Deloitte: Buyers risk identity theft on 65% of Irish websites

A number of websites do not enforce adequate security for online payments, leading to a greater risk of identity theft and fraud, according to analysis from Deloitte Enterprise Risk Services.

The analysis looked at more than 100 Irish-based e-commerce websites and examined the security levels that were in place for online payments.

While certain progress has been made in complying with the Payment Card Industry Data Security Standards (PCI DSS), a lot of websites analysed are still not compliant with the standards.

PCI DSS is the set of standards which was created by the major credit card firms including Visa, MasterCard, American Express, Diner’s Club, Discover and JCB.

These standards cover a range of areas including building and maintaining a secure network, protecting cardholder data, implementing strong access control measures and maintaining an information security policy.

Up to 53% of companies supported weak or legacy encryption, with 2% of sites not encrypting cardholder data entry sessions at all.

This means that the information that visitors to the site submit - such as name, address and credit card details - can potentially be compromised and accessed by fraudsters.

Also, 7% of websites did not require a CVV2 number – the three-digit code on the back of credit cards. By requesting this number, the risk of fraud is greatly reduced.

The survey also showed that 3% of websites had expired SSL certificates. SSL certificates verify that the website being interacted with is who it claims to be.