Posts

The high-tech world of hacking means the bad guys have a lot of digital tools at their fingertips. Now more than ever, the automation behind stealing your account access means consumers need to practice the strongest password security they can.

Unfortunately, some consumers have continued to ignore years of expert warnings when it comes to password strength. SplashData, who publishes the annual list of the most commonly used passwords as compiled from leaked credentials, found that in 2017, “123456” was still the world’s most common password. That was followed by “Password,” “12345678” (thanks to websites that are trying to protect their users by requiring longer passwords), “qwerty,” and others, such as “admin” and “letmein.”

“But ‘password’ is so obvious that no hacker would ever think I’d use that… right?” Sadly, that’s not how credential cracking works.

The term credential cracking refers to the systematic, automated breaking of your username and password with the use of high-speed bots. Following a large-scale data breach, a hacker simply uses a large database of usernames and allows the computer to “guess” the passwords for each one. Some credential cracking software can make billions of guesses per second.

In short, no one is sitting at a computer with your username, typing in guess after guess until they reach your password. Their software does it for them and it does it with fairly strong results. There has even been a reported uptick in the numbers of failed login attempts on major consumer websites following large-scale data breaches, indicating that hackers are using the stolen information and their bots to “guess” passwords.

As bad as this development is, it’s not the only bad news. If you’re one of the many consumers who reuses passwords, any cracked credentials that a hacker has on you can lead them right to your other accounts. Using stolen information and cracking tools to guess your email or social media login, for example, would also give the hacker access to your Amazon, PayPal, online banking or other sensitive accounts if you’re reusing your password.

In order to fight back against this high-tech break-in, your account passwords must be strong and unique. Lengthy strings of uppercase and lowercase letters (that do NOT spell a word!) combined with some non-sequential numbers and symbols can help ward off even the most devoted little bot. Using that password on only one account is crucial to preventing multiple accounts from coming under attack.


Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.

Peer-to-peer payment apps, or P2P apps, are a convenient way to share funds with people. It might be a friend who bought those Taylor Swift concert tickets for your kid’s birthday present on your behalf, someone who owes you money for picking up the tab at lunch last week, or even a way to conduct business transactions like selling a piece of furniture or handmade crafts. One of the increasingly popular uses for P2P apps is when multiple people have to “chip in” to pay for a single item, like a hotel room, cruise ship cabin, or baby shower gift for a co-worker.

Though convenient, P2P platforms have been scrutinized for their potential security concerns. As a platform that is connected to some type of payment account, they’re a golden ticket for hackers. When you create your account on a P2P site, you will link a credit card, debit card, or bank account in order to deposit and withdraw funds; if a hacker gains access to your P2P account, they have access to a more serious form of your finances.

If you plan to take advantage of this handy payment method, you’ve got to use some precautions. The very first is your password security, which is always a good idea. Whether it’s an app account, your email account, or any other online portal, a strong and unique password is a must. A strong password contains a lengthy combination of uppercase letters, lowercase letters, numbers, and symbols, typically between eight and twelve characters in length. A unique password means that you don’t use it on other sites, no matter how tempting that may be.

Once your account is secured with a strong, unique password, it’s important to monitor all activity in case someone still manages to get in. You can set up transaction alerts to let you know right away if your account has been used, and you can schedule some time to log in and take a quick look each week. If you see activity that you don’t recognize, report it immediately.  Deposits you weren’t expecting, not just withdrawals or purchases, can still be a sign that someone is in your account.


Contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App from ITRC.