Security for Your Online Purchases

Implementing safe online shopping practices lowers the risk that you will be the victim of identity theft and fraud. Identity theft occurs when your personal information, such as your name, email address, payment information, or social security number, is obtained by an unauthorized person. Using that information, criminals can make purchases under your name with your payment information.








What if there are unauthorized charges on my credit card?







Why does password security matter?


How do I create a strong password?

Strong passwords take hackers longer to crack than weak passwords. The most important factor in creating a strong password is its length. You can create a strong password by following these guidelines:

  • Create a password that has at least 10 characters composed of alphabetic (uppercase and lowercase), numeric, and special characters. An example is "9@jeg2H54!w".
  • One way to create a memorable password is to take the first letter of each word in a meaningful (but not overly common) phrase, and add numbers and punctuation. For example, "3+RiffMs!2" is derived from "rhythm is food for my soul."
  • Avoid weak passwords such as dictionary words, names, biographical information, numbers, and identifiable patterns or phrases. These are easy to guess. Thus, you should avoid passwords such as "doglover", "Nicholas", "Miami1964", and "123456."

Create a different password for each website account, your computer, and your wireless network. If you use the same password for multiple accounts, a person who steals it will gain access to all of your accounts instead of just one.

When you register with a website, you may be asked to create security questions and answers to verify your identity if you lose your password. Your answer should not be obvious to people who know you and are familiar with your pet's name, favorite color, and birthplace. Information of this sort may even be visible on your social media webpages.

Create responses for the security questions that only you can answer. For example, if the security question asks you to name your birthplace, enter the name of your favorite cookie instead.

How can I keep track of my passwords?

With the number of password-protected accounts you have, it is unlikely that you will remember all of your strong passwords. Secure password management systems are the most advanced way of keeping track of your passwords, but there are still risks. You should only use an online password manager if it requires a strong master password to view your other passwords and encrypts the passwords it stores. Similarly, you should ensure that your browser password manager does not display passwords in plain text. Another option is to write down your passwords on a piece of paper and keep it in a secure place.

What is a web browser?

A web browser is software on your computer that allows you to connect to websites. Mozilla Firefox, Internet Explorer, Apple Safari, Google Chrome and Opera are common browsers. Because the browser directly connects your computer to the Internet, you should ensure that your browser protects against attempts to steal your personal information.

How can I tell if my web browser is secure?

Your web browser shows how your personal information is secured during your online shopping. To optimize browser security, you should take the following actions:

  • Use the most current version of your browser. The most current version of a browser is likely to be the most secure, because older versions may have security holes. Go to your browser's website to get the current version. For the same reason, update your browser's plug-ins and extensions.
  • Check for "https" in the web address. The security of a webpage is signified by "https" (rather than just "http") at the beginning of the website address. The "s" means secure and indicates information is transmitted using Secure Sockets Layer encryption, which is the industry standard.
  • Look for the lock icon in the address bar. The lock icon further informs you about the webpage's security. A closed lock indicates that the information is encrypted during transmission. A broken lock indicates that information is not encrypted. Avoid purchasing through webpages with a broken lock.

What is malware?

Malicious software, or malware, can compromise the security of your personal information. Malware infects computers through email attachments, online advertisements, downloads, web browsing, and computer media. Common types of malware include viruses, worms, Trojan horses, spyware, adware, rootkits, and bots.

How does malware make my personal information vulnerable to fraud?

Some malware is designed to obtain your personal information by accessing your computer. For example, worms and Trojan horses serve as a vehicle for other malware, such as keyloggers and backdoors. Keyloggers record each key you type and take screenshots of what is displayed on your monitor. Backdoors provide an easier way for hackers to avoid authentication processes. You may not know malware is infecting your computer until your personal information has been used fraudulently. To lower the risk of malware infecting your computer, you should do the following:

  • Scan your computer with updated anti-malware software. New malware surfaces daily and good anti-malware software is updated just as frequently to protect against the newest threats. Forgoing routine scans for your computer (and any attached media and hardware) with the current software leaves your computer vulnerable to attack.
  • Use a firewall. A firewall is software or hardware that makes it harder for malware to gain access to your computer. Firewall software is part of the current Windows and Apple operating systems. You can also purchase third-party software. Some routers also include firewall protection.
  • Set your computer to update your operating system automatically. Operating systems have security vulnerabilities, and the updates fix these vulnerabilities. Failure to routinely update your operating system, which may include your firewall, leaves your computer vulnerable to attack.
  • Secure your wireless network. Protect your wireless network with a strong password and encrypt your network with WPA2, which offers protection superior to that of older alternatives WEP and WPA. Additional information can be found here.
  • Avoid risky webpages. Certain websites exist primarily to infect your computer with malware. Some pop-up advertisements and webpage ads are examples of this. Some file-sharing websites, which allow people to pass files from one computer to another, have also been known to spread malware. You should download files only from reputable websites.
  • Avoid opening emails from unknown senders. Unknown senders may use the email links, attachments, and images in the body of the message to download malware to your computer.
  • Avoid opening unfamiliar files. Even files sent to you by friends can contain malware without their being aware of it. Scan incoming email with your anti-virus/anti-malware software first.
  • Disable cookies. Enabling cookies allows websites to monitor your website browsing. A hacker could use your history to access your personal information.
  • Avoid phishing and spoofing scams. Phishing and spoofing emails are ones that resemble those from a legitimate sender, such as a bank, and try to trick you into accessing a fraudulent website. These websites can compromise your personal information by downloading malware to your computer or getting you to submit your personal information. Look for signs of legitimacy such as a security policy, About Us page, phone number and addresses, correct spelling, and additional identifying information. Before clicking on a link in an email message, hover your cursor over the link text and check whether the address that the link connects to is the same as that of the link text.

Is it risky to make online purchases using public computers and networks?

Public computers and networks are subject to heightened data security threats, simply because more people can access them. They include not only computers and networks accessible to the public at large, but also those at your place of employment. If you choose to make online purchases using public access methods, here are some suggestions:

  • Use private browsing. Modern web browsers permit you to visit webpages without the browser storing your web history or tracking cookies. But private browsing does not prevent other computer applications from tracking your web behavior. Nor does it prevent remote monitoring of your computer (and personal information).
  • Minimize the amount of personal information submitted. Enter only as much personal information as is necessary for your purpose. Don't save any account or log-in information to the computer.
  • Be wary of public wi-fi networks. Anyone may view the information you submit via open public networks because these networks generally do not encrypt information and the networks are accessible to anyone. You should only visit fully encrypted websites.

For the Lawyers

Placing a fraud alert on an individual's credit report

Obtaining a free credit report

FTC's Business Guide to Data Security

What to do in case of identity theft

Information about identity theft and data breaches

State data breach notification laws

State computer hacking and unauthorized access laws

State anti-phishing laws


For the Public

Resources for

Stay Connected