Online Banking Security
Additionally, you might find the website www.onguardonline.gov from the Federal Trade Commission, U.S. Department of Education, and the U.S. Department of State helpful in understanding Online Banking Security.
Foundation Bank Online Banking has implemented various layers of security features to help reduce the risks associated with Online Banking and to help protect your account information from unauthorized access.
These layers include:
- All Online Banking data transmitted to us is encrypted. Encryption is the process of transforming information into an indiscernible coded message. When you click on “login”, we encrypt your Online Banking User ID and PIN using Secure Sockets Layer (SSL) technology. This secure connection is established before your Online Banking User ID and PIN are transmitted and maintained for the duration of your Online Banking session.
- If you are using one of the following browsers; Microsoft IE 7.0 or higher, Firefox 3.0 or higher, or Safari 3.2 or higher, an EV (Extended Validation) SSL certificate will be active. The EV SSL certificate will be evident as the browser will display https://, turn green, show a closed padlock and rotate “Foundation Bank” and “Identified by VeriSign”.
- After your initial login, we require you to change your Online Banking PIN before any transactions can be requested.
- PIN guessing is deterred with a lock-out feature. Our system will automatically lock-out a user when an incorrect PIN is entered multiple consecutive times.
- The date of last access to the Online Banking system is displayed after login so you can verify that no one else has logged into your Online Banking account.
- Online Banking sessions have a time-out limit requiring you to login again after a period of inactivity to prevent unauthorized access to your session.
- Account numbers are not visible through Online Banking unless you choose to display the account number through the “Pseudo Name” function.
- Our Identity Verification Feature provides an additional layer of security by getting to know you and your typical and characteristic Online Banking behavior. If atypical behavior is detected you will be prompted to verify your identity by answering your established Challenge Questions.
- A personal Watermark feature appears during the login process for your assurance that you have accessed the authentic Foundation Bank Online Banking site.
- Secure ID Tokens are available for Online Banking with Cash Management accounts. Based upon time synchronization technology, this authentication device generates a simple, one-time code that changes every 35 seconds. The token is used in conjunction with your Online Banking User ID and PIN.
The following Information can help you keep your confidential information safe while using our Online Banking system. In addition to the safeguards that Foundation Bank has put into place, being an educated client is your best defense.
Refer to the attached Guide, Protecting Personal Information a Guide for Business, to assist with this process. You will learn about the 5 Key Principles of a sound data security plan.
- Take stock.
- Scale down.
- Lock it.
- Pitch it.
- Plan ahead.
As your trusted financial partner, Foundation Bank is committed to the safekeeping of your confidential financial information. As part of this commitment we want to make you aware of current online threats and to provide you with valuable information to help identify and guard against them. Nothing can eliminate all of the risks; however, an informed and vigilant user is a key defense.
Phishing is a scam where Internet fraudsters request personal information (such as User IDs, PINs, and identifying information), from users online. These requests are most commonly in the form of an email from an organization with which you may or may not do business. Fraudulent emails such as these may look official, sometimes including the company logo. The email usually states that the company needs you to update your personal information or that your account is about to become inactive, all in an effort to get you to click on a site or divulge confidential information. No reputable business will ever email you requesting that you update your personal information, including account numbers, system passwords or Social Security Numbers via a link to their site.
Unlike phishing, fraudsters using a technique called “pharming” don’t lure their victims with emails. Instead, they install malicious software or use other means to re-direct a user to a fraudulent website - even if the user types the correct address into their browser or uses an existing bookmark for their bank’s website. This means when you type a legitimate website address into a web address bar you are redirected without your knowledge to a bogus site that looks identical to the genuine site. Once you log in with your login name and password, the information is immediately captured by the fraudster.
SMiShing or Vishing
There is a variant of traditional phishing scams that uses telephone calls, instead of email, to collect confidential information. Customers may receive an automated phone call or an email saying their account has been compromised and gives them a phone number to call to resolve the issue. When they call, they reach an automated answering program that asks them for confidential information to verify their account. Customers should never give confidential information in response to suspicious requests such as these.
Adware, or advertising-supported software, is any software package which automatically plays, displays, or downloads advertisements to a computer after the software is installed on it or while the application is being used. It is usually integrated into or bundled with a legitimate program. It can be used to carry spyware or trojans.
Spyware is a type of malware that is typically secretly installed on computers and collects little bits of information at a time about users without their knowledge and can be difficult to detect. The software then relays this information to advertisers, marketing groups, and others for advertising or malicious purposes. Information that is commonly collected includes login IDs, PINs, account information and computer files.
Spyware is usually installed without your knowledge when you download legitimate software. Sometimes the fine print of the license agreement includes information about the spyware component, but not always. Spyware is known to change computer settings, resulting in slow connection speeds, different home pages, and/or loss of Internet or functionality of other programs.
Keylogging is a method by which fraudsters record your actual keystrokes and mouse clicks. Keyloggers are “trojan” software programs that target your computer’s operating system (Windows, Mac OS, etc.) and are “installed” via a virus. These can be particularly dangerous because the fraudster can capture your User ID and PIN, account number, Social Security Number, “Secret Question” answers and anything else you have typed. If you happen to have the same User ID and PIN for many different online accounts, you’ve essentially granted the fraudster access to any company with whom you do business.
Trojan horses are designed to allow a hacker/fraudster remote access to a target computer system. Once a trojan horse has been installed on a target computer system, it is possible for the hacker/fraudster to access it remotely and perform various operations. Operations that could be performed by a hacker/fraudster on a target computer system include:
- Use of the machine as part of a botnet (i.e. to perform spamming or to perform Distributed Denial-of-service (DDoS) attacks.)
- Confidential Data theft: User IDs, PINs, account information.
- Installation of software, including other malware.
- Downloading or uploading of files.
- Modification or deletion of files.
- Keystroke logging.
- Viewing the user’s screen.
- Wasting computer storage space.
- Crashing the computer.
A virus is software capable of causing great harm to files or other programs on a computer. Viruses cannot spread from computer to computer on their own. They usually access new victims through infected email attachments. Some signs that may indicate your computer is infected with a virus include:
- It is operating much slower than normal or getting hung up.
- You suddenly start seeing pop-up advertisements.
- You see a new home page.
A computer worm is a self-replicating malware computer program that uses a computer network to send copies of itself to other computers without user intervention. Unlike a virus, it does not need to attach itself to an existing program. Worms almost always harm the network (mostly by consuming bandwidth), whereas viruses almost always corrupt or modify files on a targeted computer.
A software system that consists of a program, or combination of several programs, designed to hide or obscure the fact that a system has been compromised. Contrary to what its name may imply, a rootkit does not grant administrator access, as it requires prior access to execute and tamper with system files and processes. An attacker may use a rootkit to replace vital system executables, which may then be used to hide processes and files the attacker has installed, along with the presence of the rootkit.
- Use a current Internet browser with 128-bit encryption that supports secure and private transactions.
- Consider using the built-in security features that are provided with your Internet browser instead of disabling them.
- Use a software or hardware firewall to protect your computer from network intrusion.
- Maintain and run anti-spyware and anti-virus software to detect new threats.
- If your computer is on a wireless network (home or public), ensure that the router settings are secure, (encrypted). Using scanning devices, individuals can intercept unencrypted signals and view or obtain your information.
- Use caution when downloading files, installing software, or opening email attachments from unverified or unknown sources. Many of these files contain spyware or key-logging programs that can send information back to a malicious site.
- Be suspicious of emails purporting to be from a Financial Institution, government department or other agency requesting account information, account verification or banking access credentials such as User ID’s, PIN’s, Codes and similar information. Opening file attachments or clicking on web links in suspicious emails could expose the system to malicious code that could hijack your computer.
- We recommend clearing the browser cache before starting an Online Banking session in order to eliminate copies of web pages that have been stored on the hard drive.
- Always lock your computer when you leave it unattended. Set the computer to automatically lock after a set period of inactivity, e.g. 5 minutes.
- When you are finished with your computer turn it off or disconnect it from the Internet by unplugging the modem or Ethernet/DSL cable.
- Properly dispose of old computers and ensure all sensitive information is removed from the hard drive. Reformatting the hard drive may not be sufficient – use specialized software to erase information.
As a business you have additional concerns, such as multiple users and cash management (ACH & Wires) functionality to contend with regarding the safety and security of your Online Banking accounts. There is the growing threat of fraudulent ACH transactions and Wire transfers from online banking accounts which primarily target small to medium sized businesses and government entities and can involve amounts as small as $10,000 US dollars to as much as several million dollars. The majority of these attacks require the attacker to compromise the target computer by installing malware (viruses, spyware, adware, trojans, keyloggers, worms, rootkits), in addition to phishing and pharming techniques, to obtain users login credentials allowing access into the client’s Online Banking session via hijacked credentials.
The following recommendations are cyber security best practices that help reduce the risks associated with online banking. Nothing can eliminate all of the risks, however, an informed and vigilant user is a key defense. In conjunction with our Online Banking Security Information document the following is a list of additional online banking security measures for our Commercial Clients:
- Install a dedicated, actively managed firewall. A firewall limits the potential for unauthorized access to a network and computers.
- Install well known and supported anti-virus and desktop firewall software on all computer systems. Look for names you know and read independent reviews of all products you use.
- Ensure computers are patched regularly, particularly operating systems and key applications with security patches. It is highly recommended to sign up for automatic operating system updates for the operating system and many non-operating system applications.
- Change the default login names and PINs on routers, firewalls, and other network equipment and software.
- Monitor log files, especially proxy server logs, for unauthorized/suspicious Internet connections coming to and leaving the network.
- Carry out all online banking activities from a hardened and completely locked down computer system.
- Use a single computer with a static IP Address for all online banking transactions. If possible, register this IP Address with the Financial Institution. Actively monitor the computer for viruses and other malware and limit this computer from conducting any other Internet activity, including email.
- Use a dedicated computer for all online transactions and implement white listing methods to prevent the system from going to any site/address that does not have a documented business need.
- Whenever possible do not use a wireless network for financial transactions. If a wireless network must be used, enforce security measures such as enabling encryption and MAC address filtering, changing the service set identifier (SSID) and turning off SSID broadcasting.
- Turn off and remove services that are not needed on computers. Allow the use of CDs, DVDs, USB devices for legitimate business needs only.
- Consider blocking Internet plug-ins on the computers that access online banking accounts. Disabling Flash, scripts, pop-up windows, etc., can be frustrating for general users but will prevent multiple exploits.
- Educate users on good cyber security practices to include how to avoid having malware installed on a computer and new malware trends.
- Make sure employee computer profiles have the least privilege possible to do their job.
- Ensure employees cannot override or circumvent security software.
- Only approved company applications should be deployed on your computers, and should be patched regularly.
- Use a mail service that blocks or removes email file attachments such as files that end in .vbs, .bat, .pif, or .scr. These are file extensions for executables, and are commonly dangerous files.
- Prohibit the use of shared User IDs and PINs for Online Banking.
- Develop and implement employee rules and policies concerning appropriate and allowed use of the Internet.
- Instill good security habits with your employees. Develop a security awareness program that addresses the risks specific to your business and/or to the specific functions within your company. Review with employees on a regular basis.
- If you have employees that use laptops, consider implementing software that will determine if mobile devices have been infected before allowing them back into your network.
- Employ advanced authentication techniques for user logins such as two-factor authentication (User ID and PIN - something the user knows, and Token codes - something the user has.)
- Develop a working relationship with a member of law enforcement so that there is an established venue for reporting incidents.
- Properly exit from Foundation Bank Online Banking as soon as you finish your banking activities by clicking “Logoff”. Never walk away from your computer with your account information on the screen.
- While using a computer in public areas beware of “shoulder surfers” who may be trying to intercept your PIN or account information.
- Do not use the same computer for online banking transactions that you use to browse the Internet.
- Monitor your account on a daily basis to detect any unusual activity immediately.
- Beware of fraudulent emails or websites known as “Phishing” or “Web Spoofing” schemes that appear to be from Foundation Bank or other legitimate sites. Always go directly to Foundation Bank’s website by typing www.foundationbank.com directly into the browser address bar. Never click on unverified links in emails, in pop-up ads, or on other unknown sites. These emails and links may ask for personal information or may redirect you to illegitimate sites that look like Foundation Bank’s site or appear to have the Foundation Bank URL address in the browser address bar.
- Know what your Financial Institution’s website looks like and what questions are asked to verify your identity. Some attacks, known as man-in-the-middle attacks, will change the login page. A vigilant user can sometimes spot these attacks by noticing slight modifications to the Bank’s standard page; extra security questions, poor grammar, misspellings, a fuzzy or older logo or a change to the location of each feature.
- Be suspicious of any email that asks for personal information, requests your authentication, or indicates a problem with your Foundation Bank account. If you receive an email like this, DO NOT REPLY by email. Instead call Foundation Bank at 425-691-5000 to notify us of the fraudulent email. Foundation Bank does not request personal or account information from clients via email or pop-up windows.
- Only use trustworthy computers. Shared public computers like those in airport lounges, internet cafes, public libraries, and hotel lobbies could be connected to keystroke loggers or infected with password-stealing viruses. Do not use them to access Online Banking or other websites containing confidential information about you.
Your Online Banking PIN is the key to your Online Banking account and your personal and financial information. Here are some tips to keeping your PIN secure:
- Create a strong and unique Online Banking PIN by making it as long and complex as possible with a combination of uppercase and lowercase letters, numbers, and symbols. Refrain from using predictable sequences of characters such as “1234” or “abcd”. Do not use your Online Banking ID in your PIN.
- Do not use words that can be found in a dictionary or information related to you such as your birth date, address, names of family members, etc.
- Disable any “AutoComplete” or similar features on any computer you use for Online Banking.
- Do not write down your PIN.
- Do not share your Online Banking PIN with anyone, including Foundation Bank associates. Your Online Banking ID and PIN are assigned to you and verify who you are when you begin and Online Banking session with Foundation Bank.
- If you feel that your Online Banking ID and/or PIN have been stolen or compromised, immediately change your PIN Online and notify Foundation Bank.
- Change your PIN on a regular basis. We recommend changing your PIN every 60-90 days.
- Do not use the same PIN for various website.
- Never email your PIN or respond to an email request for your PIN or other confidential information. Foundation Bank will never ask you to submit confidential information in an email.
- Question suspicious emails. We will never send you an email asking for confidential information or your Online Banking ID or PIN.
- If you receive an email that appears to be suspicious, do not reply to it or click on the link that it provides. Simply delete it.
- If you think you may have provided personal or account information in response to a fraudulent email or website, report the fraud immediately, change your PINs, and monitor your account activity frequently.
- Avoid clicking on links provided in emails. It is always better to type the address into your browser.
- Open email attachments only if you know the sender. It is best to scan attachments with your anti-virus software prior to opening.
- Most computer files have filename extensions such as “.doc” for documents or “.jpg” for images. Any file that appears to have a double extension, like “heythere.doc.pif” is extremely likely to be a dangerous file and should never be opened.
- Never open email attachments that have file endings of “.exe”, “.pif”, or “.vbs”. These are file extensions for executables, and are commonly dangerous files.
- Be careful and selective before providing your email address to a questionable website. Sharing your email address makes you more likely to receive fraudulent emails.
- Confirm the validity of all requests for sensitive personal, financial, or account information, particularly if they are made with an urgent or threatening tone.
- Confirm requests for personal or account information by going to the company’s website directly. Open a new browser window, type the Web address, and check to see if you must actually perform any activity that an email may be asking you to do, such as change a PIN.