Safety Precautions for Internet Banking or Shopping
Going Mobile: How to be Safer When Using a Smartphone or Tablet
Beware of Malware: Think Before You Click!
Cybersecurity for Small Businesses: Ways to Stay Protected
How to Avoid Identity Theft Online
Using Social Networking Sites: Be Careful What You Share
For Parents and Caregivers: Tips for Protecting Your Child’s Personal Information
The Roles of Banks and the Government
How Federal Laws and Industry Practices Limit Losses From Cyberattacks
Dear FDIC: Questions About Deposit Insurance and Online Banking
Additional FDIC Resources for Consumers
A Cybersecurity Checklist
For More Help or Information on Cybersecurity
Keep in mind however, that even if you think your security has been compromised, it does not automatically mean that you are a victim of identity theft. It might be an incorrect entry or an isolated incident of theft from your First Bank account that is quickly resolved by calling First Bank at (601) 684-2231.
How Identity Theft Can Happen
Dumpster diving for documents containing personal or financial information
Stealing a purse or wallet
Taking incoming or outgoing mail from your home mailbox
Breaking into your home and taking documents or a computer with personal or financial information stored on it
Shoulder surfing at ATM machines and phone booths in order to capture PIN numbers
Identity thieves change the address on account statements or bills and have them sent to their address or, more likely, a PO Box
Stealing information where they work
Bribing an employee
Conning an employee (see pretext calling)
Hacking into a company’s computer system
Stealing credit/debit card information by using a data storage device when processing (swiping) a card
Phishing – fishing for confidential information
The consumer receives an email that appears to be valid and originate from a financial institution, government agency or other reputable entity
The message states an urgent reason why you must “verify” or “re-submit” personal or confidential information by clicking on a link embedded in the message – the link appears to be the website of the legitimate company but really belongs to the “phisher”
Software that can track online usage and personal information, even record every keystroke
Often unknowingly installed by consumers because it is packaged with other software
Trojan Horse virus
An email virus usually released by opening an email attachment
The virus scours the hard drive for personal information then sends this information to the thief’s email address
The identity thief calls a financial institution posing as a customer, an official at another bank, a government regulator or a law enforcement officer trying to get information on customer’s account
May use intimidation (threatening to close account), helplessness or claim an emergency situation
What to Look For
New or replacement credit cards that don’t arrive in a timely manner
Credit card bills or account statements for accounts you didn’t open
Calls or letters from collection agencies about accounts you didn’t open
Unexpected denials of credit
Emails asking for personal information that don’t address you by name, threaten action if you don’t respond, or contain spelling errors
For more information on Identity Theft visit http://www.consumer.ftc.gov/features/feature-0014-identity-theft.
How to Prevent Identify Theft
Always keep this information in a safe place.
Never email any of the above information even to your banker. Email is not a secure transmission. It is the equivalent of a postcard and you wouldn’t put your social security number on a postcard for the post office to read, would you?
Shred any financial offers you receive such as those for credit card offers and any bank statements before throwing them away. Consider getting your bank statements online, it will not only help protect your identity but it will help the environment.
Protect your ATM PIN number and ATM receipts.
Keep your ATM card and PIN number separate and shred them if you should need to dispose them. Never write your PIN number on your card, memorize it instead.
Report lost or stolen checks, debit cards or credit cards immediately to the appropriate party.
If you see something questionable on a bill, don’t hesitate to question it as this may help prevent possible fraud.
Annually check your credit report for accuracy and report any errors immediately.
Review your account statements regularly, online and on paper.
If You Become a Victim
Contact us immediately at (601) 684-2231 or the company involved immediately and have all accounts closed or monitored for further changes.
Contact all three major credit bureaus to place a fraud alert on your file, this can help prevent thieves from obtaining any new credit in your name. For more information about the steps to take, and to get your credit reports, contact the credit bureaus listed below:
Equifax: 1-800-525-6285 or www.equifax.com
Experian: 1-888-397-3742 or www.experian.com
TransUnion: 1-800-680-7289 or www.transunion.com
Contact other creditors. Contact your other creditors including credit card and phone companies, as well as banks and other lenders, to notify them of potential fraud. Always follow up any telephone conversations with a letter. Close any accounts that have been breached and reopen them with new account numbers and passwords. We strongly suggest not using your Social Security number as either a username or password.
File a report with the local police. Contact your local police department if you suspect that your personal information was stolen. A police report will lend weight to your case when dealing with creditors who may require proof of criminal activity.
Report the criminal activity to the Federal Trade Commission (FTC). Call the toll-free hotline at 1-877-ID THEFT (1-877-438-4338) to speak with a trained identity theft counselor. Or enter information about your complaint into a secure FTC online database at ftc.gov/complaint. Your information may be shared with other law enforcement agencies investigating identity theft.
You can also file a complaint with the appropriate federal investigative law enforcement agency. For a list of appropriate law enforcement agencies, go to www.justice.gov/criminal/cybercrime/reporting.html
Contact other agencies as appropriate:
Postal Inspection Service at www.usps.com. If you believe your mail was stolen or redirected, notify the Postal Inspector at your local post office.
Social Security Fraud Hotline at 1-800-269-0271. If you suspect someone is using your Social Security number for fraudulent purposes, call the hotline.
Department of Motor Vehicles office at www.dmv.org. If you believe someone is trying to get a driver’s license or identification card using your name and information, contact your local DMV
Carefully review all your credit files and accounts. Since identity theft takes time to completely resolve, you should continue to carefully review all charges and transactions appearing on account statements and online. Keep all receipts and records for proof of legitimate purchases. Any discrepancies should be reported immediately.
How First Bank Protects You While Banking Online
These layers include:
All Online Banking data transmitted to us is encrypted. Encryption is the process of transforming information into an indiscernible coded message. When you click on “login”, we encrypt your Online Banking User ID and PIN using Secure Sockets Layer (SSL) technology. This secure connection is established before your Online Banking User ID and PIN are transmitted and maintained for the duration of your Online Banking session.
If you are using one of the following browsers; Microsoft IE 7.0 or higher, Firefox 3.0 or higher, or Safari 3.2 or higher, an EV (Extended Validation) SSL certificate will be active. The EV SSL certificate will be evident as the browser will display https://, turn green, show a closed padlock and rotate “First Bank” and “Identified by VeriSign”.
After your initial login, we require you to change your Online Banking PIN before any transactions can be requested.
PIN guessing is deterred with a lock-out feature. Our system will automatically lock-out a user when an incorrect PIN is entered multiple consecutive times.
Online Banking sessions have a time-out limit requiring you to login again after a period of inactivity to prevent unauthorized access to your session.
Account numbers are not visible through Online Banking unless you choose to display the account number through the “Pseudo Name” function, however, this is not recommended in order to protect your information.
Our Identity Verification Feature provides an additional layer of security by getting to know you and your typical and characteristic Online Banking behavior. If atypical behavior is detected you will be prompted to verify your identity by answering your established Challenge Questions.
A personal Watermark feature appears during the login process for your assurance that you have accessed the authentic First Bank Online Banking site.
Secure ID Tokens are available for Online Banking with Cash Management accounts. Based upon time synchronization technology, this authentication device generates a simple, one-time code that changes every 35 seconds. The token is used in conjunction with your Online Banking User ID and PIN.
Upon proper exit from Online Banking, an alert will be displayed requesting to close the webpage of the session you have logged out of.
Understanding the Risks
Phishing is a scam where Internet fraudsters request personal information (such as User IDs, PINs, and identifying information), from users online. These requests are most commonly in the form of an email from an organization with which you may or may not do business. Fraudulent emails such as these may look official, sometimes including the company logo. The email usually states that the company needs you to update your personal information or that your account is about to become inactive, all in an effort to get you to click on a site or divulge confidential information. No reputable business will ever email you requesting that you update your personal information, including account numbers, system passwords or Social Security Numbers via a link to their site.
Unlike phishing, fraudsters using a technique called “pharming” don’t lure their victims with emails. Instead, they install malicious software or use other means to re-direct a user to a fraudulent website – even if the user types the correct address into their browser or uses an existing bookmark for their bank’s website. This means when you type a legitimate website address into a web address bar you are redirected without your knowledge to a bogus site that looks identical to the genuine site. Once you log in with your login name and password, the information is immediately captured by the fraudster.
SMiShing or Vishing
There is a variant of traditional phishing scams that uses telephone calls, instead of email, to collect confidential information. Customers may receive an automated phone call or an email saying their account has been compromised and gives them a phone number to call to resolve the issue. When they call, they reach an automated answering program that asks them for confidential information to verify their account. Customers should never give confidential information in response to suspicious requests such as these.
Adware, or advertising-supported software, is any software package which automatically plays, displays, or downloads advertisements to a computer after the software is installed on it or while the application is being used. It is usually integrated into or bundled with a legitimate program. It can be used to carry spyware or trojans.
Spyware is a type of malware that is typically secretly installed on computers and collects little bits of information at a time about users without their knowledge and can be difficult to detect. The software then relays this information to advertisers, marketing groups, and others for advertising or malicious purposes. Information that is commonly collected includes login IDs, PINs, account information and computer files.
Spyware is usually installed without your knowledge when you download legitimate software. Sometimes the fine print of the license agreement includes information about the spyware component, but not always. Spyware is known to change computer settings, resulting in slow connection speeds, different home pages, and/or loss of Internet or functionality of other programs.
Keylogging is a method by which fraudsters record your actual keystrokes and mouse clicks. Keyloggers are “trojan” software programs that target your computer’s operating system (Windows, Mac OS, etc.) and are “installed” via a virus. These can be particularly dangerous because the fraudster can capture your User ID and PIN, account number, Social Security Number, “Secret Question” answers and anything else you have typed. If you happen to have the same User ID and PIN for many different online accounts, you’ve essentially granted the fraudster access to any company with whom you do business.
Trojan horses are designed to allow a hacker/fraudster remote access to a target computer system. Once a trojan horse has been installed on a target computer system, it is possible for the hacker/fraudster to access it remotely and perform various operations. Operations that could be performed by a hacker/fraudster on a target computer system include:
Use of the machine as part of a botnet (i.e. to perform spamming or to perform Distributed Denial-of-service (DDoS) attacks.)
Confidential Data theft: User IDs, PINs, account information.
Installation of software, including other malware.
Downloading or uploading of files.
Modification or deletion of files.
Viewing the user’s screen.
Wasting computer storage space.
Crashing the computer.
A virus is software capable of causing great harm to files or other programs on a computer. Viruses cannot spread from computer to computer on their own. They usually access new victims through infected email attachments. Some signs that may indicate your computer is infected with a virus include:
It is operating much slower than normal or getting hung up.
You suddenly start seeing pop-up advertisements.
You see a new home page.
A computer worm is a self-replicating malware computer program that uses a computer network to send copies of itself to other computers without user intervention. Unlike a virus, it does not need to attach itself to an existing program. Worms almost always harm the network (mostly by consuming bandwidth), whereas viruses almost always corrupt or modify files on a targeted computer.
A software system that consists of a program, or combination of several programs, designed to hide or obscure the fact that a system has been compromised. Contrary to what its name may imply, a rootkit does not grant administrator access, as it requires prior access to execute and tamper with system files and processes. An attacker may use a rootkit to replace vital system executables, which may then be used to hide processes and files the attacker has installed, along with the presence of the rootkit.
Online Banking Security Guidelines
While using a computer in public areas beware of “shoulder surfers” who may be trying to intercept your PIN or account information.
Do not use the same computer for online banking transactions that you use to browse the Internet.
Monitor your account on a daily basis to detect any unusual activity immediately.
Beware of fraudulent emails or websites known as “Phishing” or “Web Spoofing” schemes that appear to be from First Bank or other legitimate sites.
Always go directly to First Bank’s website by typing www.firstbankms.com directly into the browser address bar. Never click on unverified links in emails, in pop-up ads, or on other unknown sites. These emails and links may ask for personal information or may redirect you to illegitimate sites that look like First Bank’s site or appear to have the First Bank URL address in the browser address bar.
Know what your Financial Institution’s website looks like and what questions are asked to verify your identity. Some attacks, known as man-in-the-middle attacks, will change the login page. A vigilant user can sometimes spot these attacks by noticing slight modifications to the Bank’s standard page; extra security questions, poor grammar, misspellings, a fuzzy or older logo or a change to the location of each feature.
Be suspicious of any email that asks for personal information, requests your authentication, or indicates a problem with your First Bank account. If you receive an email like this, DO NOT REPLY by email. Instead call First Bank at (601) 684-2231 to notify us of the fraudulent email. First Bank does not request personal or account information from clients via email or pop-up windows.
Only use trustworthy computers. Shared public computers like those in airport lounges, internet cafes, public libraries, and hotel lobbies could be connected to keystroke loggers or infected with password-stealing viruses. Do not use them to access Online Banking or other websites containing confidential information about you.
Online Banking PIN Guidelines
Create a strong and unique Online Banking PIN by making it as long and complex as possible with a combination of uppercase and lowercase letters, numbers, and symbols. Refrain from using predictable sequences of characters such as “1234” or “abcd”. Do not use your Online Banking ID in your PIN.
Do not use words that can be found in a dictionary or information related to you such as your birth date, address, names of family members, etc.
Disable any “AutoComplete” or similar features on any computer you use for Online Banking.
Do not write down your PIN.
Do not share your Online Banking PIN with anyone, including First Bank employees. Your Online Banking ID and PIN are assigned to you and verify who you are when you begin and Online Banking session with First Bank.
If you feel that your Online Banking ID and/or PIN have been stolen or compromised, immediately change your PIN Online and notify First Bank.
Change your PIN on a regular basis. We recommend changing your PIN every 60-90 days.
Do not use the same PIN for various websites.
Never email your PIN or respond to an email request for your PIN or other confidential information. First Bank will never ask you to submit confidential information in an email.
Consider using the built-in security features that are provided with your Internet browser instead of disabling them.
Use a software or hardware firewall to protect your computer from network intrusion.
Maintain and run anti-spyware, anti-malware, and anti-virus software to detect new threats.
If your computer is on a wireless network (home or public), ensure that the router settings are secure, (encrypted). Using scanning devices, individuals can intercept unencrypted signals and view or obtain your information.
Use caution when downloading files, installing software, or opening email attachments from unverified or unknown sources. Many of these files contain spyware or key-logging programs that can send information back to a malicious site.
Be suspicious of emails purporting to be from a Financial Institution, government department or other agency requesting account information, account verification or banking access credentials such as User ID’s, PIN’s, Codes and similar information. Opening file attachments or clicking on web links in suspicious emails could expose the system to malicious code that could hijack your computer.
We recommend clearing the browser cache before starting an Online Banking session in order to eliminate copies of web pages that have been stored on the hard drive.
Always lock your computer when you leave it unattended. Set the computer to automatically lock after a set period of inactivity, e.g. 5 minutes.
When you are finished with your computer turn it off or disconnect it from the Internet by unplugging the modem or Ethernet/DSL cable.
Properly dispose of old computers and ensure all sensitive information is removed from the hard drive. Reformatting the hard drive may not be sufficient – use specialized software to erase information
Additional Computer Security Guidelines for Business
The following recommendations are cyber security best practices that help reduce the risks associated with online banking. Nothing can eliminate all of the risks, however, an informed and vigilant user is a key defense. In conjunction with our Online Banking Security Information document the following is a list of additional online banking security measures for our Commercial Clients:
Install a dedicated, actively managed firewall. A firewall limits the potential for unauthorized access to a network and computers.
Install well known and supported anti-virus and desktop firewall software on all computer systems. Look for names you know and read independent reviews of all products you use.
Ensure computers are patched regularly, particularly operating systems and key applications with security patches. It is highly recommended to sign up for automatic operating system updates for the operating system and many non-operating system applications.
Change the default login names and PINs on routers, firewalls, and other network equipment and software.
Monitor log files, especially proxy server logs, for unauthorized/suspicious Internet connections coming to and leaving the network.
Carry out all online banking activities from a hardened and completely locked down computer system.
Use a single computer with a static IP Address for all online banking transactions. If possible, register this IP Address with the Financial Institution. Actively monitor the computer for viruses and other malware and limit this computer from conducting any other Internet activity, including email.
Use a dedicated computer for all online transactions and implement white listing methods to prevent the system from going to any site/address that does not have a documented business need.
Whenever possible do not use a wireless network for financial transactions. If a wireless network must be used, enforce security measures such as enabling encryption and MAC address filtering, changing the service set identifier (SSID) and turning off SSID broadcasting.
Turn off and remove services that are not needed on computers. Allow the use of CDs, DVDs, USB devices for legitimate business needs only.
Consider blocking Internet plug-ins on the computers that access online banking accounts. Disabling Flash, scripts, pop-up windows, etc., can be frustrating for general users but will prevent multiple exploits.
Educate users on good cyber security practices to include how to avoid having malware installed on a computer and new malware trends.
Make sure employee computer profiles have the least privilege possible to do their job.
Ensure employees cannot override or circumvent security software.
Only approved company applications should be deployed on your computers, and should be patched regularly.
Use a mail service that blocks or removes email file attachments such as files that end in .vbs, .bat, .pif, or .scr. These are file extensions for executables, and are commonly dangerous files.
Prohibit the use of shared User IDs and PINs for Online Banking.
Develop and implement employee rules and policies concerning appropriate and allowed use of the Internet.
Instill good security habits with your employees. Develop a security awareness program that addresses the risks specific to your business and/or to the specific functions within your company. Review with employees on a regular basis.
If you have employees that use laptops, consider implementing software that will determine if mobile devices have been infected before allowing them back into your network.
Employ advanced authentication techniques for user logins such as two-factor authentication (User ID and PIN – something the user knows, and Token codes – something the user has.)
Develop a working relationship with a member of law enforcement so that there is an established venue for reporting incidents.
Email Security Guidelines
If you receive an email that appears to be suspicious, do not reply to it or click on the link that it provides. Simply delete it.
If you think you may have provided personal or account information in response to a fraudulent email or website, report the fraud immediately, change your PINs, and monitor your account activity frequently.
Avoid clicking on links provided in emails. It is always better to type the address into your browser.
Open email attachments only if you know the sender. It is best to scan attachments with your anti-virus software prior to opening.
Most computer files have filename extensions such as “.doc” for documents or “.jpg” for images. Any file that appears to have a double extension, like “heythere.doc.pif” is extremely likely to be a dangerous file and should never be opened.
Never open email attachments that have file endings of “.exe”, “.pif”, or “.vbs”. These are file extensions for executables, and are commonly dangerous files.
Be careful and selective before providing your email address to a questionable website. Sharing your email address makes you more likely to receive fraudulent emails.
Confirm the validity of all requests for sensitive personal, financial, or account information, particularly if they are made with an urgent or threatening tone.
Confirm requests for personal or account information by going to the company’s website directly. Open a new browser window, type the Web address, and check to see if you must actually perform any activity that an email may be asking you to do, such as change a PIN.
Lost or Stolen Debit Card
During Banking Hours (Monday – Thursday, 9am – 4pm; Friday, 9am – 5pm)
Call (601) 684-2231
Instantly Report Lost or Stolen from On the Go mobile app
If reporting by phone, please be ready to provide First Bank’s ABA Routing Number (065303386) and the last 4 digits of your Debit Card*, plus any other identifying information.
First Bank will charge a $5 replacement fee for lost or abused cards.
Protect Your Debit Card & PIN
Sign your card immediately upon receiving it and perform an account inquiry at an ATM to activate the new card.
Do not lend your card to anyone unless you are comfortable with them having access to your cash.
Save your receipts to compare against your statements.
Notify the bank immediately if you notice any unauthorized or suspicious transactions.
Contact us immediately if your card is lost or stolen or becomes compromised in any way. Please refer to the Lost or Debit Card section of our website for instructions on how to report this.
Protect your PIN:
Memorize your PIN.
Do not write it on your card.
Do not give your PIN number to anyone over the phone or internet.
When making a purchase never let a store clerk enter your PIN number for you.
Remember no one needs to know your PIN number but you.
Block others view of your transaction:
Cover screen and/or keypad when entering PIN number.
If you feel you may be watched leave the ATM and go to a safe location.
Never let anyone assist you in entering your PIN number or give anyone your PIN number, not even a store clerk. You should guard your PIN number as you would cash.
If in line at the ATM, leave your car running, windows up and doors locked.
Have your card ready before reaching the ATM, don’t wait until you get there to start digging for your card.
Remember the more time you spend at an ATM, especially after hours, the easier target you are for a thief.
After a transaction, don’t visibly display your cash.
Immediately store away your card, cash, and receipt, wait until you are safely away to sort everything out.
Notice your surroundings prior to and during transactions.
If you notice anything unusual or anything or anyone that makes you uncomfortable leave the ATM and try another location if needed.
Check the ATM:
Pay attention to the actual ATM machine, if it looks to be altered or has any unusual devices attached to the card slot or keypad, do not use it and notify the bank of your findings.