Spyware

For all of us who aren’t living off the grid, our private lives are inextricably connected to the computers and other networked devices we use every day. Our personal communications, financial activities, and other sensitive information can be found there, and cybercriminals know that gaining access to an individual’s devices can yield a treasure trove of valuable data.

One of their most effective high-tech tools for invading secure systems to steal data is the software category known as spyware. What is spyware, and how does it get used to facilitate fraud, data breaches, and other cyberattacks?

Privacy has become a big deal on the internet in recent years, with many countries adopting laws designed to protect their users from intrusive data-harvesting practices. While some so-called spyware is designed to track your browsing habits for the purpose of serving you more relevant advertisements, the spyware you really need to worry about has much more nefarious designs in mind and little respect for data protection regulations.

Nearly one out of four consumers have detected spyware or other types of malware on one of their devices, but many infections are never discovered at all. When spyware is forcibly installed on a victim’s computer for the purpose of snooping on personal and financial information, the stolen data can be used for credit card fraud, identity theft, account takeover, and other attacks that can lead to chargebacks. Spyware installed on a merchant’s servers can potentially lead to a massive data breach, as well as significant reputational damage to the merchant.

What Is Spyware?

Spyware is a category of malware, which means “malicious software.” This term refers to programs that are installed without your knowledge or consent, or that perform undesirable functions that you aren’t informed about prior to installing them.

Some forms of malware don’t care about spying on you or stealing your data—they’re there to hijack your computer to run bot programs, or to lock up the operating system and hold it for ransom. Spyware is designed to run unobtrusively in the background and send your personal data back to its operator.

Anything that is stored or processed on a networked device can be monitored by spyware: saved files, browsing history, emails, online chats, and more.

Keyloggers are a popular category of spyware that record every keystroke entered into the host computer, which means they can steal passwords, banking information, PINs, and other highly sensitive data, even if it is never copied down or saved anywhere.

While spyware can be used for corporate espionage, state surveillance, stalking romantic partners, and other specific and targeted purposes, in most cases it is used by opportunistic cybercriminals who are trying to steal information they can turn into a quick profit.

Cybercriminals can easily sell social security numbers, payment card credentials, and other sensitive data on the dark web for a few dollars, where they are bought by other bad actors who will go to the trouble of exploiting the data for greater profit—testing out the card numbers, turning personal information into synthetic identities, and so on. 

How Do Devices Get Infected with Spyware?

The hardest part of being a spyware operator is getting your victims to install the software. Unfortunately, there are lots of ways to trick people into doing this:

• Bundled with other, more appealing software that target will want to download and install
• Automatically installed through browser exploits when the target visits a malicious website
• Posted on a file-sharing site under a false or misleading description
• Sent as an executable email attachment

Malware that gets into your device by pretending to be some other type of software is sometimes called a Trojan Horse.

How Can People Protect Themselves from Spyware?

Awareness of the threat and strong cybersecurity practices are the best line of defense against spyware. You should never download and install software that isn’t from a trusted source, and never click on a link or open an attachment from a suspicious-looking email. Cybercriminals are always refining their technique for crafting phishing emails, so it’s important to stay aware of trends in the cybersecurity sector so you know what to look for.

Merchants and other individuals in charge of organizations that could be targeted should regularly educate their staff about how to recognize and avoid malicious emails and websites. System administrators can also exercise the option of only allowing whitelisted software to be installed on networked devices.

Cybersecurity best practices won’t always stop every type of attack, so anti-malware software can be another important part of your defense. However, these aren’t foolproof either.

Cybercriminals are constantly working on making their programs harder to detect, so anti-malware software needs frequent updates and even those are not always enough to stay ahead of the most sophisticated cybercrime rings.

Some malware creators even threaten legal action against anti-malware publishers to get their programs delisted, although this is more likely to be spyware on the less-evil adware end of the spectrum. The cybercriminals who are after your social security number and bank account usually prefer to fly well under the radar.

Conclusion

Spyware should be of great concern to merchants because of the ways in which it facilitates and fuels credit card theft and other forms of online fraud. Powerful, sophisticated spyware programs feed stolen data by the terabyte to dark web markets.

Any unethical person with a little bit of cryptocurrency to spend can purchase thousands of credit card numbers or personal identification details to make use of, which can result in countless acts of fraud that are sure to be followed by chargebacks.

While merchants can do everything in their power to protect their own systems from a catastrophic breach, there’s not much you can do about cybercriminals targeting your current and future customers on their own devices. For this reason, it is just as important to have strong downline defenses against fraud, such as AI fraud detection software and two-factor authentication, as well as a comprehensive strategy for dealing with chargebacks.

Thanks for following the Chargeback Gurus blog. Feel free to submit topic suggestions, questions, or requests for advice to: win@chargebackgurus.com