With the holiday shopping season in full swing, more than 174 million Americans shopped online and in stores from Black Friday to Cyber Monday. That weekend may be in the past, but there are still plenty of opportunities for threat actors to exploit poor cybersecurity practices.

As retailers continue to push out deals to consumers over the next month, fraudsters will seek opportunities to breach personal information, spread malware and prey on the abundance of data being shared during the hectic holiday season. For example, in 2016, researchers from IBM X-Force identified a phishing campaign that sent emails from an address that appeared to be from Amazon.com. The emails contained fake tracking numbers and attachments to embed ransomware onto users’ computers.

When using mobile payments, online shopping, or setting up new technology and devices, organizations and consumers alike should be hypervigilant to keep their networks and information safe.

Our elite team of security professionals, IBM X-Force, is monitoring malicious activities closely — not only during the shopping season, but 24 hours a day, seven days a week, 365 days a year — to help customers, fellow researchers and the public better understand the latest security risks and stay ahead of emerging threats.

Online Shopping Safety Tips for the Holiday Season

The X-Force team, which manages 35 billion events per day, offered the following tips to help organizations and consumers keep their information and networks safe while shopping online during the 2017 holiday season.

Safeguard Credit/Debit Information

When taking advantage of those holiday deals, never save credit or debit card information on retail sites or in your web browser. Always look for the green lock icon in the browser address bar to ensure a secure connection to websites.

Pass the Phrase, Please

While shopping online, use different passphrases for each site and be sure to mix letters, numbers, special characters and even spaces. For example, “H0w D1d I G3t Stuck In Th1s Ch1mney?” or “Two:Billi0n CO0kies & Glasses 0f Milk!” You can also use a password manager to store passphrases in a digital vault so you don’t have to memorize them on your own. In addition, never use the same passphrase as your email account.

Email Scammers Don’t Take Holiday Vacations

Scammers often prey on the surge of online shopping to send fake emails that look like customer service follow-ups. Make sure to pay extra attention to emails that look suspicious. When in doubt, go directly to the trusted retail site instead of clicking on potentially malicious links.

Security Recommendations for Connecting New Devices

The X-Force team also recommends taking the following security precautions when setting up new devices.

Don’t Forget the Batteries

A decade ago, batteries were the biggest concern — but before the kids start unwrapping, don’t forget to secure those smart devices. Many of today’s toys need software updates, patches and configuration of permissions before use. Drones, robots and even connected teddy bears may require access to video, audio and social media platforms and should be configured to limit your family’s exposure appropriately.

Protect Devices From Themselves

Before connecting any new technology to a home network this holiday season, make sure the router is protecting devices that can’t protect themselves. By using a Domain Name System (DNS) service such as Quad9 at the router level, any smart device that requires internet access is provided with additional security and privacy automatically.

Prevent Personal Assistants From Snooping

Thinking about introducing a virtual assistant to your household? Be sure to mute the microphone on the assistant when not in use, and avoid linking any important bank or credit accounts to the device.

Get Creative With Security Questions

When setting up those new tech gifts, opt for security and password reset questions that aren’t public to make it harder for fraudsters to get their hands on your information. For example, don’t use your mother’s maiden name, which could be easily found online. Even answers to opinion-based questions, such as favorite movie or food, can be found on social media. For increased security, lie about your answers or use passphrases as the answers.

Be Open to Biometrics

Before firing up new phones and tablets, consider implementing biometric authentication, which uses physical characteristics such as fingerprints or behavioral characteristics such as voice recognition. Biometrics and two-factor authentication add a layer of protection and make it harder for cyber Grinches to get their sticky fingers on your personal information.

Carrying Over Cybersecurity Awareness Into the New Year

While it’s particularly important to be mindful of cybersecurity precautions during the holiday season, security awareness should be part of your everyday routine. There is often a noticeable increase in threats during the holidays, but cybercriminals are looking to capitalize on opportunities to execute attacks year-round. By putting these security measures into practice now, consumers and organizations will be able to better protect themselves heading into the new year and beyond.

Interested in emerging security threats? Read the latest IBM X-Force Research