1

I just clicked a phishing link and foolishly entered my credit card details. I realized it was phishing before I hit SUBMIT. Is there a chance I exposed my data?

Illia Strikhar
  • 11
  • 2
  • Depending on how the site was designed, it's possible. Some sites send each keystroke that is typed in a text field to the server. For example, think about Google - after each character that you type in the search box, it shows you suggestions. To do this, it must send each keystroke to Google's server. One way to know if the phishing site that you visited is doing this is to go back to the site, start typing in the text box, and use the networking tab in the developer tools to see if there is network activity after each character that you type. – mti2935 Mar 20 '22 at 22:35
  • As mentioned, keystrokes can be intercepted, and you can also check the javascript for how the values are handled to check when data is sent (which is perhaps more reliable than checking for network data on every keystroke as it may be cached and sent with a delay). Couple caveats here though, it might be php not js, and may be obfuscated, and checking the source isn't very useful advice if you're unfamiliar with code) – belkarx Mar 21 '22 at 03:55

1 Answers1

1

In principle, yes. It may very well be that there is a script running in the background of the page, for instance. In that case the data can be send to the server. However, if that is the case it should be possible to get the script from the phishing site - even if the scripts are obfuscated, or you could try and inspect the communication after filling in the number, e.g. using the developer tools or a proxy. In principle the data could also be stored in e.g. a cookie, but as you may not visit the site again that's rather less likely.

The attackers may not take the risk of having their site scrutinized for such things as it would indicate a phishing attempt for crawlers of companies such as Google, and it would only catch a minimal amount of additional credit card numbers.

If you are not sure then you should probably call your credit card company to have your card temporarily blocked.

Maarten Bodewes
  • 4,562
  • 15
  • 29