Learning Objectives

By the end of this chapter, you will be able to:

  • Identify the major security threats in e-commerce.
  • Distinguish viruses, worms, Trojan horses, ransomware, and botnets.
  • Explain phishing and its variants, and recognise a phishing message.
  • Describe hacking, data breaches, card fraud, spoofing, sniffing, insider attacks, and DoS/DDoS attacks.
  • Relate each threat to the security dimension it violates and to examples from Nepal.

Major Security Threats in E-commerce

Several major types of threats can affect an e-commerce site, its customers, and the channel between them. Some attack technology; many attack people.

flowchart TB
  Threats[E-commerce Security Threats]
  Threats --> Mal[Malicious Code / Malware]
  Threats --> Phish[Phishing]
  Threats --> Hack[Hacking]
  Threats --> Vandal[Cybervandalism]
  Threats --> DoS[DoS / DDoS]
  Threats --> Breach[Data Breaches]
  Mal --> V[Viruses]
  Mal --> W[Worms]
  Mal --> T[Trojan Horses]

Figure 1: Taxonomy of major e-commerce security threats

1. Malicious Code (Malware)

Malicious code (malware) is software designed to harm systems, steal data, or take control of a device.

Type How it works
Virus Attaches to a file or program and spreads when the infected file is run
Worm Spreads by itself from computer to computer over a network, without user action
Trojan horse Looks like useful software (a free game, a “cracked” app) but carries a hidden harmful payload
Ransomware Encrypts the victim’s files and demands payment for the key
Spyware and keyloggers Secretly record activity and keystrokes, including passwords and card numbers
Bots and botnets Infected computers controlled remotely, often used together for spam or DDoS attacks

Potentially unwanted programs (PUPs), such as aggressive adware and browser hijackers, are installed without clear consent and change settings or show unwanted ads.

2. Phishing and Social Engineering

Phishing is a form of social engineering: the attacker pretends to be a trusted organisation, such as a bank, wallet, or online shop, to trick the victim into revealing passwords, PINs, one-time passwords (OTPs), or card details.

  • Email phishing: Mass emails with links to fake login pages.
  • Spear phishing: Targeted messages to one person, such as a company’s accountant, using personal details.
  • Smishing: Phishing by SMS or messaging apps (“Your wallet will be blocked, click here”).
  • Vishing: Phishing by phone call, often pretending to be bank staff asking for an OTP.

Worked example: anatomy of a phishing SMS

“Dear customer, your wallet KYC has expired. Update within 24 hours to avoid account block: http://wallet-kyc-update.info/login”

Warning sign Why it is suspicious
Urgency (“within 24 hours”) Pressure stops people from thinking carefully
Threat (“account block”) Fear makes people act quickly
Link domain Not the wallet’s official domain; a look-alike address
Asks for login or OTP Genuine providers never ask for a PIN or OTP by message or phone

The safe response is to ignore the link, open the official app directly, and report the message to the provider.

3. Hacking and Cybervandalism

Hacking is unauthorised access to a computer system. Attackers are often described by their intentions:

  • Black hats break in for money, data, or damage.
  • White hats are hired, with permission, to find weaknesses before criminals do (ethical hacking, penetration testing).
  • Grey hats break in without permission but claim good intentions, such as reporting the flaw afterwards.

Cybervandalism is deliberately defacing or destroying a website, for example replacing the home page with a message. Hacktivism is cybervandalism for political or social causes.

4. Data Breaches

A data breach occurs when someone gains unauthorized access to sensitive information — customer names, passwords, payment details, or order history — and copies or exposes it. Breaches can happen through weak passwords, unpatched software, insider misuse, or a successful phishing attack on an employee. For e-commerce, the impact includes financial loss, regulatory penalties, customer churn, and long-term reputational damage. Prevention combines encryption, access controls, staff training, and incident response plans so the business can detect and contain a breach quickly.

5. Card Fraud and Identity Fraud

  • Credit and debit card fraud: Stolen card details are used for online purchases. Card data can come from breaches, skimming devices on ATMs, or phishing.
  • Identity fraud: Criminals use stolen personal data (name, citizenship number, phone number) to open accounts, take loans, or pass KYC checks in someone else’s name.

Merchants usually bear the cost of fraudulent online card payments through chargebacks, which is why they use verification checks and fraud screening.

6. Spoofing, Pharming, and Spam Websites

  • Spoofing means pretending to be someone else, such as a fake sender email address or a fake website that copies a real shop.
  • Pharming redirects users from a real web address to a fake site, for example by tampering with DNS, so the victim types the correct address but lands on the attacker’s page.
  • Spam (junk) websites promise cheap products or prizes but exist only to collect data, spread malware, or take payment without delivering.

7. Sniffing and Man-in-the-Middle Attacks

A sniffer is a program that eavesdrops on network traffic. On an unencrypted connection, such as an open café Wi-Fi network without HTTPS, an attacker can read passwords and messages. In a man-in-the-middle (MITM) attack, the attacker secretly sits between the customer and the site, reading or changing the data. HTTPS (TLS encryption) is the main defence.

8. Insider Attacks

Not all threats come from outside. Employees and contractors with legitimate access can steal customer data, misuse refunds, or leak information, either deliberately or by mistake. Insider attacks are hard to detect because the person is allowed to be on the system. Controls include giving staff only the access they need, logging activity, and removing access when people leave.

9. Poorly Designed Software

Many attacks succeed because the software itself has flaws:

  • SQL injection: An attacker types database commands into a form field (such as a login or search box). If the site does not check the input, the database runs the commands and may reveal or delete data.
  • Unpatched software: Old versions of plugins, content management systems, and servers have known weaknesses that attackers scan for automatically.
  • Zero-day vulnerabilities: Flaws unknown to the software maker, with no fix yet available.

10. Denial-of-Service (DoS) and DDoS Attacks

A denial-of-service (DoS) attack floods a website with useless traffic so that real customers cannot reach it. A distributed denial-of-service (DDoS) attack uses thousands of computers at once, usually a botnet, which makes it much harder to block. For an online shop, a DDoS attack during a festival sale means lost revenue and damaged trust. Defences include DDoS protection services, content delivery networks, and extra server capacity.

11. Threats on Mobile Platforms and Social Networks

  • Mobile: Fake apps, malicious APKs shared outside official app stores, SMS-based phishing, and stolen phones without a screen lock.
  • Social networks: Fake seller pages, hacked accounts used to message friends for money, and fake giveaways that collect personal data.

Threats and the Dimensions They Violate

Threat Main dimension violated
Malware, ransomware Integrity, availability
Phishing, identity fraud Authenticity, confidentiality
Data breach, sniffing Confidentiality, privacy
Cybervandalism, SQL injection Integrity
Spoofing, pharming Authenticity, integrity
DoS / DDoS Availability
Card fraud with denial of purchase Nonrepudiation

See the six dimensions of e-commerce security and the technology solutions used against these threats.

Common Security Threats in Nepal

Nepali e-commerce businesses and consumers are facing a growing number of security threats. Some of the most common threats include:

  • Phishing and vishing: Messages and calls pretending to be from banks, wallets, telecom operators, or prize schemes are common. They usually aim to get the victim’s OTP or PIN.
  • Social engineering on social media: Hacked Facebook and Messenger accounts are used to ask the victim’s friends for urgent money transfers, and fake seller pages take advance payment for goods that never arrive.
  • Attacks on financial institutions: In 2017, attackers used the SWIFT system of NIC Asia Bank to send fraudulent international transfers; most of the money was later recovered. Card-skimming at ATMs has also been reported.
  • Data breaches: In 2020, user data from the food delivery platform Foodmandu was leaked online. Breaches like this expose names, phone numbers, and addresses that criminals then use for targeted phishing.
  • Malware: Pirated software and apps installed from outside official stores are common sources of infection for both businesses and customers.

Most of these attacks succeed through people rather than technology, which is why customer awareness and staff training are as important as firewalls and encryption.

Summary

E-commerce faces many threats. Malware (viruses, worms, Trojans, ransomware, spyware, and botnets) damages systems or steals data. Phishing and other social engineering attacks trick people into revealing credentials. Hacking, cybervandalism, and data breaches expose or damage systems and customer information, and card and identity fraud turn stolen data into money. Spoofing and pharming send customers to fake sites, sniffing reads unencrypted traffic, insiders misuse their access, poorly designed software allows attacks such as SQL injection, and DoS/DDoS attacks take sites offline. In Nepal, phishing, social media fraud, and data breaches are the most visible threats.

Key Takeaways

  • Malware includes viruses (need a host file), worms (spread alone), Trojans (disguised), and ransomware (encrypt and extort).
  • Phishing attacks people, not machines; never share an OTP or PIN.
  • DDoS attacks use botnets to make a site unavailable.
  • SQL injection and unpatched software are common technical weaknesses.
  • Each threat violates one or more of the six security dimensions.

Discussion Questions

  1. What are the signs that an email might be a phishing attempt?
  2. Why would someone launch a denial-of-service attack against a website?
  3. What is the difference between a DoS and a DDoS attack?
  4. Why are insider attacks especially hard to prevent?

Exam-Style Questions

Short answer

  1. Distinguish between a virus and a worm.
  2. What is a Trojan horse? Give an example.
  3. What is phishing? Name two of its variants.
  4. Define a DDoS attack and a botnet.
  5. What is SQL injection?

Long answer

  1. Explain the major security threats in the e-commerce environment with suitable examples.
  2. What is malicious code? Describe its different types and their effects on e-commerce businesses.
  3. Discuss the common e-commerce security threats in Nepal and how businesses and customers can reduce them.