Safety & Security

There has been an increase in fraud targeting mortgage closing companies and consumers near the closing date of their dream property. Do not to let emotions and the stress surrounding typical closing dates cause you to let your guard down. It is important for consumers to understand how the email phishing scam works.

How the scam works
Real estate companies, title companies and consumer email accounts can be hacked or phished by unauthorized third parties. These unauthorized third parties send fraudulent emails to clients during the late stages of the mortgage closing process. These fraudulent emails can look as though they were truly sent by an employee of the genuine real estate or title companies and include instructions to wire funds to a fraudulent account not controlled by the genuine real estate or title companies. Once wired, the fraudsters will quickly deplete the funds wired to the fraudulent account before anyone realizes they have been scammed.

How consumers can protect themselves
Early in the home closing process, consumers can find out exactly what to expect from wire transferring instructions by speaking directly to the title company, real estate agent and lender. Before wiring funds for closing, consumers should verify bank and account information by speaking to title company representatives in person or by telephone, using a phone number of record instead of any phone number shown in an email. IT IS VERY IMPORTANT THAT YOU CALL YOUR TITLE AGENT USING A KNOWN NUMBER (NOT THE ONE IN AN EMAIL) TO CONFIRM WIRING INSTRUCTIONS FOR YOUR CLOSING!

Once the wire is sent the transaction is final, and it can be impossible to recover the funds. Often times there is no recourse if your Credit Union or bank followed the wire instructions that you provided and authorized. If you are a victim of wire fraud, contact law enforcement immediately and provide as much information as possible. In addition, it is highly recommended that you immediately file a complaint with the Federal Bureau of Investigation Internet Crime Complaint Center (IC3) at https://www.ic3.gov/Home/BEC.

For more information:

• https://www.consumerfinance.gov/about-us/blog/mortgage-closing-scams-how-protect-yourself-and-your-closing-funds/
  
• https://www.ic3.gov/

The holiday season is typically about friends, family, food and shopping! Unfortunately, while you're looking for holiday deals, the bad guys are looking for ways to scam you any way they can. Due to an increase in online shopping in 2020 and 2021, card not present fraud has grown exponentially. One in five Americans are now using payment applications such as Zelle, Venmo and PayPal, and fraud in this space was up 300% this summer. Additionally, social media quizzes and challenges allow for account security question answers to be easily guessed by fraudsters.

Here is an easy way to remember 5 best practices to avoid fraud:

1. Friends and family only: This is the crucial rule of thumb for using person-to-person payment apps. The likelihood of information and money being stolen goes up drastically when your member uses payment apps outside of friends and family. Also, be careful not to overshare on social media. Consider anything you post to be public information. If you receive a holiday greeting card in your inbox, verify the sender before clicking the link to view the card.
2. Remember to use the alert features for your online accounts. This creates layers of protection for your information's security. Use options like text message alerts if a transaction occurs outside your typical radius, card not present or a withdrawal has been made. Keep an eye on the activity in your accounts.
3. Authentication: The layers of authentication are ever so critical and can include:
   • Multi-factor authentication
   • Biometrics
   • Setting strong, unique passwords and usernames
4. Update your devices to help ensure there are the latest security patches. Be suspicious of emails you receive about online purchases. Check the status of your order directly on the website you purchased from so you don't accidentally click on malware.
5. Dollar limits: Limiting the daily dollars spent on credit and debit cards and capping the number of transactions are two significant risk mitigation tools.

Be aware of popular text messaging scams:

• Do not click on fraudulent text message links regarding "your package" or "delivery" claiming to be from USPS, UPS or FedEx. Instead visit the website of the company you ordered from to check the delivery status.
• Fraudulent text messages such as "you still haven't claimed your phone worth $1200" or "you have been approved for a loan of $4500" have been popular. Avoid clicking on these text messages, which often try to convey a sense of urgency like "today only" or "in the next 24 hours."

Do you think your password is impossible to guess? The reality is that many people use simple passwords that are easy to remember but make it easy for hackers to gain access to your financial and personal accounts. Making your password more complex will keep you safer online (though much more can still be done).

You should also have more than one password that you use. Just as you wouldn't use the same key for your house, your car, your mailbox and your office, you shouldn't use the same password for all of your online accounts. This exposes you to more risk and increases the likelihood of having your information stolen.

• Use passwords that have at least eight characters.
• Use a combination of letters, numbers and symbols. This will create a much stronger password. For example, [email protected] is a better alternative than TIMCHICAGO. However, it is important to create a password that you can still remember without having to write it down.
• Another clever trick you can use to create a strong, yet still memorable password is to think of a phrase or a poem and convert the first letters of each word in the phrase into your password. For example, "How much wood could a woodchuck chuck" would become [email protected]
• Using common data such as your name, family member's names, hometown, your birth date or any word that can be found in the dictionary make your password less secure (hackers often have programs that will try every word in the dictionary in order to crack your password).
• Using the same ID/password combination for several different accounts means that if one of your combinations is stolen, all of your accounts are at risk. For instance, if someone steals your password for your online photo site, they will be then able to access your online accounts. Try to use different combinations for your various online accounts.
• Never share your passwords with anyone.
• Be sure to "logout" of online sites when you are finished conducting your business. Don't just close the browser or "X" out of the page.

1. Update your Username and Password for your online account and create a strong Username and complex Password. We recommend using a unique mix of characters, avoid using your first and last name or your email name or other easily identifiable information.
2. Add Alerts by selecting "Manage Alerts" under "My Profile" within Online/Mobile Banking.
3. Keep your computer and mobile devices current with the most recent software update.
4. Install reputable antivirus software on whatever devices you use to access your account information.
5. If you suspect malware, consider using a professional service to have your electronic device or personal computer scanned and cleaned.
6. Add Two-Factor Authentication when setting up your Online Account Access.
7. Protect your phone by setting up a password or using biometrics to access.
8. Call or visit a branch to add a verbal password to access your account information by phone.
9. Make sure you keep your contact information current.
10. Report any suspicious activity as soon as possible.

We will never call, email or text message you to verify your Eglin Federal Credit Union account information, such as your account number, card number, card expiration date, security code (Two-Factor Authentication), password and/or PIN.

Every year scammers add new twists to well-known tax-related scams and 2020 is no exception.

Taxpayers should remember that the IRS generally first mails a bill to a taxpayer who owes taxes. There are special circumstances when the IRS will call or come to a home or business.

Click the links below to visit IRS.gov for more tips to help you spot email phishing scams and phone scams and avoid becoming a victim.

Socially engineered schemes often rely on methods that financial institutions would never employ, to avoid fraud:

• Never give out personal or financial information in response to an unsolicited phone call, fax, e-mail or text.
• Contact the financial institution to confirm the legitimacy of any e-mail that asks for the submission of personal or account information.
• Check credit card and account statements regularly for unauthorized transactions, even small ones.
• Make sure websites are safe when submitting financial information online. Check for padlocks or key icons at the bottoms of Internet browsers. Most secure Web addresses also use "https" as opposed to "http."
• Report suspicious activity to the Internet Crime Complaint Center, a partnership between the Federal Bureau of Investigation and the National White Collar Crime Center.
• Contact your financial institution immediately if a phishy link may have been clicked or a suspicious communication responded to.

Report an Internet crime to the FBI Internet Crime Complaint Center

Getting infected with a computer virus or Trojan can be frustrating. These programs are known to destroy your computer, slow its performance, and barrage you with annoying pop-up ads. However, the types of viruses and Trojans that infect computers today are more malicious. They are designed to steal your credit card information and passwords, take over your email and use it for spamming, or even record what you type on your computer. Also, many of the new viruses and Trojans aim to be transparent so most people don't even know they have been infected.

Using anti-virus software and keeping it up-to-date is the best protection against these threats. Nowadays, most anti-virus software products will automatically update themselves as new threats are uncovered so you don't have to do a thing. Many Internet service providers now even offer these products free to their customers.

Hackers constantly create new ways to penetrate your computer. Installing a personal firewall is essential to safeguard your computer and valuable personal information. A firewall is a secure barrier that sits between your computer and the Internet that prevents hackers from accessing your information.

A firewall needs to be installed properly or it will not effectively protect you from online threats. In addition, like anti-virus software, your firewall should be kept up-to-date. This is easy to do with software that automatically updates the latest versions onto your computer.

Be aware of deceptive emails, pop-ups, and other online scams.

Online criminals will attempt to acquire your personal information by luring you to a website that looks legitimate, but is actually a fake site. If you receive any emails from an unfamiliar source, or any suspicious pop-ups, do not click on the links or open the attachment.

New online attacks are so advanced that they are capable of redirecting you to a fake website, even if you didn't click on anything. If a web page asks for you to provide sensitive information that it has never asked you to provide before, do not type anything and close the page immediately. Financial institutions and online service providers do not ask you to enter information such as your credit card number, full Social Security number, or PIN number on the login page or any subsequent pages.

As consumers become more educated about fraud and identity theft, online criminals are moving to other places to launch their scams. Phone scams are gaining popularity again. There are two common types of phone scams. The first type of scam involves an email detailing a problem with your account and requests you to call a specific phone number to provide more details. The second type of scam involves a phone call from an automated call center asking you for sensitive information. You should never provide personal information to an unsolicited caller.

Mobile phones are another new target. For example, one scam involves sending a text message to your mobile phone claiming to be your financial institution or a credit card processor. If you receive such a text message and are unsure if it is a legitimate communication, call your financial institution's customer service center to verify that the message is genuine.

Guard your privacy and limit the amount of personal information you share online.

The growth of social networking sites has made it easier for online criminals to obtain information on you. This is a way for them to gather information to answer the challenge questions most online service providers require in order to enable access to your account or retrieve and change your password. Limit the amount of personal information you publicly share online.

Despite adopting all the appropriate security measures, online users still manage to fall victim to scams and have their identity stolen. In order to help ensure that you and your information stay safe, check your online account statements frequently. If you have fallen victim to online fraud, the sooner you know about it, the sooner you can act to block your accounts, and take corrective action. If you detect suspicious activity in your account, you should immediately contact your account provider for help.

To protect your account, we monitor your ATM and debit card transactions for potentially fraudulent activity which may include a sudden change in locale (such as when a U.S. issued card is used unexpectedly overseas), a sudden string of costly purchases, or any pattern associated with new fraud trends around the world.

If we suspect fraudulent ATM or debit card use, we will call you to validate the legitimacy of your transactions. Your participation in responding to our call is critical to prevent potential risk and avoid restrictions we may place on the use of your card.

• Our automated call will ask you to verify recent transaction activity on your card.
• You'll be able to respond via your touchtone keypad.
• You'll also be provided with a toll-free number to call should you have additional questions.

So that we may notify you as quickly as possible, it is important that EFCU has your cell phone number and accurate email address. Call 850.862.0111 x1402 or update your Contact Information by logging into your account via a browser or the EFCU Mobile App.

In the meantime, please be diligent in monitoring transaction activity on your account and contact us immediately if you identify any fraudulent transactions.

Here are some additional tips on protecting yourself from debit card fraud:

• Be Proactive with Alerts: When logged into your EFCU account via a browser or the EFCU Mobile App, under 'eServices', you have a choice of 29 alerts to help monitor your account activity.
• Unless absolutely required for a legitimate business purpose, avoid giving out your:
  
  • Address and ZIP code
  • Phone number
  • Date of birth
  • Social Security number
  • Card or account number
  • Card expiration date
  Your PIN is private; never give it out.
• In stores and at ATMs, always cover your card and PIN, and watch for:
  
  • Cell phone cameras, mirrors, or other tools used to view cards and PINs
  • People watching your transactions
  • Cashiers taking your card out of sight; take it to the register yourself
  • Any unusual activity at ATMs; if you feel uncomfortable, go to another ATM
• Online, you should never respond to unsolicited emails that:
  
  • Ask you to verify your card PIN or account number; such emails are not sent by legitimate businesses
  • Link to websites; such sites can look legitimate but may collect data or put spyware on your computer

Maximize your safety at ATMs with these tips:

• Keep your ATM/Debit card in a safe place. Memorize your personal identification number (PIN) - never write it on your card!
• Use ATMs that are well lit, are located in high traffic areas, and have mirrors so you can see who is approaching you from behind. At night, it is a good idea to have someone else with you.
• At walk-up ATMs, don't leave the keys in your car.
• At drive-up ATMs, keep your car locked.
• Use your body to shield the keyboard from view when entering your PIN. When you get money, don't count it in public view.
• Remember to take your card and receipt. Keep receipts until you have balanced your monthly statement.
• If you see something suspicious at an ATM, leave immediately and contact the police.
• Never enter your PIN in any ATM that does not look genuine, has been modified, has a suspicious device attached, or is operating in a suspicious manner.
• Be Alert to potential scams -We will never call or email you to verify your Eglin Federal Credit Union account information, such as your password and/or PIN number.

Is the mobile app secure?
The mobile app uses SSL encryption to communicate securely throughout the entire process of accessing your accounts.

How long does each login session last?
Each login session lasts 20 minutes from the beginning of the session. The timer is not reset with activity.

How can I further protect my account information?
Protect your account information by taking additional steps: - Use the screen locking feature of your mobile device. - Never save your account number on your mobile device. - Always use the Logout feature of the mobile app. - Request a password change if your device is lost or stolen. - Read "Make Your Smartphone Safe" on this page to learn more about securing your mobile device.

As technology evolves, so unfortunately do the ways that criminals can illegally access your personal information. Smartphones give us a lot of freedom and make our lives more efficient, but they also present their own set of challenges when it comes to data security. However, there is no reason why you can't make yourself more secure with a few key habits.

Hold on to it!
When you are in a public area, don't set your phone down or leave it exposed in an open bag. It only takes a second for a thief to walk off with your little lockbox of personal information. If a stranger asks to borrow your cell phone, offer to help them find a public phone they can use instead.

Lock it up
Whether it's with a password or a thumbprint, using a unique entry requirement will make it difficult or impossible for anyone else to enter your phone's data. It might be an inconvenience now, but if you lose your phone or have it stolen, you'll be glad to know the person who has your phone doesn't also have free reign over your sensitive data. Make your password tough to guess for even someone who knows you well.

Slow down a bit
When you're pinballing around between apps, the internet, your text messages and any number of other items, there's a tendency to click without a lot of thought. But like with your other computers, it's important to be very careful about the links you click on. If you don't recognize the sender of a link in a text message or email, or even if you aren't 100% sure about the origin of a link, you're better off leaving it alone.

Use extra security
While you're loading up on games, tools and other cool apps, be sure to also get yourself some security software designed for smart phones. On top of that, check regularly for updates that will keep you ahead of the criminals trying to pry into your phone. Remember though that you should always check to make sure anything you download to your phone is from a trusted source and has been reviewed for problems by other users.

Be network careful
If you're tech savvy, you may know that you can potentially save money by using a public wi-fi network when it's available instead of your phone's data service. However, it's best to avoid using these networks when you plan to access sensitive information of any kind.

Mind what's in your phone
With smartphones likely becoming more and more inextricably intertwined into your life, it may seem like it makes sense to keep your account numbers, passwords and other hard-to-remember information in a notepad document on your phone for easy access. But you should consider this only as safe as having the same information on a piece of paper loose in your pocket; it could very easily end up somewhere you don't want it to be.

Clean it up before you turn it in
When you trade in an old phone, use a "wipe" app and reset your device to the factory default settings to avoid sending a treasure chest of your data out into the world. Also check to see what kind of precautions phone recyclers use to prevent stolen information.

In case it is stolen
You may at some point find your phone gone despite all your best efforts to keep it in your possession. But it doesn't have to stay missing. If you download a "Find My Phone" app ahead of time, you can use this handy tool to figure out where your phone has found its way to. In a similar vein, an erase app installed before your phone absconds can remotely wipe the data from your phone before it falls into the wrong hands. No matter what precautionary measures you have taken, though, you need to contact your wireless provider immediately if you lose your phone.

Information security for your smartphone isn't that different from keeping your other repositories of data safe. By taking a few basic steps now, you can save yourself some major problems later on.

EFCU has partnered with Digital Defense Inc. to provide you Training, Education, and Awareness Module™ (TEAM) that is relevant and easy-to-understand. Using a web browser you can access the security training anytime and anywhere. Click the button below to browse topics for improving your online security.

We are committed to taking reasonable steps to protect the security of our member's financial information in all areas of our operations. Therefore, when providing access to your financial information over the Internet, we practice the following security measures:

1. The Credit Union maintains a firewall system that protects our Web server from unauthorized access.
2. We use EV-SSL (Extended Validation Secure Socket Layer) technology to encrypt all traffic (including account numbers, PINs, and financial data) that is sent between your computer and our online banking system. A new encryption key is generated every time you log into your EFCU account online. Please note that the information is not encrypted once it resides within your computer.
3. We require a valid account number and PIN to access your account. After three bad attempts, the account is locked for your protection.
4. A session-only cookie is transmitted to your computer when you successfully log in to your EFCU account online. The cookie contains a number that is unique to every session and every member. While you are logged in, it is used to verify your access to information. When you either logout, close your browser, or allow the inactivity timer (see below) to expire, this session-only cookie values becomes invalid. EFCU recommends that you log out and/or close your browser every time you are finished accessing your financial information online. We do not recommend leaving your computer unattended and allowing the inactivity timer to expire. In order to access your account online via a browser or the EFCU Mobile App you will need to enable session-only cookie support for eglinfcu.org.
5. An inactivity timer automatically breaks your connection after several minutes of inactivity. This prevents you from accidentally leaving active connections to your account after you have completed your transactions.
6. The Credit Union uses a Multi-Factor Authentication system to further verify your identity when you access your account information online. Members are prompted to select and answer three secret questions to establish their identity. The questions will appear when there is a challenge situation, for example; you log in from an unfamiliar location.