Online Security

Good points by Roadie, and hopefully I can clarify a bit.

Whenever you do business online with a credit card, hopefully it's encrypted between your computer and the web server of the institution with which you are doing business. Ensure that the URL in the address bar starts with "https" instead of "http" and look for a little lock icon somewhere in the status bar of your web browser. I'd also go to the trouble of actually typing in the URL of the bank every time to prevent someone trying to phish me with a bogus link (I won't even use a bookmark, in case it is compromised).

The encryption between your browser and the institution's web server is pretty good. The problem lies in how your personal data is treated before it leaves your browser (is it stored on your computer? has someone installed a keylogger that phones home? is your computer somehow compromised?) and after it arrives at your institution. The recent incident with the payment processor for Visa, Master Card, etc. occurred because they had violated the credit card companies security policy by retaining data, and that data was in a place where someone had access to it that should not have.

Another thing you probably want to do is change your passwords often (once a month is not too often, in my opinion), use a separate password for each account, use complex passwords (at least 8 characters, capital letters, numbers, special characters, no dictionary words, and NEVER use your userid, name, phone number, pet's name...), and although I'm sure I'll get arguments to this, write the passwords down on a slip of paper, put that piece of paper in your wallet, and treat it with the same care and sensitivity that you would use in taking care of your driver's license, credit cards, and cash. And if you're going to do this, DON'T write down the userid, account number, bank name, etc. on the same slip of paper. That way, if someone does find it, it'll just be a bunch of random password-looking words. And I'd also keep a few old slips in my wallet just to create a bit of obfuscation for a would-be thief. You have to remember which password is which and which slip is valid for this month's passwords, but that shouldn't be too hard for most people.

One more note: check your online bank statements often (at least once a week, perhaps even more often) and make sure that you can account for every transaction that takes place. If you cannot, notify your bank / credit card company immediately by both phone and in writing to challenge it.

Thanks for listening,
Tom