‘Be vigilant’: What a card testing incident taught this Melbourne business owner

Having an online presence and digital storefront is a must-have for most modern businesses, but that can also leave you open to threats. For Victorian business owner Nick McGrath, a card testing incident prompted him to take the Cyber Wardens program to protect his business.

Nick McGrath is no stranger to change. Having operated his picture framing business OnStone out of South Melbourne since 2012, when the pandemic hit he decided to leave the bricks-and-mortar world behind and move down to the Mornington Peninsula.

There, he spends his days in a manufacturing facility, fulfilling orders from around Australia and across the globe.

His customers come to OnStone for a unique product: photos sprayed onto a stone material cast wrapped in recycled timber frames.

Despite working with his hands for much of the day, McGrath is no slouch when it comes to the digital side of things. Running an e-Commerce business requires technological nous as well as an understanding of cyber security practices – even more important today given the increase in malicious attacks.

So when he realised that his business had been hit by a card testing incident, he knew he needed to tackle the issue before it spun out of control.

“They made low-value transactions on our website”

“Nefarious people will buy card lists from the web – the Ticketmaster data breach comes to mind – and then they will find any website they can to start seeing if those cards they’ve ‘purchased’ will work,” he says.

“So they made low-value transactions on our website, with the hope that once they got through with a card that worked, they could then go and exploit the card to its limit across the internet.”

Most worrying for business owners is the sheer magnitude of card testing and how many cards the criminals can attempt to use before their bank flags the threat.

“They’ll go to the website and try to buy a gift certificate for $50, for example,” McGrath says. “They fill out some information the first time and then use a script to just keep hammering the system and putting through seemingly thousands of transactions until they get a card through successfully. You have to be incredibly vigilant.”

Identifying scams before they occur

After speaking to a friend about the card testing incident, McGrath says they directed him to a free government-backed online program that trains small businesses to protect themselves from online threats: Cyber Wardens.

Supported by the Australian Government, COSBOA, Telstra, CommBank and the Australian Cyber Security Centre, the program is designed to arm small businesses with the skills they need to boost cyber safety practices at work and avoid attacks. It’s crucial for businesses to be able to protect themselves from potential financial and reputational damage, while also protecting customer information from falling into the wrong hands.

The program includes several course modules that can be completed in just five minutes at a time – achievable for even for the most time-strapped business owner.

“A lot of the information is common sense, but it was good to revisit those things like constantly backing up your data, removing old programs that may be lingering around, and being security conscious on password protection,” McGrath says.

As a free, self-paced online program, Cyber Wardens teaches practical cyber safety skills for any small or microbusiness, regardless of their technical expertise.

Business owners can expect engaging, visual content that breaks down how to implement software updates, set up multi-factor authentication and help teams identify scams – before the scamming occurs.

A ‘lightbulb moment’

Owners who have completed the program say one of the most valuable ‘lightbulb moments’ is recognising that cyber safety is a people issue. Given that 95 per cent of cyber attacks target people who work within the business, it’s everyone’s responsibility to get it right.

While it’s simple enough for everyone to understand, McGrath says you don’t need to be a complete beginner at cybersecurity to get something out of the Cyber Wardens program. On the contrary, as someone who had already set up two- and multi-factor authentication for his own banking, he appreciated the key focus points from each module.

“[The biggest takeaway was to] be vigilant about backing up your data,” he says. “I think you can become incredibly complacent on that. You might do it once and get it set up, but then you buy a new laptop or you migrate a system in-house and forget to back things up regularly.

“You might even think, ‘Well, am I still using Google Drive for this? Or am I now using OneDrive?’ There’s a multitude of areas where your data could be backed up. It’s easy to become complacent about your data just being in the cloud or just being physically backed up.”

Staying secure for the future

For the future, McGrath is committed to keeping the OnStone digital storefront as secure as possible. That includes guiding his small team about best practices for cyber safety.

“We use LastPass here – everybody on the team uses it for password management,” he says.

“We make sure all our processing has two-factor authentication, and we never store people’s credit card details, which I think is a big no-no. I don’t know why anyone would want a third party holding that data.”

If you want to better protect your business, become a Cyber Warden today.

This article is brought to you by Flying Solo in partnership with Cyber Wardens.