Fraud Prevention

Educate staff on best business practices:

• Be cautious when opening unsolicited emails or texts especially those containing links to websites.
• Don't reply to email or pop-up messages that ask for personal or financial information.
• Don't click on links or open attachments in any suspicious message.
• Don’t click on pop-ups asking you to install software or claiming that your computer has a virus.
• Be suspicious of any message that appears to be urgent or attempts to scare or intimidate you.
• Create strong, unique passwords or pass phrases and do not share them.
• Encourage the use of a password manager to securely save complex passwords for easy use.
• Never download anything from a source you don’t trust.
• If unsure about the safety of an email or link, check with the sender.

Every day, there are millions of attempts against companies to compromise data. Attacks like phishing and ransomware can be prevented with simple steps and employee education.

Implement IT related best practices:

• Ensure that all anti-virus and security software and mechanisms for all computers used for online banking are robust and up to date.
• Restrict functions for computer workstations that are used for online banking and consider limiting USB and administrative access on these machines.
• Where possible, use a firewall to enforce web content filtering or policies to restrict access to potentially malicious websites.
• Utilize strong passwords that contain a combination of letters, numbers and symbols.
• Choose different passwords for different programs as a safeguard.
• Never use public WIFI Access for sensitive information or banking transactions as encryption standards may not be current or the networks security maybe compromised.
• Perform regular backups of critical data to an external device and store them offsite if possible.
• Develop a Cyber Security Planning Guide

Emails, appearing to be from an executive (i.e. CEO/CFO) within the company, are being sent to company staff responsible for initiating wire transfers or ACH transactions requesting funds be sent to a specific bank and account number. Although the emails appear legitimate, they are not.

To safeguard against these types of fraudulent requests, encourage your employees to take a few extra steps to confirm validity.

For example,

• Examine the source of the email address – when they click “REPLY”, does the address match the sender?
• Call the sender to confirm that the request is valid.

• Monitor your accounts on a daily basis and look for red flags:
  • Are there any withdrawals that you are not expecting?
  • Are there any checks clearing out of the expected sequence?
  • Have there been any alterations to the check image?
• Add alerts to your accounts to help monitor activities and transactions.
• Consider Positive Pay for both checks and ach transactions to help prevent fraud.

• Always verify payment instructions received via email or text message by calling your company contact at the phone number you have on file - not the number in the email.
• Be extra cautious of requests that are urgent and require immediate processing.
• Fraudsters can easy make an email, text or message look like its coming from somebody at your company or a vendor. This is known as "spoofing". Do not trust any requests unless it is verbally verified.
• For ACH transactions, do not change any payment information, i.e. account number, without a signed authorization and always verbally verify with the recipient before doing so.

• KnowBe4 Security Awareness Training Blog
• Krebs on Security - Security News
• U.S. Small Business Administration Homepage
• Federal Trade Commission - Security Guide for Business
• U.S. Computer Emergency Readiness Team Homepage
• FCC Cyber Security Planning Guide
• Dark Reading - Security News
• Stop Ransomware Website