March 2020-

3/31/20– With all the news about stimulus checks, fraudsters are creating websites and ads to fool consumers into providing private information in exchange for additional stimulus payments or grants.

• Government agencies do not communicate through social media outlets, such as Facebook.
• A government agency will never request an advanced processing fee to receive a grant.
• Beware of fake government agencies promoted by fraudsters.  The only official list of all U.S. federal grant-making agencies can be found on the grants.gov website.
• Practice safe-surfing when you’re online. Know where you are and how you got there. There are growing numbers of fake websites made to look legitimate, but in fact fool us into providing our usernames, passwords and other private information.

3/20/20– During this time Fraudsters are taking advantage of the COVID-19 scare. Stay vigilant to protect your family and information. Below are a few tips and tricks to stay safe.

• Get your information from known links and sources. Fraudsters are creating malicious websites and targeting consumers. Use the official sites listed below, for health-related questions. (this would reference the official health-related sites already listed)
• Be aware of an increase in email, text and telephone scams about COVID-19.
• Avoid selecting links and attachments in your email or giving information to telephone solicitors.
• Navigate directly to the known website. Use a known telephone number or one from the Yellowpages.
• If you’ve fallen victim to a scam, immediately call your financial institution.

Learn more about Coronavirus (COVID-19) scams to watch out for.

Have questions or concerns? Contact our Service Center at 231.946.7090.

November 2019- How Important is Your Telephone Number?

Imagine that your mobile phone stops working.  No more web access, no text messages and no phone calls.  What happened?  You may be the victim of an increasingly common SIM Card Swap, in which a bad actor hijacks your cell phone number.

How does it happen?  Bad actors are practiced in what they do.  Learning your telephone number, they contact and convince your cell phone service provider to activate or transfer your SIM card, your telephone number, to a new device, often claiming that the old device was lost.

Armed with your phone number on their device, a bad actor could: • Open a new cellular account in your name or buy a new phone with the information. • Reset your online banking and account passwords by intercepting One-Time-Password/PIN (OTP) that are texted to you. • Intercept ‘call-back verification’ calls that financial institution’s use to verify your identity and intent.

How can you protect yourself? • Avoid sharing your telephone number, or any contact or personal information, with any business until you know what it will be used for, if it will be disclosed, and how it will be protected. If the information is not required, don’t share it. • Don’t reply to calls, emails or text messages that request personal or contact information. • Contact your cellular service and add a codeword or PIN to your account and require it for any changes. Also ask to be alerted when any change happens.

If it happens–Alert your cellular service provider. • After you re-gain access to your phone number, change the account passwords. Also take time to review your online accounts for any activity, including changes to the email address and telephone numbers.

– The TBA Credit Union Privacy & Security Team

August 2019- Gift Card scams are on the rise. TBACU members are a big help in educating other members and the public of fraud and scams.  With several reports lately, it seems that gift card scams may be on the rise.

This type of scam starts when you’re promised a product, service or even payments on debt and asked to pay by purchasing gift cards with your own money.  Next, the perpetrator requests the gift card numbers/IDs from the back of the cards.  Then, the perpetrator uses or cashes-out the card, but never provides product or service.  While there are variations of this scam that pull at your heartstrings, ask for donation to help in a disaster, promises romance, or to help pay for medical bills, often it includes providing gift cards numbers/IDs.

Generally speaking, no reputable person, business or government agency, including the IRS, will ask you to purchase and share a gift card.

If you answer ‘no’ to these questions, someone may be trying to take advantage you:

• Did you initiate contact with them?
• Have you worked with the person or business before? Do you know them, are they reputable?
• Upon researching, does the business normally ask for payment via gift card?
• Have you received the product or service, as promised? Are you satisfied with it?

Avoid being a victim:

• Use a credit or debit card to pay . There are built-in fraud controls and consumer laws to help protect you against unauthorized purchases.
• Add your telephone numbers to the Do-Not-Call Registry.  Reputable organizations will respect your choice to not be solicited.
• Transact directly with businesses and agencies using their official website, telephone number or brick-and-mortar location.
• Don’t be fooled into doing something you or someone else normally wouldn’t do. Ask questions.
• If you’re suspicious, ask a friend or family member for help.
• If you’re ‘coached’ on what to say, or told not to tell anyone, you’re being taken advantage of.

December 2018–A breach at Marriot International / Starwood exposed the personal information of 500 million people and started in 2014.

October 2018–A Google + bug allowed developers to access personal data from 500,000 users who had installed their app.

September 2018–Facebook continues to be in the news.  Bugs in one of there services exposed account contents and activity of 50 million Facebook, Instagram, and WhatsApp users.

October is Cybersecurity Month!

See Yourself in Cyber

Getting excited for the upcoming holidays? Well, so are the cybercriminals. So how can you beat them at their game and keep your information private, your money in your pocket, and the holidays festive?

1. Limit Sharing. Limit the information you share on a web and social media site, with any merchant, and in email. Cybercriminals scour the internet for any piece of information about you, and like a puzzle, put the pieces together to target you. And that ‘free’ email account you’re using? It’s also collecting information about you.
2. Enable Multi-factor authentication (MFA). Enable MFA for all important online accounts. This can be an email or text message with a one-time password (OTP), PIN, or code. Enable MFA on every account that you can.
3. Use Strong Passwords. As one of the first lines of defense for keeping your information safe, here are a few tips:
   1. Use a different password for each account.
   2. It doesn’t have to be complicated, like Di&81&329a$, it just has to be strong, memorable, and easy to type. Choose four unrelated words, then add a number and a special character.
   3. Reset your passwords every few months. By the time a data breach is reported, a threat actor could already be using and/or selling your data.
   4. Use a password manager. With just one master password, a password manager can generate and retrieve passwords for every account that you have, making it super easy to make them strong.
4. Think before you click. Recognize and report email phishing and other social engineering attacks. Email, text, in person, or over the phone, if the message is urgent or threatening, pulls at your heartstrings, or is an unsolicited offer to help, it’s likely a scam. Don’t interact with it, just send it to your junk folder.
5. Update. Update software on every device. Set your phone, door camera, television, desktop computer, laptop, router, etc. to automatically update. Cybercriminals also scour the internet and exploit outdated devices.

•  

Data Privacy Day January 28

With so many businesses and websites asking for your information, the resulting data breaches, and the impacts of identity theft on people like you, here are a few basic reminders to protect your private or sensitive information:

• Your personal info is like money. Value it and protect it. Avoid sharing it unless you absolutely have to. You might have to say ‘no’ to sharing once in a while.
• Use long and strong passwords. Sure, it can be a hassle, but combining four random words and a few numbers is much easier to remember and type, and is just as secure.
• Keep tabs on your Apps, as many want access to your contacts, photos, camera and microphone. Not sure how to turn that off, visit a phone carrier or retailer that specializing in your device.
• Check privacy settings on each website and business you share information with. Ask how are they going to protect it? Will they share it? Sure, there’s a lot of fine print, but it’s worth knowing

Visit StaySafeOnline.org for tips to manage your privacy, and your child’s.

Quick Cybersecurity Wins for Any Size of Business

1. Keep all software updated–firewall, anti-malware/virus, burglar alarm system, browsers…
2. Enforce strong passwords or passphrases.
3. Limit or prohibit personal use on business computers. Personal email is the riskiest.
4. Regularly back up your data.
5. Train employees.  Find cybersecurity training materials at StaySafeOnline
6. Have a plan in case there is a breach.

Lean more about Cybersecurity for Business at StaySafeOnline.

Top Frauds and Scams to Keep in Mind

With the changes this pandemic has caused, bad actors and fraudsters are hard at work. So what are the top frauds and scams you should be aware of?

• Email Phishing: Common ways to determine an email is malicious include messages that:
  • tug at your heartstrings–ask for a charitable gift for the latest natural disaster,
  • claim to have health information, and often with link to a malicious website, or
  • threaten you with sense of urgency–your account will be closed if you don’t act now!

Check out this document to learn more about social engineering.

• Cyber Attacks on Small Businesses: Suring up your network and training employees on the common scams and tactics can go a long way to help protect your credit card, employee and customer information.
  • Require passwords for all laptops, desktops, tablets, smartphones…
  • Use multi-factor authentication to access sensitive information or network areas.
  • Update your software. This includes apps, web browsers and operating systems. Set updates to happen automatically.
  • Have a data breach response plan. If an incident happens, you want to keep your business running and minimize the damage.

The Federal Trade Commission has additional resourcess to assist in training.

• Gift Card Scams: Still a common sign of fraud is when a bad actor instructs you to buy any type of gift card.
  • If you’re asked to email or text a picture of the ID # or code on the back of the card.
  • Often there is a promise to pay you for your trouble.
  • Bad actors often try to befriend you or make romantic promises, hoping use you again.
  • Sometimes starts with a ‘work from home’ program. 

Learn more about Gift Card Scams

Tax Refund Identity Theft?

Simply put, tax-related identity theft is when someone uses a stolen Social Security number to file a tax return, and it could be your number. Even if you don’t owe any taxes, bad actors use stolen numbers along with fictitious income information to trick the IRS into sending a refund.

Steps to Prevent It

• • • • • Limit the personal information you share, especially online.
        • File your taxes as soon as you can.
        • Do some research before choosing a tax preparer. Ask your friends family for a recommendation.
        • Watch out for tax scams. The IRS will never call to threaten you or demand immediate payment.
        • Watch out for phishing emails. Is the message threatening, urgent or pulling at your heartstrings?

How Would You Know It?

If you get a letter or a notice from the IRS, or you’re not able to e-file because of a duplicate Social Security number, you’ll need take these steps.

• • • • • Respond immediately to any IRS notice.
        • If your e-filed return is rejected because of a duplicate filing under your Social Security number, or if the IRS instructs you to do so, complete IRS Form 14039, Identity Theft Affidavit (PDF). Mail it, along with your paper return.
        • Check with your state tax agency to see if there are additional steps to take at the state level.
        • Contact each of your financial institutions to report that you’ve been a victim of identity theft. Inquire if any new accounts have been opened without your knowledge.
        • Review your credit profile at annualcreditreport.com.
        • Report the fraud to any credit bureau and request a freeze of your profile with each one.
          • Experian 888-397-3742
          • TransUnion 888-909-8872
          • Innovis 800-540-2505
          • Equifax 800-685-1111
        • Visit IdentityTheft.gov
        • Share this information with your friends and family.

Phishing. Don’t Get Hooked.

Phishing, or using email to trick you into sharing passwords or private information, is still a big problem and has led to a number of multi-million dollar security incidents over the recent years.

Here are a few easy tips to help recognize phishing and protect your information and accounts.

• • • • • Create two email accounts. Limit one for creditors, financial institutions, insurance companies and any official business. Don’t share this address with anyone else. Create a second email account that you can readily share with friends, family, newsletters. Fake email will stand out.
        • Manage Your Inbox and Accounts. Download important messages to your local computer. Delete unwanted messages and any that have personal or private information. I’d even delete the Sent and Deleted folder contents. Why? If bad actors get into your account this will limit what they can get.
        • Mark spam messages as spam. This will help ‘train’ the filter.
        • Think Before You Open a Message.
          • Is the sender’s name AND email address unrecognized?
          • Is it a catalog or newsletter you didn’t ask for?
          • Is the message threatening, urgent or pulling your heartstrings? Your account will be locked or your credit card will be closed if you don’t respond right this moment. What about fake ‘charities?’ Each natural disaster prompts bad actors to ask for money too.
          • Is the email or website address misspelled? When hovering your mouse over the link, is the address different?
          • Is it out of the norm for the sender to send that kind of message or attachment, or at that time of the day?

If you answered Yes, you should avoid opening the message, or clicking on the attachment or link. It would be best to call or contact the sender directly, but NOT using the phone number in the email.

Own IT, Secure IT, Protect IT

National Cybersecurity Awareness Month is a great opportunity to take stock of your personal data and devices and take basic steps to protect them.

Own Your Digital Profile

Internet-based devices are present in every aspect of our lives, and that constant connection presents opportunities for cybercriminals. We don’t have to avoid using technology, but let’s balance convenience and security.

• • • • • Know What to Protect–Personally-Identifiable Information is any information that can be used to distinguish or link to you.       Your name, alias, email address or social security number may seem obvious, but even your picture, internet surfing and purchasing habits, employment, medical, and beliefs are linkable to you. These are the puzzle pieces of information you want to protect.
        • It’s Your Property, Don’t Give it Away– Before you register in that next contest, complete a survey for a retailer or post to your social media account, know what your information will be used for. Will it be given away or sold? Can it be linked back to you? Read the fine print first. Also make sure you are cross-shredding and destroying all documents before you recycle or throw them away.

Secure Your Digital Profile

Cybercriminals are good at getting personal information from us, and the methods are getting more sophisticated. Protect against cyber threats by learning about security features available on the equipment and software you use.

• • • • • Devices–Any device in your home that is connected to a network or the internet, e.g. mobile phone, TV, computer, burglar system, thermostat, etc. needs to be secured.
        • Keep devices and software up-to-date. Call a local computer service company for help.
        • Use strong passwords passphrases. Yes, passwords have been replaced. Using four, unrelated words, numbers and special symbol is much easier to remember and just as secure. Enable multi-factor Authentication (MFA) wherever it’s available.
        • Install anti-virus software.
        • Zero Trust–Criminals will try anything to get at your money and data. Using the latest disaster to pull at your heartstrings, scare or threat tactics, or even pretending to be helpful. Don’t be duped into sharing your personal information or hard-earned money. Hang up the telephone. Never allow anyone to have remote access into your computer.

Protect IT

To protect yourself from becoming a cybercrime victim you must understand, secure and maintain your digital profile. Visit the DHS Be Cybersmart Campaign for more resources.

• • • • • Take inventory and steps to limit the personal data you have in your phone, laptop, wallet, purse and automobile, and assume it will be lost or stolen someday.
        • Practice safe surfing and avoid opening email links and attachments from people you don’t know, a message you weren’t expecting or that seems uncommon for the sender.
        • Pay attention to the websites and people your children and grandchildren communicate with. They don’t always understand the threats or how to be safe.
        • Freeze your credit profile with each of the credit bureaus.
          • Freeze your Experian credit profile
          • Freeze your Transunion.com credit profile
          • Freeze your Innovis credit profile
          • Freeze  your Equifax credit profile
        • Share what you’ve learned with your family and friends.