Your Bank. Your Future.
Cyber Security
Stay safe and stay informed.
The best practice for any consumer to stay safe from identity theft or fraud is to stay informed. It’s important to not only be educated about what security threats are out there but also to be keenly aware of your own financial and personal activities. Legacy Bank provides you with many tools to stay on top of your financial information, and we’ve put together some helpful information.
Every individual will likely be a target of a scam or fraudulent activity at some point, so be aware of some of the most common threats:
- Malware – Malicious software intended to harm computer systems through viruses, worms, Trojan horses, etc.
- Phishing – Attempts to collect personal information, such as user names and passwords by an attacker claiming to be an official source via email, phone call or text typically.
- Pharming – Online fraud that redirects a true website’s traffic to a bogus website, in an attempt to collect personal login information or card payment information.
- Social Engineering – Manipulating people through targeting emotional responses to trick them in an attempt to give up or turn over valuable information
It’s good practice to be wary of anyone contacting you via email, phone, in-person who is asking personal information of you that you were not expecting contact with.
Protect Yourself
Here are some tips to help keep your identity secure:
-
- Legacy Bank, nor any other trustworthy financial provider, will initiate emails or requests for your personal or financial information. If you receive a request, it’s a good practice to call or stop by your local bank to inquire about the request.
- Be very alert with calls or emails urging you to act quickly because your account may be suspended or closed, or to update personal information. This type of call or email will not address you by name but would use a more generic greeting such as “Dear or “Dear Valued Customer’
- Fraudsters may also attempt to contact you via a text message. You might receive a text message warning that your account may be suspended, frozen, or compromised unless you visit a particular website or call a designed phone number where you will then be asked for personal information. These “scare” tactics are designed to convince you to provide your information or face negative consequences.
- Change passwords often on your online accounts. Do not use passwords that contain words or names that may be easy to guess. It’s a good idea to use special characters in place of letters and use a combination of letters, numbers and special characters. (Ex. 1bmA*pGs@h)
- Review your account transactions, account statements and credit card statements regularly to watch for any discrepancies and report them immediately.
- Be suspicious of unsolicited emails or other contacts, including attachments or requesting personal or financial information.
- Install, update and regularly run anti-virus and anti-spyware protection programs on your home and work computers.
10 Cyber Security Tips for Small Businesses
Broadband and information technology are powerful factors in small businesses reaching new markets and increasing productivity and efficiency. However, businesses need a cybersecurity strategy to protect their own business, their customers, and their data from growing cybersecurity threats.
Train employees in security principles.
Establish basic security practices and policies for employees, such as requiring strong passwords, and establish appropriate Internet use guidelines that detail penalties for violating company cybersecurity policies. Establish rules of behavior describing how to handle and protect customer information and other vital data.
Protect information, computers, and networks from cyber attacks.
Keep clean machines: having the latest security software, web browser, and operating system are the best defenses against viruses, malware, and other online threats. Set antivirus software to run a scan after each update. Install other key software updates as soon as they are available.
Provide firewall security for your Internet connection.
A firewall is a set of related programs that prevent outsiders from accessing data on a private network. Make sure the operating system’s firewall is enabled or install free firewall software available online. If employees work from home, ensure that their home system(s) are protected by a firewall.
Create a mobile device action plan.
Mobile devices can create significant security and management challenges, especially if they hold confidential information or can access the corporate network. Require users to password-protect their devices, encrypt their data, and install security apps to prevent criminals from stealing information while the phone is on public networks. Be sure to set reporting procedures for lost or stolen equipment.
Make backup copies of important business data and information.
Regularly backup the data on all computers. Critical data includes word processing documents, electronic spreadsheets, databases, financial files, human resources files, and accounts receivable/payable files. Backup data automatically if possible, or at least weekly and store the copies either offsite or in the cloud.
Control physical access to your computers and create user accounts for each employee.
Prevent access or use of business computers by unauthorized individuals. Laptops can be particularly easy targets for theft or can be lost, so lock them up when unattended. Make sure a separate user account is created for each employee and require strong passwords. Administrative privileges should only be given to trusted IT staff and key personnel.
Secure your Wi-Fi networks.
If you have a Wi-Fi network for your workplace, make sure it is secure, encrypted, and hidden. To hide your Wi-Fi network, set up your wireless access point or router, so it does not broadcast the network name, known as the Service Set Identifier (SSID). Password protect access to the router.
Employ best practices on payment cards.
Work with banks or processors to ensure the most trusted and validated tools and anti-fraud services are being used. You may also have additional security obligations pursuant to agreements with your bank or processor. Isolate payment systems from other, less secure programs and don’t use the same computer to process payments and surf the Internet.
Limit employee access to data and information, limit authority to install software.
Do not provide any one employee with access to all data systems. Employees should only be given access to the specific data systems that they need for their jobs, and should not be able to install any software without permission.
Passwords and authentication
Require employees to use unique passwords and change passwords every three months. Consider implementing multi-factor authentication that requires additional information beyond a password to gain entry. Check with your vendors that handle sensitive data, especially financial institutions, to see if they offer multi-factor authentication for your account.
If You Become a Victim
Contact your local Legacy Bank location immediately for assistance in regards to your banking relationships.
Notify the issuers of any and all credit cards you hold to determine the proper course of action with those carriers, and close any accounts that may have had unauthorized activities.
Contact at least one of the major credit reporting agencies to place a fraud alert on your credit report.
Experian
888-397-3742
http://www.experian.com
Equifax
800-525-6285
http://www.equifax.com
TransUnion
800-680-7289
http://www.transunion.com
Keep documentation of your contracts and activities regarding the identify theft incident for future reference.
Protecting Your Business Against Internet fraud
What is Corporate Account Takeover?
Corporate Account Takeover is a type of business identity theft in which a criminal entity steals a business’s valid online banking credentials. This is a fast growing electronic crime! Small to mid-sized businesses remain the primary target of criminals, but any business can fall victim to these crimes. Attacks today are typically perpetrated quietly by the introduction of malware through a simple email or infected website.
What is the Risk?
The bank’s ability to protect you is severely undermined when your online credentials are compromised by a data breach initiated within your computer system. Once your computer is compromised, any action you can take from your online banking, a criminal will attempt to do fraudulently. Bill Pay, ACH Transfer, Wires, Etc. Any possible way to financially defraud you will not be overlooked by smart criminals with the intent to steal your money or personal information.
How Does it Happen?
Hackers often take aim at small firms’ computers because they are easier to infiltrate than a bank’s systems. For example:
-
- An infected document attached to an email
- A link with an email that connects to an infected website.
- Employees visiting a legitimate website; especially social networking sites and click on the infected documents, videos, or photos that are posted there.
- An employee using a flash drive that was infected by another computer
Once the employee opens the attachment or goes to the website, malware is installed on the computer…in each case; fraudsters exploit the infected system to obtain security credentials that they can use to access a company’s business accounts. Once embedded, it can even seek out others within the network to gain secondary access or credentials. While up-to-date antivirus software offers substantial protection against malware, it isn’t 100% effective. According to the FBI, there is no single deterrent that is 100% effective against fraud, viruses and, malware
Be Aware of Danger!
-
- Monitor and report suspicious activity! Ongoing monitoring and timely reporting of suspicious activity are crucial to deterring or recovering from these frauds. Report log-ins at unusual time of day, new user accounts, unauthorized transfers, etc., so the financial institution can immediately block the account and monitor activity.
- Be wary of distraction designed to camouflage a takeover; Robo-calls, flooding your phone lines, or an email “dump” flooding your inbox – both are designed to hide any automatic alerts or phone calls from the bank.
- Legacy Bank or Clinch Valley Bank will never ask you for any personal or identifying information through an email link.
- Only use the address that you have used before or start at your normal homepage —NEVER through a link.
- Look for the lock at the bottom of your browser and “https” in front of the website address.
- Take note of the header address on the website. Most legitimate sites will have a relatively short interest address that usually depicts the business followed by .com, .net or .org. Spoof sites are more likely to have an excessively long string of characters.
- If you have any doubts about an email or website, contact the legitimate company directly. Make a copy of the questionable website’s URL address, send it to the legitimate business and ask if the address is legitimate.
- When creating your passwords, don’t use information that could easily be linked to you (i.e. phone number, your date of birth, address numbers)
- Do not share your passwords or PINs with anyone, or store them where they can be found.
Make identity and data security an operational cornerstone of your daily business. If you don’t have the time or knowledge to do so, you should seek out professional security and network professionals who can provide ongoing monitoring and protection on your behalf. Failing to take measures to protect your business will put you at increased risk for fraud and the potential loss that could follow.