According to the Bangko Sentral ng Pilipinas (BSP), card fraud is the most rampant cybercrime in the Philippines. From stolen card details to sophisticated scams, criminals are constantly finding new ways to exploit vulnerabilities. With digital transactions becoming increasingly preferred, protecting yourself and ensuring [secure online credit card transactions](https://www.mayabank.ph/creditcard/) has never been more crucial. 

Whether shopping for groceries or booking a flight, using credit cards is part of everyday life for many modern Filipino consumers. While it’s easy to focus and get excited about rewards, cashbacks, and promos, you should also pay as much attention to learning about security features designed to safeguard your financial information. 

Understanding key security terms is an excellent first step, as it helps you take control of your card’s safety, minimize risks, and use your credit card with confidence. Here are some essential security concepts to help you get started.

### EMV Chip Technology

Swiping your card is becoming a thing of the past, thanks to the security of EMV chip technology. Unlike magnetic stripes, which can be easily skimmed to steal data, EMV chips generate a unique transaction code for each purchase, making it much harder for fraudsters to clone your card or use stolen data for unauthorized transactions.

Most merchants now use chip-enabled terminals to prevent fraud; however, EMV chips don’t offer the same protection for online purchases. To stay secure, always use trusted websites, enable multi-factor authentication, and monitor your statements for suspicious activity. While EMV technology has made card-present fraud less common, understanding its limitations helps protect your credit card in all types of transactions.

### Card Verification Value or Code

That three-digit code on the back of your card does more than you might think. Called the card verification value (CVV) or card verification code (CVC), this number adds an extra layer of security by ensuring that only the cardholder can complete card-not-present transactions, such as online or phone purchases. Since merchants are prohibited from storing CVVs, even if hackers steal payment details, they cannot easily use them for unauthorized transactions.

It’s important to note that a CVV is different from a PIN. While a PIN authorizes in-person transactions and ATM withdrawals, a CVV is meant to prevent fraud in online or remote purchases. To enhance security, avoid sharing your CVV, store your card details securely, and use virtual card numbers when available. Taking these precautions can help prevent unauthorized use of your credit card.

You may also want to look for a card like the Landers Cashback Everywhere credit card by Maya, which comes with a dynamic CVV. A dynamic CVV is only valid and changes every time the card details are opened through the Maya app. This way, even if your card details get compromised, you still have an extra layer of security working to protect your account.

### Multi-Factor Authentication

A password alone isn’t always enough to keep your credit card secure, so make sure to activate multi-factor authentication (MFA) to add an extra layer of protection. With MFA, logging into your banking app or completing a transaction requires not just your password but also an additional verification step, such as a one-time code sent via SMS, email, or an authentication app. This makes it much harder for cybercriminals to access your account, even if they steal your password.

Many financial institutions now require MFA for online transactions and account access, especially for high-value purchases. While SMS-based codes offer some security, authentication apps like Google Authenticator or bank-provided security tokens provide stronger protection. Enabling MFA wherever possible significantly reduces the risk of unauthorized access, giving you greater control over your credit card’s security.

Do note that 2FA or two-factor authentication is a subset of MFA. With 2FA, you are only required to add one type of authentication method; with MFA, you need to provide two or more (e.g., email, SMS, fingerprint, or location verification, among others).

### Zero Liability Protection

Worried about fraudulent charges? Zero liability protection ensures you won’t be held responsible for unauthorized transactions, such as purchases you didn’t make or transactions resulting from a lost or stolen card—provided you report them promptly. This policy protects cardholders from financial losses due to fraud, making it one of the most important security benefits of credit cards.
However, zero liability isn’t automatic. Card issuers typically require you to report suspicious activity within a specified timeframe. If you wait too long, your protection may be limited. Additionally, this coverage doesn’t apply if you knowingly share your card details or act negligently. To maximize safeguards, monitor your transactions regularly through your statements or your card issuer’s accompanying mobile app and enable fraud alerts. While zero liability protection provides peace of mind, staying vigilant ensures you catch fraudulent activity before it becomes a bigger problem.

### Skimming and Card Cloning

Not all fraud happens online—skimming and card cloning remain serious threats in physical transactions. Skimming occurs when criminals install hidden devices on ATMs, gas pumps, or point-of-sale terminals to steal your card’s data. Once obtained, this data is used to create a cloned card for fraudulent purchases.

To protect yourself, always inspect card readers for loose or unusual attachments, cover the keypad when entering your PIN, and use ATMs in well-lit, high-traffic areas. Many banks now offer contactless payments and virtual card numbers, which further reduce the risk of skimming. You can also enable real-time transaction alerts to catch unauthorized charges early. Understanding these tactics can help keep your credit card safe from cloning attempts.

### Phishing and Social Engineering

Not all fraud involves high-tech gadgets. Sometimes, scammers rely on deception. For instance, phishing and social engineering are tactics used to trick you into revealing sensitive information, often by posing as a trusted entity like your bank or a well-known retailer. Fraudsters may send fake emails, texts, or calls urging you to verify account details, reset passwords, or confirm suspicious transactions.

Stay vigilant. Never click on unexpected links or provide personal information over the phone. If you receive a suspicious request, contact your bank directly using the official number. Many banks also offer email filtering and fraud monitoring to help detect scams. Being cautious and verifying requests before acting can prevent you from becoming a victim of these increasingly sophisticated schemes.

As a credit card owner, learning how to make the most of your card’s benefits is not enough—you also need to know how to keep your transactions secure. Start by understanding these key security terms to spot potential threats, take preventive measures, and protect your financial details. By staying informed and applying prudent security practices, you can enjoy the convenience of credit cards without worries.


According to the Bangko Sentral ng Pilipinas (BSP), card fraud is the most rampant cybercrime in the Philippines

6 Important Security Terms You Need to Know as a Credit Card Owner

Today, businesses rely heavily on networks and external collaborations, and therefore risks associated with third-party vendors have never been more pronounced. Imagine your business as a fortress—strong walls and vigilant guards can protect it, but a single unlocked backdoor could render those defenses useless. That backdoor? Often, it’s the vulnerabilities introduced by third-party vendors. Third-party risk management (TPRM) has therefore evolved from being a nice-to-have process to an indispensable cornerstone of modern business strategy.

Third-party risk management (TPRM) not just important but indispensable for protecting your business. But TPRM isn’t just about avoiding pitfalls; it’s a proactive strategy that enables organizations to build resilience, enhance trust, and drive long-term success.

In this article we will dive into why TPRM is vital and how businesses can harness its power to secure their operations.

### Understanding Third-Party Risk Management

Third-party risk management refers to the process of identifying, assessing, and mitigating risks that arise from an organization’s reliance on external vendors or partners. These risks often stem from vulnerabilities in the third-party’s systems, processes, or policies. Common areas of concern include data breaches, operational disruptions, regulatory non-compliance, and reputational damage.

### The Importance of Third-Party Risk Management

1. **Protecting Sensitive Data** Many third-party vendors have access to sensitive organizational data, including customer information, intellectual property, and financial records. A single data breach involving a third party can lead to significant financial and reputational harm.

2. **Ensuring Regulatory Compliance** Regulatory bodies often hold organizations accountable for the actions of their vendors. For example, the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA) require businesses to ensure their third parties adhere to strict data protection standards.

3. **Minimizing Operational Disruptions** A failure or cyberattack at a critical third-party vendor can disrupt an organization’s supply chain or essential services. **Supply chain risk management** is therefore a vital component of any TPRM strategy.

4. **Preserving Brand Reputation** Customers and stakeholders expect organizations to ensure the security and reliability of their operations. Any issues involving third-party vendors can tarnish an organization’s reputation and erode trust.

### Third-Party Cybersecurity Risk Management Challenges

While the importance of third-party risk management is undeniable, organizations face several challenges when implementing effective TPRM strategies:

1. **Lack of Visibility**: Organizations often struggle to gain full visibility into their third-party networks, making it difficult to assess risks accurately.

2. **Diverse Vendor Ecosystem**: Managing risks across a wide range of vendors with varying levels of cybersecurity maturity can be overwhelming.

3. **Evolving Threat Landscape**: Cyber threats targeting third parties, such as ransomware and phishing attacks, are becoming increasingly sophisticated.

### Third-Party Risk Management Best Practices

To address these challenges, organizations should adopt the following third-party risk management best practices:

1. **Establish a Comprehensive Risk Management Framework** Develop a TPRM framework that outlines the processes, policies, and tools required to manage third-party risks effectively.

2. **Conduct Vendor Risk Assessments** Regularly evaluate the cybersecurity posture of your third-party vendors through security questionnaires, audits, and penetration testing. Focus on their vulnerability management practices and incident response capabilities.

3. **Implement Third-Party Risk Management Tools** Invest in a **third-party risk management tool** or **platform** like Cyble that provides real-time visibility into vendor risks. Such tools can automate risk assessments, monitor vendor activities, and generate actionable insights.

4. **Enforce Contractual Obligations** Include robust security requirements in vendor contracts. Ensure vendors comply with industry standards such as ISO 27001, SOC 2, and NIST Cybersecurity Framework.

5. **Monitor Vendor Performance Continuously **Use a combination of manual reviews and automated monitoring solutions to track vendor performance and identify emerging risks. Third-party risk management services often include continuous monitoring capabilities to ensure ongoing compliance.

6. **Strengthen Collaboration Across Teams** Foster collaboration between procurement, legal, IT, and cybersecurity teams to ensure a unified approach to managing third-party risks.

### Key Strategies for Third-Party Risk Management

Effective TPRM requires a strategic approach tailored to the organization’s specific needs. Here are some third-party risk management strategies to consider:

1. **Risk Prioritization**: Focus on vendors with access to the most sensitive data or critical systems. Use a risk-based approach to allocate resources efficiently.

2. **Supply Chain Risk Management**: Assess risks across the entire supply chain to ensure all third-party dependencies are secure.

3. **Incident Response Planning**: Collaborate with vendors to establish clear protocols for responding to security incidents, including breach notification timelines.

4. **Training and Awareness**: Educate internal teams and third-party vendors about cybersecurity risks and best practices.

### Choosing the Right Third-Party Risk Management Solution

Selecting the right **third-party risk management product** or **platform** is crucial for streamlining your TPRM processes. Look for a solution that offers the following features:

1. **Automation**: Automate vendor risk assessments and continuous monitoring to save time and reduce human error.

2. **Integration**: Ensure the platform integrates seamlessly with existing tools such as vulnerability management and compliance systems.

3. **Customisability**: Opt for a solution that can be tailored to meet your organization’s unique needs.

4. **Scalability**: Choose a platform that can grow with your vendor ecosystem.

5. **Expert Support**: Consider working with a third-party risk management company that provides additional services such as consulting and risk mitigation.

### Secure Your Business from Third-Party Vulnerabilities with Cyble's Third-Party Risk Management Solutions

Cyble’s [Third Party Risk Management solutions](https://cyble.com/solutions/third-party-risk-management/) offers a comprehensive suite of tools designed to identify, assess, and mitigate these risks effectively.

Cyble’s platform leverages advanced analytics and real-time monitoring to deliver actionable insights into vendor vulnerabilities. With capabilities such as automated risk scoring, continuous surveillance of vendor ecosystems, and integration with broader cybersecurity frameworks, Cyble empowers organizations to stay ahead of potential threats. Additionally, the solution helps businesses achieve regulatory compliance by aligning with global standards, ensuring that third-party relationships are both secure and legally sound.

By adopting Cyble’s TPRM solutions, organizations can enhance their cybersecurity posture, protect sensitive data, and ensure business continuity in an increasingly interconnected world.

### Benefits of Third-Party Risk Management Services

Engaging professional third-party risk management services can help organizations:

1. Gain expert insights into vendor risks and compliance requirements.
2. Reduce the time and effort required to manage third-party risks.
3. Enhance their overall cybersecurity posture.

### Real-World Impacts of Effective TPRM

Organizations that invest in strong TPRM practices reap significant benefits, including:

1. **Reduced Breach Incidents**: Proactive risk assessments and monitoring reduce the likelihood of third-party breaches.

2. **Improved Compliance**: Strong TPRM practices ensure alignment with regulatory requirements, avoiding costly fines and penalties.

3. **Enhanced Business Continuity**: Effective supply chain risk management minimizes disruptions caused by vendor failures.

4. **Increased Stakeholder Confidence**: Demonstrating a commitment to cybersecurity boosts customer and investor trust.

#### Final Thoughts

As the old saying goes, “A chain is only as strong as its weakest link.” Third-party risk management isn’t just about managing external threats; it’s about securing your business for the future. As organizations grow more reliant on interconnected ecosystems, the ability to proactively address third-party risks becomes a defining factor for success.

By leveraging advanced third-party risk management (TPRM) solutions, partnering with trusted experts, and adopting comprehensive best practices, businesses can turn potential vulnerabilities into strengths. The stakes are high, but so are the rewards for those who prioritize security, resilience, and trust in their third-party relationships. Remember, in the battle against risk, preparation isn’t optional—it’s essential.


Why is third party risk management so important? Discover its critical role in safeguarding data, ensuring compliance, and minimizing operational risks.

Why Is Third-Party Risk Management So Important

Explore 2024’s top 10 deadliest data breaches, their impacts, responses, and essential cybersecurity lessons to protect your data and enhance online safety.

2024 Data Breaches Round-up Top 10 Deadliest Cyber Attacks Revealed

Malware

Vulnerability

Data Breach 

Ransomware

Finance

DDoS

Cryptocurrency 

Android 

Misconfiguration

API 

Healthcare

Theft

Cyberattack

Phishing

DeFi

Blockchain

Privacy 

Cloud Security

GenAI

PayPal, one of the world's leading electronic payment platforms, has recently fallen victim to a credential-stuffing attack that exposed the personal data of nearly 35,000 users. This type of cyber attack is becoming increasingly prevalent and poses a significant threat to online security.

Credential stuffing is a form of automated cyber attack where hackers use bots to systematically test a list of username and password pairs on various online platforms and services. The attack aims to gain access to accounts by exploiting the common practice of users reusing the same password across multiple accounts.

The attack on PayPal occurred between December 6th and 8th, 2022, and was initially detected and mitigated by the company's security team. However, an internal investigation was conducted to determine how the hackers could gain access to the accounts. The investigation revealed that unauthorized third parties could log into the accounts using valid credentials, but there is no evidence that the user credentials were obtained directly from PayPal.

The personal information exposed in the [attack](http://www.documentcloud.org/documents/23578067-paypal-notice?responsive=1&title=1) includes full names, dates of birth, postal addresses, social security numbers, and individual tax identification numbers. Additionally, transaction histories, credit or debit card details, and PayPal invoicing data were also accessible to hackers. This is particularly alarming as this information can be used for identity theft and financial fraud.

PayPal took prompt action to limit the intruders' access to the platform and reset the passwords of accounts confirmed to have been breached. The company also stated that there is no evidence that the attackers attempted or were able to perform any transactions from the breached PayPal accounts.

To protect themselves, PayPal recommends that affected users change the passwords for other online accounts using a unique and long string and activate two-factor authentication (2FA) protection from the 'Account Settings' menu. This will provide an additional layer of security and make it more difficult for hackers to gain access to the account. Additionally, affected users will receive a free two-year identity monitoring service from Equifax, which will help them to detect any suspicious activity on their accounts.

Don't want to be the next viable target like Paypal! Try [Threatspy](https://bit.ly/3PV3C4M), an automated application security management platform that finds & fixes injection vulnerabilities across your web application that can lead to credential stuffing attacks ahead of exploitation. Contact us to book a [free demo](https://bit.ly/3Woo7JN) of Threatspy Now!


PayPal was hit by a massive data breach, exposing personal data of 35k users. Hackers used credential stuffing attacks to gain access.

35,000 PayPal Users' Data Exposed in Credential Stuffing Attack!

DraftKings would be compensating consumers for incurred losses of upto $300,000 caused by a credential stuffing attack. The tweet comes after DraftKings was closely looking into all the customers' grievances having troubles with their accounts.

Credential stuffing attacks occur when malicious actors use automated tools to try hundreds of thousands, or even millions, of times to get into user accounts using credentials (often user/password combinations) obtained from other online services.

When used against accounts whose owners have repeated credentials across various platforms, this tactic is very effective.

The objective is to get control of as many accounts as possible in order to acquire sensitive information and then sell it on underground markets or hacker forums.

All hacked accounts appear to have started with a $5 deposit, after which the attackers changed the password, enabled two-factor authentication (2FA) using a new phone number, and withdrew as much money as they could from the victims' associated bank accounts.

Some victims have taken to social media to vent their anger at DraftKings for not being able to help them as they watched the attackers continually take money out of their accounts.

More than 12 hours later, DraftKings President and Cofounder Paul Liberman said that "we presently think that the login information of these clients was obtained on other websites and then utilized to enter their DraftKings accounts where they used the identical login credentials."

_"There is no indication that DraftKings's servers were compromised in order to get this data. Less than $300,000 in consumer cash were compromised, and we plan to fully compensate all affected customers."_

Customers were warned against using the same password for multiple accounts and against providing their information to any website or app that did not originate from DraftKings. This included betting trackers and applications that did not directly involve DraftKings.

Customers of DraftKings who haven't been hit by this credential-stuffing attack yet are urged to use two-factor authentication (2FA) and delete or unlink their bank accounts as soon as possible.

DraftKings statement cred stuffing
Statement from DraftKings on the Credential Stuffing Attack (DraftKings Customer Support)

As was the case with hijacked DraftKings accounts, the attackers will utilize the stolen information to move funds from the victims' associated bank accounts to accounts under their control, or make unlawful transactions.

The FBI recently issued a warning that the proliferation of such assaults is inevitable given the widespread availability of automated toolkits and compiled databases of compromised credentials.



DraftKings, which suffered a credentials-stuffing attack recently, would be compensating all the impacted consumers for incurred losses of a whopping $300,000...

$300,000 stolen in the DraftKings credential stuffing attack

A massive credential stuffing attack compromised 194,905 accounts on the thenorthface.com website, belonging to customers of outdoor gear company 'The North Face.'

As part of a credential stuffing attack, threat actors attempt to get into user accounts on other websites by using similar strings of email addresses/usernames and password combinations stolen in data breaches.

Password recycling, in which individual practices repeating the same credentials on other online platforms, is crucial to the effectiveness of these attacks.

The credential stuffing attack on The North Face website began on July 26, 2022, but was halted by the website's administrators on August 19, 2022.

North Face discovered that the hackers had compromised nearly 200,000 accounts by utilizing legitimate credentials to get access to the following consumer information during the course of the attack:

- Name
- Buying patterns
- Billing address
- Shipping address
- Telephone number
- Account creation date
- Gender
- XPLR Pass reward records

Credit card information and other payment information are not stored on the website, making it more difficult for hackers to steal personal data.

_"All credit card information is encrypted throughout the checkout process and is never stored by The North Face. Your actual credit card information is never stored on our servers; only our external payment processing service does that, "_ stated the company in its data breach report. _"This token can only be used to begin a purchase on thenorthface.com."_

The brand's parent company, VF Corporation (originally Vanity Fair Mills), has begun sending out [data breach notifications](https://www.documentcloud.org/documents/22275912-consumer-notification-template-vans_northface_combined-2022?responsive=1&title=1) to affected customers in the wake of the recent security incident.

All user passwords have been reset, and any payment card tokens that may have been compromised have been deleted.

Customers with an affected online account must change their password and re-enter their payment information.

Affected users should, of course, select a unique, strong (long) password and avoid the convenience of recycling credentials.

Customers should also update any other passwords they may have used across internet services.

The North Face has, notably, reset passwords after a successful credential stuffing attack twice before, the first time in November 2020 and again in the present.

The North Face is only one of many popular brands owned by VF Corporation. Other brands include Vans, Timberland, Eastpak, Kipling, Dickies, and Napapijri. Unfortunately, it seems that neither this attack nor any others like it have affected those.





The North Face suffered a credential stuffing attack resulting in the data breach of nearly 200,000 user accounts…


Over 194K accounts of The North Face hit by credential stuffing attack

Scattered Spider's technical tactics: social engineering, cloud exploits, ransomware ops, and advanced defense evasion

Scattered Spider: Social Engineering Meets Cloud Ransomware Tactics

Explore how China's Flax Typhoon group targets global critical infrastructure, using stealthy tactics to conduct cyber espionage and disrupt national security

Flax Typhoon: Chinese Cyber Espionage Group Infiltrating Critical Infrastructure Globally

Explore an in-depth technical analysis of FireScam—a stealthy Android malware posing as Telegram Premium. Learn about its phishing distribution, multi-stage infection, data exfiltration via Firebase, and effective defense strategies to protect your mobile ecosystem

Our Product

Resource Library

Subscribe to Our Weekly Threat Digest

Contact Us

PRODUCT

threatspyBulk IP/Domain Lookup

threatspy

Bulk IP/Domain Lookup

SOLUTIONS

By Industry

Healthcare

Healthcare

Education

Education

IT & Telecom

IT & Telecom

By Role

Government

Government

CISO/CTO

CISO/CTO

DevSecOps

DevSecOps

RESOURCES

Threat Feed

Threat Feed

Threat Research

Threat Research

White Paper

White Paper

SB Blogs

SB Blogs

COMPANY

Our Story

Our Story

Our Team

Our Team

Career

Career

Press And Media

Press And Media

Contact Us

Contact Us

PayPal was hit by a massive data breach, exposing personal data of 35k users. Ha...

DraftKings, which suffered a credentials-stuffing attack recently, would be comp...

The North Face suffered a credential stuffing attack resulting in the data breac...

PayPal

Credential Stuffing Attack

Data Breach

35,000 PayPal Users' Data Exposed in Credential Stuffing Attack!

Credential Stuffing Attack

$300,000 stolen in the DraftKings credential stuffing attack

The North Face

Credentials Stuffing

Over 194K accounts of The North Face hit by credential stuffing attack

ThreatSpy

Reinventing Application security

Trending Tags

Cyberattack

Ransomware

Trojan

Blockchain

Malware

Cryptocurrency

Data Breach

Vulnerability

APT

Threat Research

Scattered Spider's technical tactics: social engineering, cl...

Explore how China's Flax Typhoon group targets global critic...

Explore an in-depth technical analysis of FireScam—a stealth...

Popular Blogs

According to the Bangko Sentral ng Pilipinas (BSP), card fra...

Why is third party risk management so important? Discover it...

Explore 2024’s top 10 deadliest data breaches, their impacts...

Stay Cyber-Updated

Product

Solutions

Resources

Company

threatspy
Bulk IP/Domain Lookup