With a constant stream of news of big organizations that have neglected their security, we often forget that the most vulnerable organizations are the small and medium businesses that don\u2019t have the resources to build elaborate security teams. These businesses can have a single iPad, phone or dated register protecting their critical customer data. They aren\u2019t using business class networking equipment and don\u2019t have firewall hardware. And, most importantly, they don\u2019t have processes that protect user data from malicious employees.<\/p>\n
The most common places that we encounter these threats are the everyday small to medium transactions. Small grocery and convenience stores, bars, boutique shops and restaurants.<\/p>\n
In these everyday payments, all it takes is a malicious employee spending ten seconds writing down your card numbers, or snapping two quick photos of your card to have all of your information.<\/p>\n
Here, we discuss the mitigation of the threat of small insecure businesses in your daily life, and how to reduce the harm that a breach at one of these businesses can cause you.<\/p>\n
Cash Cash Cash<\/em><\/strong> \u2013 When you visit high risk small businesses, give them cash. The absolute best defense against theft is to never give them your private data in the first place. It avoids the myriad of risks outright.<\/p>\n Use gift cards that do not require personal information<\/em><\/strong> \u2013 My personal preference is the Vanilla Visa in the US. You can load the cards with up to $500 and can enter any fictional name, address, and zip when checking out. If one of these gets compromised by your barber, you can simply throw it away and be annoyed.<\/p>\n Use a SEPARATE<\/em> credit card<\/strong> \u2013 If cash or gift cards are not reasonable options for you, using a separate credit card (not your debit card as credit) isolates your risk to a single entity. This works far better than using a basic debit card, because if a credit card is breached, it just temporarily increases your balance while the issuing bank investigates the fraud. With a debit card, this is taking funds directly from your bank account, which can create serious shortfalls in your budget for weeks until you are reimbursed for the theft.<\/p>\n Use credit instead of debit<\/em><\/strong> \u2013 When running a transaction as debit and entering your PIN, you are foregoing many of the protection features of the card per your user agreement. If you lose your PIN in a data breach it is a lot harder to recover your money.<\/p>\n Do not use your primary email<\/strong><\/em> \u2013 This avoids the risks of your email leaking to third parties. This can both be through malice, and through business agreements with third parties, such as their payment gateway software. A breach at any party holding this information makes you a target for identity theft. Once an attacker has your email address, they will attempt to phish your sign-in credentials out of you often impersonating the business that they\u2019ve breached. If they can get you to click on a malicious link, or coerce you into revealing information about your secret questions (or just finding those answers through social media) they can gain access to your email and issue password resets on your major accounts. This will have a substantially higher impact on your life than the loss of a single card account for a few weeks while your bank sorts out the fraud. It will span multiple accounts and disrupt your entire life.<\/p>\n Use cryptocurrency over a VPN if it is an option \u2013 <\/strong>This is the best option for protecting an online transaction from a questionable online retailer. Other than the risk of the retailer running off with your transaction money, you have no further risk of the retailer leaking your information or stealing your card data. They only have a cryptocurrency address that they can\u2019t use, they don\u2019t have your IP address, and whatever information you gave them for shipping (see: Get a P.O. box below)<\/p>\nFor Questionable Online Retailers:<\/h2>\n