Safety & Security

The Federal Trade Commission (FTC) released a consumer alert regarding using AI for new scams: cloning someone’s voice. This could happen to anyone. An attacker could pose as one of your family members or a co-worker (like your manager) and use the sound of their voice to try and trick you into moving money or giving out information.

Remember to always stop, look and think:

• Does the request make sense?
• Do you get a feeling in your gut?
• Does the request follow normal policy or procedure?
• Is the request out of character for the person asking you?
• Is there a sense of urgency?

When in doubt, call the person back from a number you know.

Read more about voice cloning and other scams

Important texting scam information from our Fraud Department

Members are reporting that they are receiving fake text messages from fraud monitoring services that appear as an EFCU alert. The text message asks members to confirm or STOP a transaction from a merchant. When the member replies to the text with "STOP," they are contacted by the scammer and may be asked for their Online/Mobile Banking Username and/or Password, their Debit/Credit Card PIN, their One-Time Passcode (OTP) for Debit/Credit Card transactions, their Two-Factor Authentication Text/Voice code, or other account information. These calls often include fake Caller ID numbers that appear to be from EFCU, and almost immediately lead to real contactless card fraud. Members who have been victimized have reported that these scammers can be very convincing.

EFCU will never contact you asking for your password, PIN, one-time code or other logon information. We also never ask you to download software in an email or while you're on the phone with us. If you've provided any information through this type of call or text, call EFCU Card Services at 800.367.6159, option 1. Thank you.

Be aware of mobile deposit scams

Mobile banking is easy and convenient. Unfortunately, the growing popularity of mobile banking is making it easier for thieves to commit fraud. One of the most common ways they do this is through mobile deposit scams.

Mobile deposit scams work the same way as traditional fake check scams, but the fraud is conducted remotely using a mobile device.

There are many types of fake check scams, but most involve a fraudulent check being deposited into a victim's account. The mobile deposit can be made either by the victim or the scammer. The victim receives a fake check by mail or email. They either deposit the check or are tricked into giving away their online banking credentials to the scammer who then makes the deposit. The victim is then asked to send or pay money to a third party as a condition of receipt. By the time, the fraud is discovered, the victim may have already sent money to the fraudster. The victim may receive no benefit from the bad deposit but has all the liability for it.

Be wary of any offers that involve the exchange of money, especially if they sound too good to be true and never share your log in credentials with anyone.

If you think you may have been a victim of a scam, you can file a complaint with the FTC online at ftc.gov or contact EFCU at 850.862.0111, option 4.

Every year scammers add new twists to well-known tax-related scams.

Taxpayers should remember that the IRS generally first mails a bill to a taxpayer who owes taxes. There are special circumstances when the IRS will call or come to a home or business.

Click the links below to visit IRS.gov for more tips to help you spot email phishing scams and phone scams and avoid becoming a victim.

There has been an increase in fraud targeting mortgage closing companies and consumers near the closing date of their dream property. Do not to let emotions and the stress surrounding typical closing dates cause you to let your guard down. It is important for consumers to understand how the email phishing scam works.

How the scam works
Real estate companies, title companies and consumer email accounts can be hacked or phished by unauthorized third parties. These unauthorized third parties send fraudulent emails to clients during the late stages of the mortgage closing process. These fraudulent emails can look as though they were truly sent by an employee of the genuine real estate or title companies and include instructions to wire funds to a fraudulent account not controlled by the genuine real estate or title companies. Once wired, the fraudsters will quickly deplete the funds wired to the fraudulent account before anyone realizes they have been scammed.

How consumers can protect themselves
Early in the home closing process, consumers can find out exactly what to expect from wire transferring instructions by speaking directly to the title company, real estate agent and lender. Before wiring funds for closing, consumers should verify bank and account information by speaking to title company representatives in person or by telephone, using a phone number of record instead of any phone number shown in an email. IT IS VERY IMPORTANT THAT YOU CALL YOUR TITLE AGENT USING A KNOWN NUMBER (NOT THE ONE IN AN EMAIL) TO CONFIRM WIRING INSTRUCTIONS FOR YOUR CLOSING!

Once the wire is sent the transaction is final, and it can be impossible to recover the funds. Often times there is no recourse if your Credit Union or bank followed the wire instructions that you provided and authorized. If you are a victim of wire fraud, contact law enforcement immediately and provide as much information as possible. In addition, it is highly recommended that you immediately file a complaint with the Federal Bureau of Investigation Internet Crime Complaint Center (IC3) at https://www.ic3.gov/Home/BEC.

For more information:

• https://www.consumerfinance.gov/about-us/blog/mortgage-closing-scams-how-protect-yourself-and-your-closing-funds/
  
• https://www.ic3.gov/

Due to an increase in online shopping, card not present fraud has grown exponentially. Additionally, social media quizzes and challenges allow for account security question answers to be easily guessed by fraudsters.

Here is an easy way to remember 5 best practices to avoid fraud

1. Friends and family only: This is the crucial rule of thumb for using person-to-person payment apps. The likelihood of information and money being stolen goes up drastically when your member uses payment apps outside of friends and family. Also, be careful not to overshare on social media. Consider anything you post to be public information. If you receive a holiday greeting card in your inbox, verify the sender before clicking the link to view the card.
2. Remember to use the alert features for your online accounts. This creates layers of protection for your information's security. Use options like text message alerts if a transaction occurs outside your typical radius, card not present or a withdrawal has been made. Keep an eye on the activity in your accounts.
3. Authentication: The layers of authentication are ever so critical and can include:
   • Multi-factor authentication
   • Biometrics
   • Setting strong, unique passwords and usernames
4. Update your devices to help ensure there are the latest security patches. Be suspicious of emails you receive about online purchases. Check the status of your order directly on the website you purchased from so you don't accidentally click on malware.
5. Dollar limits: Limiting the daily dollars spent on credit and debit cards and capping the number of transactions are two significant risk mitigation tools.

Be aware of popular text messaging scams

• Do not click on fraudulent text message links regarding "your package" or "delivery" claiming to be from USPS, UPS or FedEx. Instead visit the website of the company you ordered from to check the delivery status.
• Fraudulent text messages such as "you still haven't claimed your phone worth $1200" or "you have been approved for a loan of $4500" have been popular. Avoid clicking on these text messages, which often try to convey a sense of urgency like "today only" or "in the next 24 hours."

Beware of shopping and travel scams

1. Watch out for Malvertising (malicious advertising): Convincing ads for fake websites, banks, digital wallets and more can con you into having your credentials stolen. Don't click on social media or search engine ads! Look up the actual website.
2. Fake eCommerce shops are out there: 62% of us are online shoppers and we're looking for bargains! Fake online shops often offer items that seem to be out of stock or hard to find everywhere else. They scam shoppers out of money and never send the merchandise purchased. Be wary! Shop with vendors you know and trust.
3. Counterfeit goods: Luxury items like jewelry, purses, electronics and pro sports merchandise are prime targets for counterfeiting. Unknowing shoppers pay high prices and may receive fraudulent or even stolen goods. This is another good reason to shop with vendors you know and trust.
4. Travel scams: Unfortunately, vacation rental cons, fake loyalty programs, sham travel agencies, fraudulent airline tickets, etc. are on the rise. Fraudsters will create completely fake vacation packages, including flights, rental cars and hotel stay. When pricing seems too good to be true, contact the vendor multiple ways to make sure they are legitimate. Better yet, use a travel agent you know.

Fraud is constantly increasing and evolving year-round. Always do your research and use caution whether you are shopping online, reading emails, or receiving texts or phone calls.

Do you think your password is impossible to guess? The reality is that many people use simple passwords that are easy to remember but make it easy for hackers to gain access to your financial and personal accounts. Making your password more complex will keep you safer online (though much more can still be done).

You should also have more than one password that you use. Just as you wouldn't use the same key for your house, your car, your mailbox and your office, you shouldn't use the same password for all of your online accounts. This exposes you to more risk and increases the likelihood of having your information stolen.

• Use passwords that have at least eight characters.
• Use a combination of letters, numbers and symbols. This will create a much stronger password. For example, Tim_Chic@go171 is a better alternative than TIMCHICAGO. However, it is important to create a password that you can still remember without having to write it down.
• Another clever trick you can use to create a strong, yet still memorable password is to think of a phrase or a poem and convert the first letters of each word in the phrase into your password. For example, "How much wood could a woodchuck chuck" would become HmWc@wC.
• Using common data such as your name, family member's names, hometown, your birth date or any word that can be found in the dictionary make your password less secure (hackers often have programs that will try every word in the dictionary in order to crack your password).
• Using the same ID/password combination for several different accounts means that if one of your combinations is stolen, all of your accounts are at risk. For instance, if someone steals your password for your online photo site, they will be then able to access your online accounts. Try to use different combinations for your various online accounts.
• Never share your passwords with anyone.
• Be sure to "logout" of online sites when you are finished conducting your business. Don't just close the browser or "X" out of the page.

1. Update your Username and Password for your online account and create a strong Username and complex Password. We recommend using a unique mix of characters, avoid using your first and last name or your email name or other easily identifiable information.
2. Add Alerts by selecting "Manage Alerts" under "My Profile" within Online/Mobile Banking.
3. Keep your computer and mobile devices current with the most recent software update.
4. Install reputable antivirus software on whatever devices you use to access your account information.
5. If you suspect malware, consider using a professional service to have your electronic device or personal computer scanned and cleaned.
6. Add Two-Factor Authentication when setting up your Online Account Access.
7. Protect your phone by setting up a password or using biometrics to access.
8. Call or visit a branch to add a verbal password to access your account information by phone.
9. Make sure you keep your contact information current.
10. Report any suspicious activity as soon as possible.

We will never call, email or text message you to verify your Eglin Federal Credit Union account information, such as your account number, card number, card expiration date, security code (Two-Factor Authentication), password and/or PIN.

Socially engineered schemes often rely on methods that financial institutions would never employ, to avoid fraud:

• Never give out personal or financial information in response to an unsolicited phone call, fax, e-mail or text. If you receive a call from an individual stating they are an EFCU employee, don’t give out any personal information. Instead, ask the individual for their extension, hang up, then call the main EFCU number at 850.862.0111 and type in the extension the caller gave you. Never call a number provided by an unverified individual unless you have confirmed the number is valid.
• Contact the financial institution to confirm the legitimacy of any e-mail that asks for the submission of personal or account information.
• Check credit card and account statements regularly for unauthorized transactions, even small ones.
• Make sure websites are safe when submitting financial information online. Check for padlocks or key icons at the bottoms of Internet browsers. Most secure Web addresses also use "https" as opposed to "http."
• Report suspicious activity to the Internet Crime Complaint Center, a partnership between the Federal Bureau of Investigation and the National White Collar Crime Center.
• Contact your financial institution immediately if a phishy link may have been clicked or a suspicious communication responded to.

Report an Internet crime to the FBI Internet Crime Complaint Center

Getting infected with a computer virus or Trojan can be frustrating. These programs are known to destroy your computer, slow its performance, and barrage you with annoying pop-up ads. However, the types of viruses and Trojans that infect computers today are more malicious. They are designed to steal your credit card information and passwords, take over your email and use it for spamming, or even record what you type on your computer. Also, many of the new viruses and Trojans aim to be transparent so most people don't even know they have been infected.

Using anti-virus software and keeping it up-to-date is the best protection against these threats. Nowadays, most anti-virus software products will automatically update themselves as new threats are uncovered so you don't have to do a thing. Many Internet service providers now even offer these products free to their customers.

Hackers constantly create new ways to penetrate your computer. Installing a personal firewall is essential to safeguard your computer and valuable personal information. A firewall is a secure barrier that sits between your computer and the Internet that prevents hackers from accessing your information.

A firewall needs to be installed properly or it will not effectively protect you from online threats. In addition, like anti-virus software, your firewall should be kept up-to-date. This is easy to do with software that automatically updates the latest versions onto your computer.

Be aware of deceptive emails, pop-ups, and other online scams.

Online criminals will attempt to acquire your personal information by luring you to a website that looks legitimate, but is actually a fake site. If you receive any emails from an unfamiliar source, or any suspicious pop-ups, do not click on the links or open the attachment.

New online attacks are so advanced that they are capable of redirecting you to a fake website, even if you didn't click on anything. If a web page asks for you to provide sensitive information that it has never asked you to provide before, do not type anything and close the page immediately. Financial institutions and online service providers do not ask you to enter information such as your credit card number, full Social Security number, or PIN number on the login page or any subsequent pages.

As consumers become more educated about fraud and identity theft, online criminals are moving to other places to launch their scams. Phone scams are gaining popularity again. There are two common types of phone scams. The first type of scam involves an email detailing a problem with your account and requests you to call a specific phone number to provide more details. The second type of scam involves a phone call from an automated call center asking you for sensitive information. You should never provide personal information to an unsolicited caller. If you receive a call from an individual stating they are an EFCU employee, don’t give out any personal information. Instead, ask the individual for their extension, hang up, then call the main EFCU number at 850.862.0111 and type in the extension the caller gave you. Never call a number provided by an unverified individual unless you have confirmed the number is valid.

Mobile phones are another new target. For example, one scam involves sending a text message to your mobile phone claiming to be your financial institution or a credit card processor. If you receive such a text message and are unsure if it is a legitimate communication, call your financial institution's customer service center to verify that the message is genuine.

Guard your privacy and limit the amount of personal information you share online.

The growth of social networking sites has made it easier for online criminals to obtain information on you. This is a way for them to gather information to answer the challenge questions most online service providers require in order to enable access to your account or retrieve and change your password. Limit the amount of personal information you publicly share online.

Despite adopting all the appropriate security measures, online users still manage to fall victim to scams and have their identity stolen. In order to help ensure that you and your information stay safe, check your online account statements frequently. If you have fallen victim to online fraud, the sooner you know about it, the sooner you can act to block your accounts, and take corrective action. If you detect suspicious activity in your account, you should immediately contact your account provider for help.

To protect your account, we monitor your ATM and debit card transactions for potentially fraudulent activity which may include a sudden change in locale (such as when a U.S. issued card is used unexpectedly overseas), a sudden string of costly purchases, or any pattern associated with new fraud trends around the world.

If we suspect fraudulent ATM or debit card use, we will call you to validate the legitimacy of your transactions. Your participation in responding to our call is critical to prevent potential risk and avoid restrictions we may place on the use of your card.

• Our automated call will ask you to verify recent transaction activity on your card.
• You'll be able to respond via your touchtone keypad.
• You'll also be provided with a toll-free number to call should you have additional questions.

So that we may notify you as quickly as possible, it is important that EFCU has your cell phone number and accurate email address. Call 850.862.0111 x1402 or update your Contact Information by logging into your account via a browser or the EFCU Mobile App.

In the meantime, please be diligent in monitoring transaction activity on your account and contact us immediately if you identify any fraudulent transactions.

Here are some additional tips on protecting yourself from debit card fraud:

• Be Proactive with Alerts: When logged into your EFCU account via a browser or the EFCU Mobile App, under 'eServices', you have a choice of 29 alerts to help monitor your account activity.
• Unless absolutely required for a legitimate business purpose, avoid giving out your:
  
  • Address and ZIP code
  • Phone number
  • Date of birth
  • Social Security number
  • Card or account number
  • Card expiration date
  Your PIN is private; never give it out.
• In stores and at ATMs, always cover your card and PIN, and watch for:
  
  • Cell phone cameras, mirrors, or other tools used to view cards and PINs
  • People watching your transactions
  • Cashiers taking your card out of sight; take it to the register yourself
  • Any unusual activity at ATMs; if you feel uncomfortable, go to another ATM
• Online, you should never respond to unsolicited emails that:
  
  • Ask you to verify your card PIN or account number; such emails are not sent by legitimate businesses
  • Link to websites; such sites can look legitimate but may collect data or put spyware on your computer

Maximize your safety at ATMs with these tips:

• Keep your ATM/Debit card in a safe place. Memorize your personal identification number (PIN) - never write it on your card!
• Use ATMs that are well lit, are located in high traffic areas, and have mirrors so you can see who is approaching you from behind. At night, it is a good idea to have someone else with you.
• At walk-up ATMs, don't leave the keys in your car.
• At drive-up ATMs, keep your car locked.
• Use your body to shield the keyboard from view when entering your PIN. When you get money, don't count it in public view.
• Remember to take your card and receipt. Keep receipts until you have balanced your monthly statement.
• If you see something suspicious at an ATM, leave immediately and contact the police.
• Never enter your PIN in any ATM that does not look genuine, has been modified, has a suspicious device attached, or is operating in a suspicious manner.
• Be Alert to potential scams -We will never call or email you to verify your Eglin Federal Credit Union account information, such as your password and/or PIN number.

Is the mobile app secure?
The mobile app uses SSL encryption to communicate securely throughout the entire process of accessing your accounts.

How long does each login session last?
Each login session lasts 20 minutes from the beginning of the session. The timer is not reset with activity.

How can I further protect my account information?
Protect your account information by taking additional steps: - Use the screen locking feature of your mobile device. - Never save your account number on your mobile device. - Always use the Logout feature of the mobile app. - Request a password change if your device is lost or stolen. - Read "Make Your Smartphone Safe" on this page to learn more about securing your mobile device.

As technology evolves, so unfortunately do the ways that criminals can illegally access your personal information. Smartphones give us a lot of freedom and make our lives more efficient, but they also present their own set of challenges when it comes to data security. However, there is no reason why you can't make yourself more secure with a few key habits.

Hold on to it!
When you are in a public area, don't set your phone down or leave it exposed in an open bag. It only takes a second for a thief to walk off with your little lockbox of personal information. If a stranger asks to borrow your cell phone, offer to help them find a public phone they can use instead.

Lock it up
Whether it's with a password or a thumbprint, using a unique entry requirement will make it difficult or impossible for anyone else to enter your phone's data. It might be an inconvenience now, but if you lose your phone or have it stolen, you'll be glad to know the person who has your phone doesn't also have free reign over your sensitive data. Make your password tough to guess for even someone who knows you well.

Slow down a bit
When you're pinballing around between apps, the internet, your text messages and any number of other items, there's a tendency to click without a lot of thought. But like with your other computers, it's important to be very careful about the links you click on. If you don't recognize the sender of a link in a text message or email, or even if you aren't 100% sure about the origin of a link, you're better off leaving it alone.

Use extra security
While you're loading up on games, tools and other cool apps, be sure to also get yourself some security software designed for smart phones. On top of that, check regularly for updates that will keep you ahead of the criminals trying to pry into your phone. Remember though that you should always check to make sure anything you download to your phone is from a trusted source and has been reviewed for problems by other users.

Be network careful
If you're tech savvy, you may know that you can potentially save money by using a public wi-fi network when it's available instead of your phone's data service. However, it's best to avoid using these networks when you plan to access sensitive information of any kind.

Mind what's in your phone
With smartphones likely becoming more and more inextricably intertwined into your life, it may seem like it makes sense to keep your account numbers, passwords and other hard-to-remember information in a notepad document on your phone for easy access. But you should consider this only as safe as having the same information on a piece of paper loose in your pocket; it could very easily end up somewhere you don't want it to be.

Clean it up before you turn it in
When you trade in an old phone, use a "wipe" app and reset your device to the factory default settings to avoid sending a treasure chest of your data out into the world. Also check to see what kind of precautions phone recyclers use to prevent stolen information.

In case it is stolen
You may at some point find your phone gone despite all your best efforts to keep it in your possession. But it doesn't have to stay missing. If you download a "Find My Phone" app ahead of time, you can use this handy tool to figure out where your phone has found its way to. In a similar vein, an erase app installed before your phone absconds can remotely wipe the data from your phone before it falls into the wrong hands. No matter what precautionary measures you have taken, though, you need to contact your wireless provider immediately if you lose your phone.

Information security for your smartphone isn't that different from keeping your other repositories of data safe. By taking a few basic steps now, you can save yourself some major problems later on.

We are committed to taking reasonable steps to protect the security of our member's financial information in all areas of our operations. Therefore, when providing access to your financial information over the Internet, we practice the following security measures:

1. The Credit Union maintains a firewall system that protects our Web server from unauthorized access.
2. We use EV-SSL (Extended Validation Secure Socket Layer) technology to encrypt all traffic (including account numbers, PINs, and financial data) that is sent between your computer and our online banking system. A new encryption key is generated every time you log into your EFCU account online. Please note that the information is not encrypted once it resides within your computer.
3. To gain access to your account online via Online/Mobile banking, we require a unique Username and strong Password. After a series of consecutive failed attempts, the account will be locked for your protection.
4. A session-only cookie is transmitted to your computer when you successfully log in to your EFCU account online. The cookie contains a number that is unique to every session and every member. While you are logged in, it is used to verify your access to information. When you either logout, close your browser, or allow the inactivity timer (see below) to expire, this session-only cookie values becomes invalid. EFCU recommends that you log out and/or close your browser every time you are finished accessing your financial information online. We do not recommend leaving your computer unattended and allowing the inactivity timer to expire. In order to access your account online via a browser or the EFCU Mobile App you will need to enable session-only cookie support for eglinfcu.org.
5. An inactivity timer automatically breaks your connection after several minutes of inactivity. This prevents you from accidentally leaving active connections to your account after you have completed your transactions.
6. The Credit Union uses a Multi-Factor Authentication system to further verify your identity when you access your account information online. Members are prompted to select and answer three secret questions to establish their identity. The questions will appear when there is a challenge situation, for example; you log in from an unfamiliar location. You may also elect to receive a text or voice call containing a two-step verification code instead.