threats and how AI is aiding those threats, how to recognize scams and protect yourself, and finally, what to do if you fall for a scam.
Common threats
The cyber centre outlined some common ways that threat actors can steal information, such as creating fake storefronts, payment processing sites, and/or fake checkout pages to steal information. The centre also warned about insecure websites (e.g. those that use HTTP instead of HTTPS), and online stores that don’t offer basic consumer protections.
Other things to watch out for include impersonation scams where threat actors pretend to be other companies or retailers, fraudulent links or QR codes, and requests to move payments outside of secure channels, such as using e-transfer, gift cards, or cryptocurrency.
AI makes many of the above behaviours much, much easier for scammers. It can help create convincing, professional-looking websites, ads, reviews, and more.
Elsewhere, the guidance warns of AI-powered shopping assistants that can make recommendations or even complete purchases.
“AI tools cannot reliably determine whether a seller, website or offer is trustworthy or fraudulent in the same way a person can. You should remain actively involved in shopping decisions and verify sellers and payment details. Treat AI-generated recommendations as guidance, not assurances of legitimacy,” the guidance says.
This warning is particularly prevalent amid the rise of AI apps like Meta’s Muse, which claims to be able to handle various tasks like shopping on behalf of users. However, not only are there risks with using AI shopping assistants, but these apps often have their own security problems. Muse, for example, had a serious security flaw at launch that allowed any app or terminal command to essentially take over the AI assistant and do whatever attackers wanted on the victim’s device. Yikes!
I’d go one step further than the cyber centre guidance and encourage people not to use AI apps and tools like this at all, given the significant security risks involved.
How to recognize scams and protect yourself
When shopping online, there are a few things to watch for that can help you spot potential scams.
Look for things like poor design that makes sites look unprofessional, or for elements like buttons or links that don’t work properly. Legitimate sites typically also offer policies for users, such as privacy or refunds and returns — check for those and make sure the policies in place make sense. Similarly, look for clear, accurate contact information. Finally — and this advice is universally helpful — you should question any requests for personal or financial information, especially if it’s not needed for or relevant to your purchase.
However, scams go beyond websites, so the Centre for Cyber Security also shared tips for recognizing other types of scams, like suspicious messages or offers. Be wary of offers that seem too good to be true and of pressure tactics that urge shoppers to act quickly. Moreover, watch for unexpected or higher-than-usual charges, and be wary of unexpected follow-up messages. (For example, there’s an ongoing carrier scam that tricks people into sending recently purchased products to scammers.)
Along with recognizing signs of possible scams, there are actions Canadians should take to protect themselves when shopping online, even with legitimate retailers.
When shopping, always do your research — look up independent reviews from beyond the retailer’s website, look into how long a retailer has been operating, and search for complaints and reports of scams or other customer issues.
For online browsing in general, make sure you’re connecting to secure websites. Look for HTTPS in the URL, which signifies a secure connection (most web browsers will show an icon like a shield or padlock in the URL bar to indicate whether a site is secure, and may even show warnings if you connect to an insecure website). Always double-check the URL, since common scams rely on tricking people with fake URLs. For example, a fraudulent site pretending to be Amazon might replace the ‘o’ with a zero so that it looks legit at a glance. This is extra important on mobile, where URLs are often shortened because of the limited screen space. And never click links that are sent to you via email or text message.
Finally, it’s important to protect your accounts by creating strong passwords or passphrases and using multi-factor authentication (MFA) whenever possible. While the cyber centre guidance doesn’t mention this, it’s a great idea to use a password manager, which can help users create and store strong, unique passwords for every account they use.
What to do if you fall for a scam
Wrapping things up, if you do fall for fraud, there are a few things you should do after.
First, notify relevant people, like your friends and family or your employer so they can help.
Next, contact your financial institution or credit card company to report the fraud. They’ll be able to help you take steps to secure your finances or possibly reverse fraudulent charges.
Third, reset your affected accounts, such as email or social media, as well as any accounts that used a similar password to the one that was compromised. (Again, if you’re using one password, or a variation of one password, across multiple online accounts — don’t! If you do that, one compromised account can expose everything.)
Finally, report the incident to Canada’s Anti-Fraud Centre. You should do this even if you didn’t lose any money, because knowing about ongoing scams can help spread awareness and aid in stopping fraud.
For more details on how to protect yourself during the holiday shopping season, check out the full guidance.
News 
Gaming 
News 
News 