Internet Security
The Internet is one of the most powerful communication tools available, making it possible to share information instantly, any time of the day or night, around the globe.
Criminals have capitalized on the broad power and wide availability of the Internet and electronic mail (e-mail) to defraud unsuspecting people. It is critical that each of us maintain constant vigilance over the way we use the Internet and all forms of electronic communication.
The Bank of New York Mellon maintains active oversight of all of our systems as part of our efforts to protect the security and privacy of client information.
If you have any concerns or questions, please contact your The Bank of New York Mellon representative or send a message.
The Bank of New York Mellon does not contact its clients or anyone else by e-mail to confirm credit card or financial transactions, or to confirm or request personal account information or any other type of sensitive information.
Protect Yourself
To help protect yourself and your personal data, do not trust any e-mail communications that request your personal information.
Criminals can be convincing. They make their fraudulent e-mails look like they come from legitimate sources. They publish fake Web sites that use designs, information and programming stolen from their rightful owners. Don't fall for their ploys.
E-mail and Web Site Scams
E-mail is by far the most popular way for criminals to try to get your attention — and your personal information. An e-mail may direct you to a Web site designed and operated by criminals to trick you into revealing such information. Therefore, treat e-mail from someone you don't know the same way you would treat a telemarketing call from someone you don't know: don't necessarily believe what you're being told.
Fraudulent e-mails and Web sites are created every day to attempt to steal personal information. It's called "phishing" — a variation of the word "fishing." There are limitless variations of these online scams, so the best defense is education and a healthy dose of skepticism. A few misleading and deceptive techniques in use include the following:
- The e-mail or Web site may appear to be genuine.
- It may include a logo that appears legitimate.
- It may ask you to click on a link to go to a Web site — the Web site address may, at first glance, appear legitimate and imply importance.
- The e-mail or Web site may ask for you to supply account numbers, Social Security numbers, personal identification numbers (PINs), passwords or credit card numbers.
- The e-mail or Web site may even already contain some of this information and is asking you to confirm the data.
- You are right to be suspicious of any e-mail or Web site asking you to supply or confirm any personal information.
As technology and one's ability to detect these scams improves, so, unfortunately, do the criminals. The latest attacks do not even require you to do anything. Merely opening the e-mail can launch "hidden" software — a virus, "spyware" or other malicious code — that will download to and reside on your computer. Should they go undetected, any of these programs could compromise your computer in a variety of ways, including stealing private information, redirecting your Web surfing to unscrupulous sites and transmitting information that you type on your computer directly to the criminals. Therefore you should delete all unwanted and potentially fraudulent e-mails without opening them.
Some fraudulent e-mails, spear-phishing attempts for example, can be very well done and very convincing. These are often created by more sophisticated and more determined criminals who are highly motivated to succeed. More generally, however, most fraudulent e-mails and Web sites established for fraud may frequently be characterized by the following:
- Misspellings and other typographical errors
- Poor grammar
- Urgent messages in the e-mail subject line
- Random characters in the e-mail subject line or body
- "Fuzzy" logos, or logos that are distorted
Tricks of the Trade
There are a number of common e-mail scams of which you should be aware. While this list is by no means exhaustive, recent e-mail tricks include:
- Creating a sense of panic. E-mails threatening loss of account access, loss of credit, foreclosure, etc., are trying to get you to panic enough to lose your common sense and fall for their scam. Don't panic; when in doubt, call your financial institution.
- Referencing a recent transaction. Vaguely worded e-mails referring to a "recent transaction" that you need to go online and verify, or for which you need to provide additional account information, are also just trying to get you to fall for their scam.
- Confirming your account information. It's possible that the criminals think they already have your account numbers, password, etc., and all they need is your confirmation. They could have guessed, they could have bought it, they could have stolen it. Don't give them the help they need to use it. Do not respond to confirmation-of-information requests received via an e-mail that you are not expecting or that could possibly be fraudulent. This includes both not responding via e-mail and not visiting a Web site to confirm the information.
- You're a winner! "Just send money to cover the costs/fees/taxes and you can claim your prize." If you do respond to this solicitation, the thief will have your money as well as your credit or debit card information if you pay online, or your checking account number and bank routing information if you pay by check. A legitimate contest will never make you pay to receive the prize.
- Your donation is needed. Many criminals act like they are actually charities and request your donations, appealing to your emotions and taking advantage of tragedies and natural disasters. Be careful when making charitable donations. Many legitimate organizations now accept donations online. But exercise caution and only donate via a non-profit organization's Web site directly, or if you are absolutely sure of the company through which you are donating.
Web Site Spoofing
"Spoofing" is another trick used by criminals. Criminals steal a Web site's code — the technical programming that makes the Web site work — and use it to create a fake Web site that "spoofs" or appears to be the legitimate site.
The difficulty for unsuspecting consumers is that these sites look legitimate. To help protect yourself, be aware of how you're accessing the site.
- Don't follow a link in an unsolicited e-mail if you have any doubts about the sender (see "phishing", above).
- Type all Web site addresses carefully, or use Favorites or Bookmarks to store frequently accessed sites — especially financial-related sites. Misspelling, even by one letter, the address of the Web site you are trying to access may send you to an incorrect, possibly fraudulent, Web site.
Lottery / Sweepstakes Letter Scams
If you receive a letter, accompanied by a check with a The Bank of New York Mellon brand, that claims you have won a lottery, a sweepstakes, have been chosen to be a paid "secret shopper" or a similar variation of a popular contest, be advised that these are scam letters and fraudulent checks. If you contact the sender as requested, you will be instructed to negotiate the check and forward the sender money through a wire transfer or money order. Please do not negotiate these checks, as they are not authentic The Bank of New York Mellon checks. If you receive one of these letters and/or checks, you should report it to your local U.S. Postal Inspection Service.
What You Can Do
Report any problems regarding The Bank of New York Mellon to your customer service representative. You also may e-mail your concerns or questions.
If you should become a victim of identity theft, you can take the following actions to help you protect your personal and financial interests:
Contact your bank and credit card issuers to ensure that:
- Access to your accounts can be protected
- All transactions are actually yours
- Your address information has not been changed
- Your PINs have not been changed
- New checks have not been ordered by the identity thief
File a police report with your local police department and provide the facts and circumstances surrounding your loss. Obtain a police report number with the date, time, police department, location and name of the police officer taking the report or involved in the subsequent investigation. Having a police report on file will often facilitate your dealings with insurance companies, banks, credit card agencies, and commercial establishments that may be parties involved in fraudulent transactions. The police report may initiate a law enforcement investigation into the loss with the goal of identifying, arresting, and prosecuting the offender and possibly recovering your lost items. The police report will also help provide immediate clarification should someone assume your identity and be arrested for criminal activity using your name and biographical data.
Contact the three major credit bureaus (listed below) to order copies of your credit report, and to report identity theft.
|
Equifax
PO Box 105069 Atlanta, GA 30349 To order a credit report: +1 800 685 1111 To report credit fraud: +1 800 525 6285 http://www.equifax.com/ |
Experian
PO Box 2002 Allen, TX 75013 To order a credit report: +1 888 397 3742 To report credit fraud: +1 888 397 3742 http://www.experian.com/ |
Trans Union
PO Box 1000 Chester, PA 19022 To order a credit report: +1 800 916 8800 To report credit fraud: +1 800 680 7289 http://www.transunion.com/ |
By ordering your credit report, you will be able to determine if the identity thief has opened any credit accounts in your name. You can then contact these creditors to let them know that your identity has been stolen, and that the accounts are fraudulent.
When calling to report fraud, request that a statement be placed on your credit report that indicates no further credit is to be granted in your name without first contacting you directly at the telephone number you designate. This is typically called a "Fraud Alert" or "Victim Statement", and will help prevent further accounts from being opened in your name.
Contact the Federal Trade Commission. The FTC maintains the Identity Theft Data Clearinghouse (the federal government's centralized identity theft complaint database), and provides identity theft victims with information. The FTC can be contacted through the following methods:
- Telephone: +1 877 ID-THEFT
Web site: www.ftc.gov/bcp/edu/microsites/idtheft/
If you discover that a fraudulent bank account has been set up using your name, report the account information to the following merchant check guarantee firms:
- Telecheck: +1 800 366 2425
- National Processing Company: +1 800 526 5380
- SCAN (Deluxe): +1 800 262 7771
- CheckRite: +1 800 766 2748
- CrossCheck: +1 800 552 1900
- Market Block List: +1 888 567 8688
Report improper use of your Social Security Number to the Social Security Administration (SSA) by contacting the SSA Hotline at +1 800 269 0271.
If your driver's license is stolen, report the theft immediately to your local Department of Motor Vehicles. Ensure that a duplicate license was not issued to the identity thief.
Maintain a log of what happened, what was lost, and all of the steps you took to correct the situation. Remember to record dates, times, phone numbers, people you spoke with, and any relevant reference numbers and information. Correcting an ID theft can be a long and difficult process — do not rely on your memory.
Businesses and Corporate clients should
- Proactively use account features that may protect their accounts, such as check cashing limitations and automated payment filters.
- Consider using positive pay features to limit check fraud
- Consider using debit blocks on disbursement only accounts
- Reconcile banking transactions on a daily basis
- Initiate ACH and wire transfer payments under dual control, with a transaction originator and a separate transaction authorizer
Business and personal customer also should employ best practices to secure computer systems in their homes and business including, but not limited to:
- Utilize strong passwords with at least 10 characters that include a combination of mixed case letters, numbers and special characters
- Do not share with others usernames and passwords for online banking systems
- Use a different password for online banking sites than you might use for email and other Internet activities
- Verify use of a secure session (https not http) in the browser for all online banking
- Do not "script" usernames and passwords for online banking to allow for automatic logins
- Install commercial anti-virus, desktop firewall, and intrusion detection software on all computer systems and apply updates regularly
- Ensure computers are patched regularly particularly operating system and key application with security patches
- Always activate the screensaver locking feature when you need to leave your computer unattended
- Limit administrative rights on users' workstations to help prevent the inadvertent downloading of malware or other viruses — create limited user accounts for daily use
- Where practical, carry out online banking activities from a stand-alone and locked down computer from which e-mail and Web browsing are not possible
- Never access bank, brokerage or other financial services information from public kiosks such as those found at Internet cafes, public libraries, and airports
Immediately notify us of any suspicious transactions, particularly ACH or wire transfers
E-mail Security
The Bank of New York Mellon actively works to protect the privacy and data integrity of sensitive client information while it is in our possession and control. In the course of providing services, we may exchange information with clients or their authorized representatives that is sensitive and confidential to the recipients. In order to protect this information when sending via e-mail, we will now encrypt e-mail communication by using a security protocol called Transport Layer Security (TLS).
TLS, an acronym for Transport Layer Security, is a feature of mail servers that encrypts the transmission of electronic mail from one server to another. Sending unencrypted messages increases the risk that messages can be intercepted or altered. TLS security technology is designed to protect confidentiality and data integrity by encrypting e-mail messages between servers and reduces this risk. TLS is a widely recognized standard issued by the Internet Engineering Task Force (IETF) for securing transmitted data and is now supported on most commercial mail servers.
Learn more about TLS: what it is, how it works, why it is important, and how you can install this security protocol on your organization's mail servers.
