Formjacking: The newest way hackers are stealing credit card information

Click to play video: 'Up to 500 million Marriott hotel guests’ data exposed in breach' Up to 500 million Marriott hotel guests’ data exposed in breach
WATCH: One of the biggest hacks in history has hit the world's biggest hotel chain. The data of up to 500 million Marriott customers have been compromised, and the breach dates back to 2014. Mike Drolet reports – Nov 30, 2018

2018 was the year of ransomware, phishing scams and the cryptocurrency hack known as cryptojacking. Come 2019 however, hackers have a new weapon in their arsenal — formjacking.

According to the Symantec Internet Security Threat Report, as security companies get better at preventing common scams, instances of formjacking have skyrocketed, with an average of almost 5,000 websites per month becoming victim to a formjacking attack during 2018.

What is formjacking?

So, what is this new form of cybercrime and how can Canadians protect themselves?

Robert Arandjelovic, the Director of Product Marketing for Symantec Americas, describes it as the digital equivalent of putting a device on an ATM to skim the numbers on a debit card.

“Formjacking is effectively, a remote, web-based version of that,” he explained.

Story continues below advertisement

WATCH: Government not stressing cybersecurity importance with MLAs

Click to play video: 'Government not stressing cybersecurity importance with MLAs' Government not stressing cybersecurity importance with MLAs
Government not stressing cybersecurity importance with MLAs – Jan 16, 2019

Cybercriminals use a malicious JavaScript code to steal credit card details and other information from payment forms on the checkout web pages of e-commerce sites.

Formjacking follows the upward trend of web-based hacking, meaning that you no longer need to download malicious software to be impacted by it. Cryptojacking, another web-based cybercrime, uses a similar kind of JavaScript code to turn the computers of those who visit the web page into cryptocurrency-mining devices.

All you have to do is visit a website running the code to be vulnerable.

WATCH: Cyber security experts warn about ‘cryptojacking’

Click to play video: 'Cyber security experts warn about ‘cryptojacking’' Cyber security experts warn about ‘cryptojacking’
Cyber security experts warn about ‘cryptojacking’ – Apr 2, 2018

There is another key difference between cryptojacking and formjacking. The former is known to radically slow down devices to the point where consumers know something is amiss, while the latter is almost impossible to detect until you get your credit card bill.

Story continues below advertisement

“What makes this really scalable is that nothing is actually impacting the computers. The bad guys are actually finding a way to infect the website itself,” Arandjelovic explained.

Credit card or other payment information entered into these sites is then siphoned off and sent to a secondary location and is often used to commit fraud. It’s important to note, however, that while the focus may be on payment information, PC Mag reports that anything entered into a digital form can be stolen this way.

READ MORE: Slow phone or computer? How to avoid getting ‘cryptojacked’

He emphasizes that small businesses and individuals weren’t the only victims of this crime last year. British Airways and Ticketmaster also fell victim to formjacking attacks over the past few months.

Furthermore, over a three-month period at the end of 2018, Symantec said it was tracking more than one million formjacking attempts on over 10,000 websites.

How can you protect yourself?

Arandjelovic suggests that the best way to prevent your information from being stolen in a formjacking scam is to apply many of the same security rules you would to other scams. The first is, download antivirus software and keep up with regular security updates. Symantec claims it blocked over 3.7-million formjacking attempts in 2018, with approximately one in 40 of these targeting Canadians.

Story continues below advertisement

For businesses however, PC Mag reports that there are other ways to safeguard your website from cybercriminals. These could involve making sure that any sites your e-commerce site interacts with to process transactions (such as secondary payment processors) is clear of malicious code.

READ MORE: 6 tips to protect your personal information when using public Wi-Fi

Arandjelovic also stresses that, while it may be tempting at times, it’s critical you don’t complete monetary transactions on devices you’re unfamiliar with or while using internet connections like public Wi-Fi.

Sponsored content