Identity Theft/Online Security

Multi-Factor Authentication and Secure Access Code
Charlevoix State Bank Online Banking uses multi-factor authentication to protect your accounts from unauthorized access. Due to their increased complexity, authentication systems using a multi-factor configuration are harder to compromise than ones using a single factor. You will need to provide your username and password along with a secure code to access your account. This secure code is a virtual token that identifies the device you are using to access your account. We only deliver secure codes via text, phone or email based on information you provide during enrollment. It is important to provide accurate contact phone numbers, mobile phone number, and E-mail address to ensure delivery of secure codes.

Username and Password
Your username and password are the first line of defense and act as unique identifiers for your personal or business account. Avoid using passwords such as your birth date, name, address, or Social Security number. Use a combination of upper and lowercase letters, numbers, and special characters. Do not share this information with anyone. Identity theft and fraud attempts are usually conducted with someone the victim knows.

Do not allow your computer or a public computer to “save” or “store” your password. Allowing your computer to remember login information gives anyone with physical access to your computer the ability to log in to your accounts.

Secure Messaging
With Charlevoix State Bank’s Online Banking system you are able to securely communicate with Customer Service via our Secure Messaging system.

• Make sure you are using up-to-date virus and malware protection.
  
• Install patches and updates regularly.
  
• Install and update firewalls.
  
• Do not use the automatic log-in feature on your devices.
  
• Do not plug unknown or unfamiliar USB drives, DVDs, etc. into your computer.
  
• Do not save credit or debit card, bank account, or other financial information on your computer, phone or tablet.
  
• Use a password on mobile devices. Set your devices to automatically lock after a period of time and turn on encryption to ensure no one can access your smartphone, tablet or laptop.
  
• Be aware of the location of your mobile devices (smartphones, tablets) at all times. Log on to financial websites only when you have a secure Internet connection.

Social engineering is the act of tricking people to obtain their personal or confidential information. The types of personally identifiable information criminals want varies. Typically, these bad actors try to trick unsuspecting individuals into giving them their passwords or financial information. They also want to trick their victims into installing malicious software, known as malware, to gain control over their computers.

Anyone can fall into the trap of cleverly designed social engineering tricks. Learning how to spot all types of social engineering attacks is the first step to avoid being tricked.

What are the types of social engineering attacks?

Phishing: Phishing attacks occur when scammers send emails to “fish” for information. These messages are intended to look identical to ones from trusted sources like organizations and people you know.

The message attempts to use your emotions against you to instill fear, excitement or urgency into revealing sensitive information by clicking on links to malicious websites or opening attachments that contain malware.

Once the malware is installed, criminals can redirect you to their controlled site to trick you into giving up your information. This is also known as “pharming.”

Vishing: This is when a legitimate phone number has been spoofed. This trick is commonly used on businesses. Scammers will contact a company’s front desk, customer service, HR or IT and claim to need personal information about an employee.

Smishing: Smishing is like vishing, but the scammer sends text messages instead of calling. Scammers purchase spoofed phone numbers to blast out messages containing malicious links.

In-person: This occurs when a scammer tricks an employee to let them into an area they don’t have access to.

Also known as "piggybacking," scammers may be dressed as delivery drivers, say they forgot their ID or pretend that they’re “new” to enter a restricted area. Once inside, they can spy on people, access workstations and more.

Tips to protect against social engineering attacks

1. Carefully check emails for errors.

If you receive a suspicious email, check for spelling and grammar mistakes. Also, be on the lookout to make sure any hyperlinks or the sender’s email address is the same spelling as the company they represent.

Be suspicious of any messages you’re not sure of. If the email looks like it is from a trusted source, do your own research. For example, use a search engine to go to the real company’s site or a phone directory to find their phone number.

2. Think before you click.

Phishing emails use an enticing and emotionally charged subject line to trick you into getting what they want. If you have a strong reaction to an email or online offer, take a minute to check in with your better judgment before proceeding.

Credible representatives will never make you feel threatened or demeaned, nor will they pressure you to act quickly. If an offer is too good to be true, it probably is.

Don't open email attachments from questionable sources. Even if you do know the sender and the message seems suspicious, it's best to contact that person directly to confirm the authenticity of the message.

3. Verify the identity of anyone you don’t know personally.

If you’re unsure of a person’s true intentions, it’s best to act upon your suspicions. Even when the sender appears to be someone you know, check with your friend or coworker before opening links or downloading attachments.

Also, be suspicious of any unwanted requests for your personal information. You can directly contact the bank they are impersonating to confirm whether the contact was legitimate.

It only takes one human error to become a victim of a socially engineered attack. And this vulnerability is the reason criminals are using social engineering techniques more often.