Strong passwords are essential in practicing online security and protecting your information. Strong passwords are those that include uppercase and lowercase letters, numbers, and special characters, and are at least twelve to fifteen characters in length.

Remember to never write down, share, or store your passwords overtly. Instead, use a secure password manager to organize and keep track of your passwords. Never use the same password for multiple accounts. Don’t give passwords or PINs to anyone. The State Bank will never ask you for your password over the phone, in person, or via email.

It is important to update your passwords frequently, set up multi-factor authentication, and enable biometric login when available.

Phishing refers to a type of social engineering attack, in which a cybercriminal sends deceptive emails in an attempt to infect a user’s device with malware and/or obtain personal information, such as credit card numbers, login credentials, and other sensitive material.

• Phishing emails are frequently centered around current events, like the COVID-19 pandemic; or sent at specific times of the year, such as tax season.​
• It is important to always think before you click, especially if the sender appears suspicious or if you were not expecting the email. Practice hovering your mouse over hyperlinks to see where they are really taking you.​
• These messages often use verbiage that creates a sense of urgency, so that the user is more likely to panic and act quickly on the fraudster’s requests.
• Always be cautious when opening attached files as they can potentially have malicious programs embedded in them just waiting to be run by an unsuspecting user.

To learn more about how to spot a social engineering attack and how to avoid them, visit the United States Cybersecurity and Infrastructure Security Agency (CISA) website and review their tips on Avoiding Social Engineering and Phishing Attacks.

Business email compromise (BEC)—also known as email account compromise (EAC)—is one of the most financially damaging online crimes. It exploits the fact that so many of us rely on email to conduct business—both personal and professional. In a BEC scam, criminals send an email message that appears to come from a known source making a legitimate request, like in these examples:

• A vendor your company regularly deals with sends an invoice with an updated mailing address.​
• A company CEO asks her assistant to purchase dozens of gift cards to send out as employee rewards. She asks for the serial numbers so she can email them out right away.
• A homebuyer receives a message from his title company with instructions on how to wire his down payment.

Versions of these scenarios happened to real victims. All the messages were fake. And in each case, thousands—or even hundreds of thousands—of dollars were sent to criminals instead. In these instances, a scammer might:

• Spoof an email account or website.
  • Slight variations on legitimate addresses (john.kelly@examplecompany.com vs. john.kelley@examplecompany.com) fool victims into thinking fake accounts are authentic.​
• Send spearphishing emails.
  • These messages look like they’re from a trusted sender to trick victims into revealing confidential information. That information lets criminals access company accounts, calendars, and data that gives them the details they need to carry out the BEC schemes.​
• Use malware.
  • Malicious software can infiltrate company networks and gain access to legitimate email threads about billing and invoices. That information is used to time requests or sends messages so accountants or financial officers don’t question payment requests. Malware also lets criminals gain undetected access to a victim’s data, including passwords and financial account information.​

Learn more on how to protect your business against fraudulent requests

Voice phishing, or Vishing, is a social engineering scheme, that aims to gather personal and confidential information using verbal scams.

If you suspect that you might have received (or are on) a vishing call, it is always best to hang up and verify legitimacy by calling an official, public phone number of the company in question. Like phishing, vishing calls may evoke a sense of panic, and attackers will attempt to persuade their victims to provide sensitive, personal material over the phone.

Cybercriminals may even leverage programs that can create bogus phone numbers using local area codes and numbers, or ones that resemble a reputable organization’s business number.

FEDERAL TRADE COMMISSION’S NATIONAL DO NOT CALL REGISTRY

You may also wish to register for the Federal Trade Commission’s National Do Not Call Registry which will greatly reduce the telemarketing calls your number receives, and help you spot a possible vishing attack.