A method for operating a portable data carrier includes a processing unit for processing commands and a memory unit for storing data, with random wait states being inserted into the processing of the commands for thwarting SPA/DPA attacks. An actual checksum may be computed over the data of a selected region of the memory unit during a random wait state. A portable data carrier is arranged for executing the method.