In a short interview ahead of Cyber Monday, identity‑theft specialist Robert Siciliano explains how the surge in online holiday shopping can expose consumers to credit‑card fraud. He cites McAfee research showing only about 20% of retailers are PCI‑compliant, leaving the majority vulnerable to data breaches. Siciliano offers three practical safeguards: (1) shop only with reputable, well‑known online retailers; (2) ensure the payment page uses HTTPS and displays the lock icon, indicating a secure, PCI‑compliant connection; and (3) closely monitor credit‑card statements, keeping receipts and disputing any unauthorized charges within the 60‑day window mandated by federal law. The interview emphasizes that even large retailers can be compromised, so vigilance is essential to avoid becoming a victim of identity theft during the holiday sales rush.
Chapters
Ahead of Cyber Monday, a warning. Turns out if you're waiting for the big, big, big online deals, you could be putting yourself at risk. Identity theft expert Robert Siciliano on the new survey. Sir, so what am I risking if I'm waiting and I go online to buy my stuff?
Well, McAfee's done numerous studies, and at this point PCI compliance is at about 20%, which means that almost 80% of retailers aren't compliant, which means that your credit card information is vulnerable.
In, in what way?
That, uh, it's being hacked. Uh, we've seen numerous data breaches over the past 5 years where, uh, hundreds of thousands and sometimes millions of credit card numbers have been compromised because the retailers themselves don't have the necessary systems in place. They're not PCI compliant, Payment Card Industry standards, uh, to make sure that that data is properly protected.
Alright, you've come up with a couple of tips on how to keep safe online. Tip number 1 says only shop at reputable known online sites. How many of those are there?
Well, you would think that they would all be reputable, at least, you know, the front-facing brands that we're all familiar with, but even they have also been compromised. But even still, do business with those who you know, who you like, and who you trust. If you just find some rogue retailer online that you're not familiar with, I don't necessarily recommend entering your credit card information there.
But if it's a big retailer that happens to have an online platform, that's okay to go there, right?
It is okay, but you still have to pay very close attention to your credit card statements, which is one of my tips. I recommend saving all your receipts, putting them in a folder, paying close attention to every purchase you're making, looking at your online statements at least weekly, and I recommend doing it for a long—
This is an important one. This is an important one. Tip number 2, guys. Can we go back to tip number 2? Enter credit card information secure pages with an S after HTTP. A lot of people don't know what that means. A lot of websites say HTTP and then goes on, but HTTPS means what?
It means it's a secure page. So where you enter your credit card information in the address bar, it should say HTTPS as in secure. If it's just an HTTP, that means that page is not secure, which means that retailer or that e-tailer is not PCI compliant.
Okay, that's good to know. Alright, so tip number 3, last one here, look for the lock icon in the address bar. What does that mean?
Generally, all of your updated browsers, they have a small little lock. It could be up in the address bar or in the bottom right or left-hand corner of your browser. That lock, which shows it's locked, means that in the address bar it should also say HTTPS. That means that that page is also a secure one.
And then the other one, you said monitor your statements. Very important, right?
Yeah, you know, we only have 60 days to refute unauthorized charges by federal law. After 60 days, the credit card company the issuing bank, they don't have to honor any returns if there's fraud. They only have— you only have 60 days. So I recommend within at least one billing cycle to pay very close attention to those statements. Otherwise, you'll be paying for the Christmas of an identity thief.
All right, Robert Siciliano, thank you very much, sir.
