The Security Mentor

A firm called ClearCommerce ran a survey recently which concluded that 71% of online shoppers can't tell if the site they're visiting is "secure".

What they mean is that the people they surveyed didn't check for the icon of a padlock, usually at the bottom right of your browser window (look for it now. It should show an open padlock at the moment). Also, about half their respondents don't check their credit card activity in between monthly statements and therefore can't detect fraud quickly.

Don't worry too much if you're one of the 71%. There are quite a few limits to the protection you get when your browser shows a closed padlock.

Your credit card number will be "encrypted" (scrambled) in transmission so eavesdroppers can't steal it. Better than nothing, but it's easier for bad guys to steal your credit card number from the merchant's computers after it arrives. It's even easier to be a crooked merchant. It's easier yet to be a crooked employee at a merchant.

Theoretically, if the padlock is closed, you've got mathematical proof that you're really talking to the same site whose address you asked for. Practically, a lot of things can and do go wrong. Use an up-to-date web browser and common sense: if you followed a link from scam email, it probably didn't go to your bank, padlock or no padlock. And use bookmarks for sites you visit often. Sleazy people have been known to take names like "anazon.com" and waylay poor typers. Once you're there, a padlock would only prove that you're really at anazon.com.

So, what to do?

Some people in the ClearCommerce survey said they only do business with well-known online merchants. That makes some sense -- such merchants are either reasonably careful with credit card numbers or they cease to be major merchants -- but those people deprive themselves of the glory of the Internet, the chance to find obscure items at small sellers.

I recommend the same precautions you use in the physical world. Read the fine print from your bank and make sure that they, not you, eat the losses if someone steals your credit card number. You might not have this protection on a debit card.

By all means sign up for online banking and check your account regularly. ClearCommerce advises that small charges you don't recognize can be a warning that a crook is testing your card number.