The trivialization of risks in a column on the cost of loyalty programs published in La Presse drew a reaction from members of the cybersecurity community. “I thought it was a really great article, until I got to that section,” Alexis Dorais-Joncas, head of the R & D centre at ESET Montréal, said in an interview. “I learned a lot,” he adds. However, he finds it unfortunate that the opportunity wasn’t taken to remind consumers that if “you agree to hand over your personal data, do it knowingly.”
For this head of a team of cybersecurity researchers, it is wrong to say the risk is the same because this data is already held by another entity, such as the bank. “The risks add up,” he explains. “The more parties that hold our personal data, the greater the chances that one of them will suffer a leak.”
It’s not just data that’s at risk
Since these programs offer rewards, Mr. Dorais-Joncas adds that the theft of accounts does not only result in lost data, but can involve a monetary loss. The loss associated with the theft of one account may seem minimal for a user, but if a fraudster gets hold of a large number of them, it adds up to much larger sums.
The third impact he noted comes from the fact that some loyalty programs are tied to a payment method. Mr. Dorais-Joncas in fact investigated a fraud case involving McDonald’s mobile app in 2019. A journalist reported being defrauded of $2,000 when someone took over his loyalty account. According to the cybersecurity specialist, “security was completely deficient. [ … ] You could test thousands of username and password combinations in a few minutes.” Moreover, once a valid account was stolen, the app had no anti-fraud measures, and several transactions had been recorded at the same time in several places across the province without this being flagged.
To sign up or not?
For Alexis Dorais-Joncas, you have to ask yourself whether you get a real benefit from the program. He suggests asking yourself, “Am I willing to hand over my personal data to this company in exchange for what it offers me?” Second, he suggests reading the terms of use and privacy policies. He admits this is not always easy, because these policies are not easy to understand, but “they say a lot about how our data will be used.”
Ideally, we should minimize the scope and number of programs we join. It is therefore better to sign up only for programs that genuinely interest us.
Once you decide to join a loyalty program, he suggests never reusing passwords. “We tend to think we don’t need as much security as for our bank account,” but once you get into the habit of using a password manager, “it’s no harder to create a good, unique password for all your accounts.”
Loyalty programs offer benefits, but they are not without risk. It is therefore important that the decision to hand over your personal data not be taken lightly.
Bill 64 is meant to regulate the collection, protection and use of this personal data. Its adoption has been delayed by the government’s recent announcement that it is suspending its study of the bill.
photo credit: Four Bricks Tall - CC BY-NC-ND license
