It’s that time of year again—the festive season when you’re most at risk for identity theft. Like demented elves in Santa’s workshop, scammers work all year long to create ways to steal your personal data, creating the ultimate gift that keeps on giving—unwinding the theft to recover your identity, your bank accounts, and your life. Say “Humbug” to scammers and cyberthieves with these tips for keeping your data safe all year long.

Data theft falls into two main categories: either the merchant’s information is stolen, meaning all the credit card data they store is compromised, and or your personal information is stolen when you inadvertently respond to their requests for information.

Protecting Yourself from a Data Breach

You may think you’re helpless against a sophisticated scammer who’s targeting major retailers, but you have a number of tools to combat theft—you just need to know that they exist, because they’re all pretty easy to use.

Keep Your Card Data Private

No matter how much you shop at Amazon or Best Buy, don’t store your card information on the retailer’s website. Keep your card data private.

Use a Third Party App

Apps like ApplePay and GoogleWallet, and PayPal put another layer of security between you and the retailer. When you put your card number into your mobile app, the app creates a unique series of characters to replace your data when you run a transaction. Here’s an example. If your card number is ABC, PayPal will create CX{{ to replace it in their system. When you use PayPal for an online transaction, that CX{{ is what the merchant, and any scammer watching the merchant’s account, sees.

Set Up Purchase Alerts

You can ask your bank to let you know of any activity above a certain threshold. You can also disable any international purchases. Visa and MasterCard offer additional security features, such as purchase verification, to keep your data secure.

Don’t Use Public WiFi

If you’re shopping online, do it at home on your secured network. Your card data could be intercepted on a public WiFi network.

Use Two-factor Authentication

This second security step is also called multi-factor, two step, MFA, or 2FA, but it’s all the same thing—an additional layer to protect your data. Passwords are easy to guess, and most people use the same password for everything—making it exponentially easier to break into your data. It’s the same concept as using your fingerprint or facial scan to unlock your phone—you’re the only one who can provide that unique information.
When you set up two-factor authentication, you’ll provide something like a PIN or your dog’s birthday, and  you’ll get a text with a code on your phone to confirm your identity.

Don’t Go Phishing

That Nigerian prince who’s stuck at some random airport is getting better at stealing your money. Scammers are sending incredibly realistic-looking emails from well-known retailers, offering unbelievable online deals. Remember, if it seems too good to be true, it probably is. Here’s how to tell if it’s a scam or if WalMart is really selling iPhones for $10.

Don’t click on those links! Instead, go to the company’s website to see if the deal is listed there. But–scammers are more sophisticated than ever. Are you sure you’re at a legitimate website? Here’s how you can confirm it’s really WalMart.

Hover over the name on the search bar to see the URL—the site’s internet address. It usually begins with https:// and the company name.  That s on the end means the site is secure. Use a search engine to find the website–don’t click over from an online ad or email. Another way to confirm the site is real is to find a locked padlock icon next to the URL.

In short, trust your instincts, and if you trust a retailer, verify their identity.