|
Don't Open Bogus Email that Claims to Come From the FTC
Email That States It’s From the FTC’s “Fraud Department” Has Virus Attached
October 2007 - A bogus email is circulating that says it is from the Federal Trade Commission, referencing a “complaint” filed with the FTC against the email’s recipient. The email includes links and an attachment that download a virus. As with any suspicious email, the FTC warns recipients not to click on links within the email and not to open any attachments.
The spoof email includes a phony sender’s address, making it appear the email is from “frauddep@ftc.gov” and also spoofs the return-path and reply-to fields to hide the email’s true origin. While the email includes the FTC seal, it has grammatical errors, misspellings, and incorrect syntax. Recipients should forward the email to spam@uce.gov and then delete it. Emails sent to that address are kept in the FTC’s spam database to assist with investigations.
Simply opening the email does not appear to cause harm. However, it is likely that anyone who has opened the email’s attachment or clicked on the links has downloaded the virus on their computer, and should run an anti-virus program. The virus appears to install a “key logger” that could potentially grab passwords and account numbers. More information about bogus emails, phishing, and virus protection is available at www.OnGuardOnline.gov.
The FTC works for the consumer to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. The FTC enters Internet, telemarketing, identity theft, and other fraud-related complaints into Consumer Sentinel, a secure, online database available to more than 1,600 civil and criminal law enforcement agencies in the U.S. and abroad. For free information on a variety of consumer topics, click http://ftc.gov/bcp/consumer.shtm.
(back to top)
Use Caution with Email Attachments
While email attachments are a popular and convenient way to send documents, they are also a common source of viruses. Use caution when opening attachments, even if they appear to have been sent by someone
you know.
More information on this and other computer safety topics can be found on the United States Computer Emergency Readiness Team website. You can access this article and others at http://www.us-cert.gov/cas/tips/ST04-010.html.
(back to top)
How to Recognize a Secure Site
Before entering personal information on a website, look for the "lock" icon in your browser. A closed lock or padlock indicates that the website you are on is secure.
| Microsoft Windows |
Secure |
Not Secure |
| Microsoft Internet Explorer |
|
|
| Netscape Navigator |
|
|
| Firefox |
|
|
| Apple MacOS: |
Secure |
Not Secure |
| Apple Safari |
|
|
| Firefox |
|
|
(back to top)
What You Can Do To Prevent Identity Theft
How can your identity be stolen? When an identity thief appropriates vital information like your name, birth date, Social Security number, or credit card number without your knowledge. Financial institutions employ a variety of technologies and practices to guard against identity theft; however, consumers should be aware of the many steps they can take to safeguard their personal information.
- Social Security Cards and Numbers
- Credit Cards
- Internet
- Mail
- Miscellaneous
Social Security Cards and Numbers
- Do not carry your Social Security card.
- Remove your Social Security number from your driver’s license and bank checks.
- Provide your Social Security number only when necessary—for example, on tax forms and employment records, or for banking, stock and property transactions.
- Do not give out your Social Security number without questioning how it will be used. (Be aware that if you refuse to give your Social Security number to a business, that business can refuse service if it feels the information is necessary.)
- Use a unique number as an account identifier instead of a Social Security number. When creating passwords and PINs, do not use a number that could be easily discovered by a thief, like part of your Social Security number, birth date, middle name, spouse’s name, child’s name, pet’s name, mother’s maiden name, address, or consecutive numbers.
- Check your Social Security earnings and benefits statement each year to ensure someone else is not using your Social Security number. (This statement may be ordered from the Social Security Administration.)
Credit Cards
- Do not carry more than two credit cards. When carrying cards, take precautions to prevent their loss.
- Always take credit card, debit card, and ATM receipts. Tear them up or shred them when no longer needed.
- Tear up or shred unused pre-approved credit card solicitations and convenience checks.
- Never provide credit card numbers over the telephone unless you placed the call and have a trusted relationship with the other party.
- Cancel unused credit cards.
- Create a list of credit cards and bank accounts. For each, include the account number, expiration date, credit limit, and telephone numbers for customer service and fraud departments. Keep this list in a safe place (not in a wallet or purse) so each creditor can be contacted quickly if cards are lost or stolen.
Internet
- When making online purchases, be sure you know the entity or person to whom you are giving your personal information. To confirm the legitimacy of a site, click on the solid lock or key symbol on your browser window. The symbol provides information about the merchant from the server certificate. A cloned site will not have a certificate. If a certificate name does not match the site, do not use it.
- Only do business with Internet companies that use secure technology to capture private information like account or credit card numbers, or place orders by telephone or mail. The key symbol on your browser status bar indicates whether or not a page is secure.
- Check merchant privacy policies and only shop with those whose published privacy policies are acceptable to you.
- Ensure your computer(s) are equipped with antivirus protection and firewalls to help keep trespassers out. Always maintain backup of your original data.
Mail
- Do not leave bill payments in your mailbox. Install a lock on your mailbox if mail theft has occurred in your area.
- Immediately review credit card and utility statements, including cell phone bills, for unauthorized use. If you suspect your account has been used fraudulently, contact the provider’s customer service and fraud departments.
- Monitor your bank accounts and monthly statements thoroughly, ensuring that all the activity is accurate. If your account statements are late, immediately contact your bank to find out when they were mailed.
- If credit card statements or new or renewed credit cards are not received in a timely manner:
- Call the creditor to see if a change-of-address request has been filed, or if additional or replacement cards have been requested. If either has happened, instruct the creditor not to honor the request.
- Contact the post office to see if a change-of-address request has been filed. If so, immediately notify your local postal inspector.
Miscellaneous
- No matter how good a reason a person might have for needing your information, do not give it away. (Often identities are stolen by skilled “social engineers” who have their stories down, know to what most people will respond, and understand that people are often willing to provide information to others if they perceive that it is needed or that they will benefit.)
- Keep your birth certificate and passport in a safe place.
- Always protect your account information. Memorize passwords and PINs—never keep them in a wallet, purse, or Rolodex. Never write a Social Security or credit card number on a check.
- Shield the keypad when entering a PIN at an ATM, store, or telephone.
- Consider having your name removed from marketing lists by the following methods:
- Individuals who would like to have their name and address removed from mailing lists obtained from the main consumer credit reporting agencies should call 888-5OPTOUT (888-567-8688).
- Request that credit card issuers not disclose to marketers any information based on the purchases you make.
- The Direct Marketing Association (DMA) maintains lists of people who do not want to receive mail and telephone solicitations from national marketers. Request that your name be added to the DMA’s Mail Preference Service and Telephone Preference Service name-removal lists. For more information go to http://www.dmaconsumers.org/offmailinglist.html
- Order a credit report each year from each of the three major credit reporting agencies. Check the reports for accuracy and indications of fraud, such as new accounts, unauthorized credit applications or inquiries, and any unrecognized charges, defaults or delinquencies. Also check the accuracy of your name, address, Social Security number, and other identifying information.
(back to top)
Be Aware of Tax Refund Scams
As tax time nears you may receive an email, allegedly from the IRS, which states you are eligible for a tax refund if you'll just click on the embedded link and fill out a form. But don't. This is a perennial phishing scheme with many variations.
Tricking consumers into disclosing their personal and financial information, such as secret access data or credit card or bank account numbers, is identity theft. Such schemes perpetrated through the Internet are called "phishing" for information.
The information fraudulently obtained is then used to steal the taxpayer's identity and financial assets.
Mark W. Everson, IRS Commissioner: "The IRS does not send out unsolicited e-mails asking for personal information. Don't be taken in by these criminals." The IRS has seen a recent increase in these scams, many of which originate outside the United States.
The current scams claim to come from the IRS, tell recipients that they are due a federal tax refund, and direct them to a Web site that appears to be a genuine IRS site. The bogus sites contain forms or interactive Web pages similar to IRS forms or Web pages but which have been modified to request detailed personal and financial information from the e-mail recipients. In addition, e-mail addresses ending with ".edu" — involving users in the education community — currently seem to be heavily targeted.
The Internal Revenue Service announced it has established an electronic mailbox for taxpayers to send information about suspicious e-mails they receive which claim to come from the IRS. Taxpayers should send the information to: phishing@irs.gov.
The IRS's new mail box allows taxpayers to send copies of possibly fraudulent e-mails involving misuse of the IRS name and logo to the IRS for investigation. Instructions on how to properly submit one of these communications to the IRS may be found on this Web site. Enter the term phishing in the search box in the upper right hand corner. Then open the article titled "How to Protect Yourself from Suspicious E-Mails" and scroll through it until you find the instructions.
The IRS does not send out unsolicited e-mails or ask for detailed personal information. Additionally, the IRS never asks people for the PIN numbers, passwords or similar secret access information for their credit card, bank or other financial accounts.
(back to top)
Spyware
Causes, Effects and Prevention
Two-thirds of Internet technology professionals believe spyware will be the top threat to network security this year, according to a January 2005 poll by WatchGuard Technologies, Inc. Spyware is usually defined as: “A technology that assists in gathering information about a person or organization without their knowledge.” In Internet terms, it’s defined as "…programming that is put in someone's computer to secretly gather information about the user and relay it to advertisers or other interested parties," and is therefore cause for public concern about privacy on the Internet.
Spyware can be installed along with another program that you consider useful. One example of this type of demographic software is a company called Fun Web Products. They will give you several entertainment and utility programs if you consent to allow them access to your demographic information.
Less benign spyware is most often installed either by a malicious prankster or a criminal. Certain types of spyware exist solely to gather personal information, such as online banking user IDs and PINs, to enable the perpetrator to commit identity theft. This software gets installed by the user’s own action or, in some instances inaction. In some cases a user clicks a link in an email and either runs an executable attachment or links to a website program that downloads and executes a program. In some cases just visiting a malicious website and viewing a page is enough to silently download and execute a spyware program.
Software ‘trading’ with friends can also mean an Internet spyware program could be hidden in the traded software. This also applies to music files, MP3s and so forth. Even graphics are not immune. There is an exploit that allows certain picture files to become infected with spyware and be able to propagate on a vulnerable PC.
How do I prevent spyware from getting into my PC?
There are a few things that businesses and individuals can do to help prevent spyware from infesting your PC. The total solution will depend upon the perceived amount of protection needed by the individual person or business. Not all of the suggestions offered below may be appropriate in all cases.
- Firewalls. A good firewall that controls both inbound and outbound traffic can help prevent damage by limiting access from your PC. A firewall solution can be either a hardware or a software solution. Hardware firewalls can range from a simple personal firewall costing less than $100 and usable on home networks, to professional ones to protect large networks. Likewise, software firewalls are available for both the individual and the enterprise solution.
- Anti-Virus software. A good anti-virus package is absolutely essential to help detect and remove malware. Get an anti-virus that is self-updating to obtain the latest malware definitions, and maintain it without fail.
- Anti-Spyware software. Just as anti-virus will help catch various malware attempting to infect your PC, an anti-spyware package will help to catch spyware specifically. While there is some overlap in their duties and abilities, each type of software will catch threats that the other is not designed to detect. It is vital that the anti-spyware software is either auto-updated, or manually updated regularly and frequently.
- Many spywares and malwares gain entrance to your PC because of security vulnerabilities in often-used programs, such as your web browser, or even the
operating system itself. Because of this it is vital to regularly follow your software and operating system vendors’ recommendations and apply security patches as soon as they become available. Unpatched, vulnerable PCs are easily and quickly exploited by spammers, identity thieves and other criminals.
- Avoid installing ‘untrusted’ or ‘unknown’ software. Trading software, MP3s or the like is an invitation to disaster. Many pirated software packages are infested with spyware and malware.
- Do not respond to links in email. Clicking links embedded in email can take you to a malicious website and put you at risk. Even if the email seems to be from a trusted site, such as your bank, do not click that link. More and more, financial institutions are making the policy to not include links in their email to help keep their customers safe. When you want to go to your bank’s website, open the browser yourself, and type in their URL on the location bar yourself as well.
- Use a spamblocker of some type on your browser. These are small software applications that integrate with your browser and notify you if the site you’re about to visit may be malicious or suspect. Many anti-spyware packages come with a real-time component that performs this function as well. Check with the vendor to determine the capabilities of your software.
How do I remove spyware once it’s on my PC?
The first line of removal for any malware or spyware is, of course, your anti-virus and anti-spyware software. If you suspect spyware and you do not have anti-virus and antispyware installed, installing them will remove most of the pests. Follow the vendors’ recommendations for the install of their product and, after installation run a complete system scan to ensure that your PC is clean.
Remember, having an anti-virus and antispyware installed at the same time provides more protection than either installed alone. This may change in the future as the traditional anti-virus software vendors upgrade their package capabilities, but today running both is beneficial.
If you already are running both anti-virus and anti-spyware software and still suspect a spyware infection, contact your anti-virus software vendor. Most have a customer support line staffed with individuals that can aid you in case you are unlucky enough to become infected with malware that they do not currently detect. Most vendors are quite anxious to find new malware and develop protection updates for them.
How do I learn more?
Each individual or business must take the initiative to perform due diligence and deal with reputable companies in selecting an anti-virus and anti-spyware solution that meets their individual needs. The following list of URLs can be used as a starting point for your independent review and consideration. We also suggest you use the Internet search engine of your choice to obtain more information on this subject.
http://www.spywareinfo.com/
http://enterprisesecurity.symantec.com/content.cfm?ArticleID=5392
http://www.microsoft.com/athome/security/spyware/default.mspx
http://www.spywareguide.com/
http://www.safer-networking.org/en/
http://www3.ca.com/securityadvisor/pest/
Disclaimer: “The above list is not intended to be complete or construed to be an endorsement by the Bank of Elmwood of any particular product or service. It is provided merely as informational material to help the reader to make a more informed decision concerning spyware.”
(back to top)
Recommended Actions if You've Become a Victim of an Online Scam
If You Have Given Out Your Credit, Debit, or ATM Card Information
- Report the incident to the card issuer as quickly as possible
- Report using toll-free numbers and 24-hour service that many companies have established to deal with such emergencies.
- Request your card issuer close your compromised account number and reissue you a new card with a different number.
- Monitor your account activity and review account statements carefully after the information loss.
- If any unauthorized charges appear, call the card issuer immediately and follow up with a hard copy letter via a traditional delivery service such as the U.S. Postal Service (keep a copy for yourself) describing each questionable charge.
Credit Card Loss or Fraudulent Charges
Your maximum liability under federal law for unauthorized use of your credit card is generally $50. However, the $50 potential liability probably does not apply for unauthorized telephone and Internet transactions because there is “no means to identify the cardholder” in those cases.
ATM or Debit Card Loss or Fraudulent Transfers
- Your liability under federal law for unauthorized use of your ATM or debit card depends on how quickly you report the loss.
- You risk unlimited loss if you fail to report an unauthorized transfer within 60 days after your bank statement containing unauthorized use is mailed to you for transactions made after the 60-day period.
If You Have Given Out Your Bank Account Information
- Report the theft of this information to the bank as quickly as possible.
- Request your bank close the compromised account and re-open a like account with a different number.
If You Have Downloaded a Virus or ‘Trojan Horse’
Some phishing attacks use viruses and/or “Trojan Horses” to install programs called “key loggers” on your computer. These programs capture and send out any information that you type to the phisher, including credit card numbers, user names and password, social Security number, etc. If this happens, it is likely you may not be aware of it until you notice unusual transactions on your account.
To minimize this risk you should:
- Install and/or update anti-virus and personal firewall software.
- Update all virus definitions and run a full scan.
- If your system appears to have been compromised, repair it and then change you password again, since you may well have transmitted the new one to the hacker.
- Check your other accounts! The fraudsters may have helped themselves to many different accounts: eBay account, PayPal, your email ISP, online bank accounts, online trading accounts and other e-commerce accounts, and everything else for which you use online passwords.
If You Have Given Out Your Personal Identification Information
If you believe you have given out personal information such as your name, address, and Social Security number to someone who may use it for fraud:
Report the theft of this information to the bank as quickly as possible.
Contact the three major credit reporting agencies – Experian, Equifax and TransUnion – and do the following:
- Request that the agencies place a fraud alert and a victim’s statement on your file.
- Request a free copy of your credit report to check whether any accounts were opened without your consent.
- Request that the agencies remove inquiries and/or fraudulent accounts stemming from the theft.
Major Credit Bureaus
Equifax – www.equifax.com
- To order your report, call: 800-685-1111 or write P.O. Box 740241, Atlanta, GA 30374-0241.
- To report fraud, call: 800-525-6285 and write: P.O. Box 740241, Atlanta GA 30374-0241
- Hearing impaired call 1-800-255-0056 and ask the operator to call the Auto Disclosure Line at 1-800-685-1111 to request a copy of your report.
Experian – www.experian.com
- To order your report, call: 888-EXPERIAN (397-3742) or write: P.O. Box 2002, Allen, TX 75013.
- To report fraud, call: 888- EXPERIAN (397-3742) and write: P.O. Box 9530, Allen TX 75013. TDD: 1-800-972-0322.
Trans Union – www.transunion.com
- To order your report, call 800-888-4213 or write: P.O. Box 1000, Chester PA 19022.
- To report fraud, call: 800-680-7289 and write: Fraud Victim Assistance Division, P.O. Box 6790, Fullerton, CA 92634. TDD: 1-877-553-7803.
Additional Actions to Take
- If bank accounts were set up without your consent, close them.
- Contact your local police department to file a criminal report.
- Contact the Social Security Administration’s Fraud Hotline to report the unauthorized use of your personal identification information.
- Notify the Department of Motor Vehicles of your identity theft.
- Check to see whether an unauthorized driver’s license has been issued in your name.
- Notify the passport office to be on the lookout for anyone ordering a passport in your name.
- File a complaint with the Federal Trade Commission. Ask for a free copy of “ID theft: When Bad Things Happen in Your Good Name,” a guide that will help you guard against and recover from your theft – and guard against it in the future.
- File a complaint with the Internet Crime Complaint Center (IC3) by visiting their Web site: www.ic3.gov. IC3 is a partnership between the Federal Bureau of Investigation (FBI) and the National White Collar Crime Center (NW3C), with a mission to address fraud committed over the Internet. For victims of Internet fraud, the Center provides a convenient and easy-to-use reporting mechanism that alerts authorities of a suspected criminal or civil violation.
- Document the names and phone numbers of everyone you speak to regarding the incident. Follow up your phone calls with letters. Keep copies of all correspondence.
(back to top)
Phishing
Don't Fall Victim to Online Scams
Please be aware that Bank of Elmwood does not, nor will we ever, request any personal information (such as account numbers, passwords, PINS, Social Security Numbers, etc.) through an unsecure e-mail.
If you receive an e-mail which appears to be sent by Bank of Elmwood, and it requests your personal information, do not reply to it. Please contact your personal banking representative or our customer support center at 262-554-5321 if you have questions about this e-mail.
These types of e-mails, called "phishing schemes" attempt to trick customers into sending personal information to fraudsters.
What is phishing?
All Internet users should be aware of the online scam known as "phishing" (pronounced "fishing"). Phishing involves the use of e-mail messages that appear to come from your bank or another trusted business, but are actually from imposters.
Phishing e-mails typically ask you to click a link to visit a Web site, where you're asked to enter or confirm personal financial information such as your account numbers, passwords, Social Security number or other data. Although these Web sites may appear legitimate, they are not. Thieves can collect whatever data you enter and use it to access your personal accounts.
How can I spot a phishing scam?
Look for these warning signs:
- Language and tone. The message you receive may urge you to act quickly by suggesting that your account is threatened. It may say that if you fail to update, verify or confirm your personal or account information, access to your accounts will be suspended. The wording may also be sloppy and contain misspellings.
- Requests for personal information. Scam e-mails typically ask for personal or account information such as:
- Account numbers
- Credit and check card numbers
- Social Security numbers
- Online banking user IDs and passwords
- Mother's maiden name
- Date of birth
- Other confidential information
- E-mailed instructions to download software. All your online banking should be done through our secure Web site, and we will not send you e-mail instructions to download any banking software to your computer. Do not install software downloads directly from e-mail messages, or from companies or Web sites you do not recognize. When in doubt, contact the company directly or call our customer service number at 262-554-5321.
• Non-secure Web pages. Clever thieves can build a fake Web site that looks nearly identical to an authentic one. They can even alter the URL (the Web address) that appears in your browser window. Watch out for non-secure Web pages that ask for sensitive information (secure sites will typically display a lock in the status bar at the bottom of your browser window).
How can I decrease my risk of being a phishing victim?
Here are some safety tips:
- Be suspicious of demanding messages. Messages threatening to terminate or suspend your account without your quick response should be treated as suspicious. A legitimate bank or business should not request personal information from you over an unsecured Web site. When in doubt, call the business' customer service number (available on your account statement) to confirm the status of your account. Do not use telephone numbers found on the suspected Web site.
- Be cautious of downloads. Installing unknown software on your computer can put your personal information at risk and potentially harm your computer's hard drive. Make sure the software comes from a legitimate Web site, not an e-mail message. If you're not sure whether you should download a program, contact a customer service representative for more information.
- Be careful of emails that are not personalized and/or contain spelling errors and awkward syntax and phrasing. Many phishing emails are sent in great bulk and, therefore, are not personalized. Many are also being sent from other countries, from individuals for whom English is a foreign language, thus resulting in misspelled words and awkward syntax and phrasing.
- Always type in the URL of the Web page you need. Phishing scams rely on embedded links that take you to fake Web sites. It's safer to type your bank's Web address directly into your browser so you know you're visiting the legitimate site.
- Protect your password. Don't write down sensitive personal information such as your password or Social Security number. Change your password frequently.
- Review credit card and bank account statements as soon as you receive them to determine whether there are any unauthorized charges. If your statement is late by more than a couple of days, call your credit card company or bank to confirm your billing address and account balances.
- Keep your computer up to date. Bank of Elmwood recommends that you install anti-virus and firewall programs to help keep your computer safe. Always visit your internet browser provider's home page to download the latest security patches even if they don't alert you to do so. For example, if you use Microsoft's Internet Explorer, you will find security updates located on Microsoft's Web site. Make it a point to learn more.
Report an online scam
Report suspicious activity to the Federal Trade Commission. You may also want to forward it to the FTC at spam@uce.gov, or contact them at www.consumer.gov/idtheft* or 877.IDTHEFT (877.438.4338). You can also visit the FTC's Identity Theft Web site (www.ftc.gov/idtheft) to learn how to minimize your risk of damage from identity theft.
If you receive suspicious e-mail that appears to come from Bank of Elmwood, please notify us immediately by forwarding the e-mail to Help@bankofelmwood.com (do not open any attachments or click any links found in the suspicious e-mail).
If you believe you have provided personal or account information in response to a fraudulent e-mail or Web site, please contact Bank of Elmwood at 262-554-5321 and contact the other financial institutions with which you have accounts.
Learn more about phishing
To learn more about phishing, read the phishing brochure provided by The Office of the Comptroller of the Currency (OCC). The OCC charters, regulates and supervises all national banks.
(back to top)
New Computer Virus May Prompt Fraud Attempt For Some Online Bill Payment Users
A new computer virus has been identified that may cause a fraudulent message to display on your computer while you are in the process of paying your bills online. This message attempts to trick you into providing sensitive information such as account numbers and passwords in order to commit fraud.
The fraudulent message is generated from a source outside of our Online Banking system, but you may be impacted if you have unknowingly infected your computer with the new virus through activities such as illegally trading software, executing files sent via email, or allowing scripts to execute while browsing the Internet.
If your computer is infected with this virus and you are using online bill payment, the virus may intercept the browser session and display a fraudulent Web page requesting additional information. This fraudulent Web page appears framed within the bill payment window and prompts you for sensitive information such as debit card account numbers and passwords. This is an attempt to commit fraud, and you should not provide the requested information.
Our bill payment provider would never ask you for this information in the middle of a bill payment transaction. Any deviations from the documented and expected bill pay system behavior may be attempts to commit fraud.
Again, this particular fraud attempt would only occur if you have the virus on your local computer since the fraud attempt is taking place in a browser window that is outside of the Online Banking system.
Best Practices for Online Security
To help prevent fraud, you should follow these best practices for online security.
- Only install software from trusted sources and known origins. Software sent via email is particularly dangerous as viruses are often transmitted via email.
- Install and maintain Antivirus and Anti-Spyware software on your computer.
- Update browser software to benefit from the latest security protections.
- Pay attention to warning messages presented through your browser. Browser warning messages may indicate a security threat.
(back to top) |
