[{"description":"Stick with Security: Require secure passwords and authentication lfair August 11, 2017 | 10:47AM Stick with Security: Require secure passwords and authentication By Thomas B. Pahl, Acting Director, FTC Bureau of Consumer Protection To make it harder for hackers to bluff their way onto a computer network, careful companies follow the advice of Start with Security and require strong authentication practices . We’ve considered FTC settlements, closed investigations, and the questions we get from businesses about implementing good authentication “hygiene.” Here are some tips on using effective authentication procedures to help safeguard your network. Insist on long, complex, and unique passwords. A password’s very reason for being is to be easy for a user to remember, but hard for a fraudster to figure out. Obvious choices like ABCABC, 121212, or qwerty are the digital equivalent of a “hack me” sign. Furthermore, experts have determined that passphrases or longer passwords are generally harder to crack. The smarter strategy is for companies to think through their standards, implement minimum requirements, and educate users about how to create stronger passwords. Also, when you install software, applications, or hardware on your network, computers, or devices, change the default password immediately. And if you design products that require consumers to use a password, configure the initial set-up so they have to change the default password. Example: A staff member attempts to select payroll as the password for the database that includes employee payroll information. The company sets up its system to reject an obvious choice like that. Example: To access the corporate network, a business allows employees to type in their username and a shared password common to everyone who works there. Employees are also allowed to use that shared password to access other services on the system, some of which contain sensitive personal information. The more prudent policy would be to require strong, unique passwords for each employee and to insist that they use different passwords to access different applications. Example: At a staff meeting, a company’s IT manager offers tips for employees about good password hygiene. She explains that passphrases or longer passwords are better than short passwords based on standard dictionary words or well-known information (for example, a child’s name, a pet, a birthday, or a favorite sports team). By establishing a more secure corporate password standard and educating employees about implementing it, the IT manager is taking a step to help her company reduce the risk of unauthorized access. Store passwords securely. A company’s first line of defense against data thieves is a workforce trained to keep passwords secret. But even the strongest password is ineffective if an employee writes it on a sticky note on her desk or shares it with someone else. Train your staff not to disclose passwords in response to phone calls or emails, including ones that may appear to be coming from a colleague. Con artists have been known to impersonate corporate officials by spoofing phone numbers or email addresses. A compromised password poses a particular risk if it can be used to open the door to even more sensitive information – for example, a database of other user credentials maintained on the network in plain, readable text. Make it difficult for data thieves to turn a lucky password guess into a catastrophic breach of your company’s most sensitive data by implementing policies and procedures to store credentials securely. Example: A new employee gets a call from someone who claims to be the company’s system administrator. The caller asks him to verify his network password. Because the new staffer learned about impersonation scams at an in-house security orientation, he refuses to disclose his password and instead reports the incident to the appropriate person in the company. Example: A company keeps user credentials and other passwords in plain","pubDate":"Mon, 05 Oct 2026 08:07:08 +0200","id":3197409,"titre":"Stick with Security: Require secure passwords and authentication","url":"https://www.ftc.gov/business-guidance/blog/2017/08/stick-security-require-secure-passwords-authentication","source":"FTC USA Business Blog Posts"},{"url":"https://www.ftc.gov/news-events/news/press-releases/2026/09/ftc-seeks-public-comment-whether-update-rule-impersonation-government-businesses-address-platforms","source":"Federal Trade Commission - Protecting America's Consumers","id":3176041,"pubDate":"Fri, 25 Sep 2026 08:10:48 +0200","titre":"FTC Seeks Public Comment on Whether to Update Rule on Impersonation of Government and Businesses to Address Platforms’ Role in Promoting Impersonation Scams","description":"The Federal Trade Commission announced today that is considering whether to update its Rule on Impersonation of Government and Businesses or take other action to prevent online platforms from engaging in ad-optimization practices that may be furthering impersonation scams. In an Advance Notice of Proposed Rulemaking (ANPRM) to be published in the Federal Register , the FTC is seeking comment on the extent to which ad-optimization tools and services offered by social media, search engines and other digital marketplace platforms further efforts by scammers to impersonate legitimate businesses and government agencies using online ads.  “Free markets depend on trust, transparency and consumers’ ability to make informed choices. Impersonation scams—especially when amplified by digital platforms that profit from them—do more than rob Americans of their hard-earned money,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “They erode the very foundation that allows competitive markets to function. Today’s impersonation scams are no longer the work of isolated con artists; they are sophisticated, highly engineered operations powered by the same advertising and targeting tools that platforms sell to legitimate businesses. Consumers reported nearly $3.5 billion in losses to impersonation fraud last year, and the true cost is likely far higher. “The Commission’s mission has always been to safeguard the conditions under which competitive markets can thrive. Increasingly, consumers rely on a small number of dominant digital platforms for everyday transactions—from shopping, banking and travel bookings to accessing government services. Yet these platforms are the very places fraudsters seek out consumers, exploiting their trust while platforms profit from optimizing and disseminating scam ads. “Today’s advance notice of proposed rulemaking asks whether the Commission should require platforms to take concrete steps to prevent impersonation ads from ever reaching consumers. By exploring potential new obligations platforms would have to follow, the rulemaking aims to ensure that Americans participate in an online economy where truthful information guides consumer choice.”  Impersonation scams have topped the list of fraud complaints reported to the FTC by consumers in recent years. In 2025, the FTC received more than 1 million reports about imposter scams from consumers, who reported losing nearly $3.5 billion to such scams. In addition, online platforms play an important role in many scams. For example, nearly 30% of consumers who reported losing money to scammers in 2025 said they were first contacted on social media platforms, with reported losses reaching $2.1 billion. The ANPRM notes that impersonation scams have been amplified by search engines, social media and other digital marketplace platforms that profit from optimizing online ads for third parties, regardless of whether the third parties are legitimate. The ANPRM seeks comment on a wide range of topics related to the use of these ad-optimization tools and services and the proliferation of ads that impersonate businesses and government agencies including:  The financial incentives driving these platforms to offer ad-optimization tools and services, details on how each tool and service optimizes the content and delivery of the ad, and the steps platforms currently take to prevent the use of such tools and services for deceptive advertising The extent to which these platform ad-optimization tools and services constitute unfair or deceptive acts or practices by furthering impersonation scams Whether these unfair or deceptive acts or practices are prevalent in the marketplace and whether the Commission should address these acts or practices by amending the existing Impersonation Rule, proposing a new separate rule or implementing non-regulatory Measures Measures the Commission could consider in crafting any new regulations, including vetting"}]