Coastal Heritage Bank was made aware of a trend in the online banking industry which has resulted in an increase of fraudulent payments in the Person to Person (P2P) network space at other banks. We have been informed this is common in Zelle, a fund transfer service currently offered to our consumer customers. In the vast majority of reported cases, online banking platforms are sending one-time passcodes to the customer, and through a series of social engineering and pre-texting initiatives, fraudsters are successfully obtaining the one-time code needed to complete the payment.

Many times, the fraudster is also spoofing the financial institution’s phone number or pretending to call from the bank’s contact center. Fraudsters either have online banking credentials already through other means (social engineering, other site breach using same credentials, malware, etc.) or are using the forgot password functionality and are convincing the user the process is done to help “validate themselves.” The calls are often regarding a fictitious transaction and the fraudster calls from the banks phone number pretending to be the banks fraud department.

Coastal Heritage Bank would like to remind you that we will NEVER call or text you asking for one-time codes. One-time codes will only be presented to you for activity that YOU have initiated.

We would like to take this time to encourage separate passwords for online banking and personal email. For best protection, have separate, randomly generated passwords for all of your sites. Fraudsters will commonly obtain credentials from other online portals or black-market sales which originated from other sites and then try those same credentials in online banking.

If ever in doubt regarding a phone call, it’s best to hang up and call us back at a phone number posted on our website, 800-695-1300.

An increase in telephone scams including individuals claiming to be from a “Bank Fraud Department” has been recently noted.

In one instance the fraud scheme was initiated through an email that the individual received from a fictitious “PayPal” email address alerting the individual that a substantial charge was going to be processed against the individual’s bank account. The PayPal email directed the customer to call a fictitious PayPal phone number if they did not authorize the charge. The individual called the fictitious PayPal phone number and the representative told them that they would be receiving a call from the Bank Fraud Department to resolve the issue. Once contacted by phone the fraudulent “representative” then probed for additional private financial information.

Please be aware and always be on guard to protect your private information.

A few important points to keep in mind:

• Neither the Bank nor the fraud department will ever ask customers over the phone for their PIN, CV2 codes or Expiration Dates.
• A text alert warning of suspicious activity on a card will NEVER include:
• A link to be clicked. Cardholders should never click on a link in a text message that is supposedly from the Bank.
• Vague reference to a “Merchant” transaction; details should be included
• Requests for cardholder data such as card numbers, PINs, CV2 Codes, Expiration Date
• A text alert from the Bank will always be from a 5-digit number and NOT a 10-digit number resembling a phone number.
• A valid notification will provide information about the suspect transaction and ask the cardholder to reply to the text message with answers such as ‘yes’, ‘no’, ‘help’, or ‘stop’.
• A phone call from one of our Call Center agents will only include a request for the cardholder Zip code, and no other personal information, unless the cardholder confirms that a transaction is fraudulent.
• Only then will the cardholder be transferred to an agent, who will ask questions to confirm the cardholder’s identity before going through the transaction history. If, at any point the cardholder is uncertain about questions being asked or the call itself, they should hang up and call us directly.
• If a call is received by a customer, claiming to be you’re the Bank’s Call Center and asking to verify transactions, no information should have to be provided by the cardholder other than their Zip code, and a ‘yes’ or ‘no’ to the transactions provided.

For additional information please visit: https://coastalheritagebank.com/2017/09/07/be-aware-phone-scams/

Please keep in mind Coastal Heritage Bank will never contact you without you first initiating a request.

October is cyber security month in the U.S., and in recognition of that, we are going to take some time over the next few weeks to explain some basic threats and terms that everyone needs to know to keep themselves safe online.

Let’s start with “phishing”.

There are many different types of fishing: deep sea fishing, ice fishing, fly fishing… you get the point. But today, we want to talk about phishing with a “ph”—and the related problem of “spear phishing.”

Phishing is when a fraudster sends you texts, emails, or other messages with the intent of tricking you into responding in some way. He will often include a malicious attachment or link in the message. If you open the attachment or click on the link, the scammer can gain access to your device.

From there, the possibilities are endless. He can install ransomware that will lock you out of your computer. He can steal your data or install software that allows him to track all of your activity, including the passwords you enter. He can gain access to your bank accounts, credit cards, and the most personal info you have stored.

Spear phishing is a more personalized version of the same scam. In this case, instead of receiving an email from a random individual, the scam artist will send you a personalized message that appears to come from a trusted source. It could look as though it comes from a friend, a business partner, a social media acquaintance, or even your bank. There are many variations of the scam, but the scam artist will often tell you a story to trick you into giving up your private information. For example, the fraudster may:

• Say he’s noticed suspicious activity on your account and wants you to verify your information
• Include a fake invoice
• Offer a government refund or claim you won a prize

So what are the warning signs of such scams?

Phishing messages often look legitimate—as though they came from a person or company you know. It’s easy to spoof a logo, and scammers will often make their messages look like they are from a trusted source.

• They will ask you to click on a link or open an attachment.
• They may ask for you to provide passwords, bank account numbers, or other confidential information.
• They will use fear to try to pressure you to act quickly. They may threaten to close your account, fine you, or even have you arrested if you don’t move quickly.

What can you do?

Protect your devices by using anti-virus and anti-malware software. Set the software to update automatically.

Don’t assume that a message that looks like it is from a friend or business associate is real. Call or email the person or company to confirm before ever clicking on a link or opening an attachment.

Most importantly, if you have any doubt—don’t click.

If you have been a victim of this online scam or any other fraud, report it to the FBI’s Internet Crime Complaint Center at www.ic3.gov or call your local FBI office.

FBI Portland
Beth Anne Steele
(503) 460-8099