Protecting Your Information is Our Priority

Unfortunately, threats to information security are increasingly part of everyday life for the customers we serve. Today more than ever, you need to know how to protect yourself against Internet and e-mail hazards like phishing, spyware, viruses, spam and more. Below, you will find useful information and education on ways you can take control to safeguard your identity, money, privacy and property.

If You Suspect Fraud

If you suspect fraudulent activity related to your accounts, contact us immediately at FNBCustomerService@fnb-corp.com or 800-555-5455. Remember that you are also able to block your FNB Visa Debit Card using CardGuard™ through Online or Mobile Banking if at any time you believe your card information may have been compromised.

Security Topics

Unfortunately, during times of turmoil some people may use this as an opportunity to take advantage of others. If you need assistance with your finances, please contact us at the number on the back of your card, on your billing statement, or on written correspondence from us. Please know that we will not contact you via phone or text messaging to request sensitive personal information such as your Social Security Number, Account Number, or Debit Card Number.

Apache Log4J Vulnerability
On December 9, 2021, a vulnerability was disclosed by the security community for Apache Log4j on versions from 2.0-beta9 to 2.14.1 that could allow for an attacker to perform a remote code execution against impacted environments. The security community rated this vulnerability as critical, with immediate actions needed to mitigate potential risk. An updated version of Apache Log4j (v2.15.0) was released on December 10, 2021, and subsequently on December 14, 2021, another version (v2.16.0) was released.

FNB is assessing its environment and taking actions to remediate any identified instances by applying the recommended mitigation technique or implementing the latest version through patching. FNB's cyber security team continues to proactively monitor our environment for attack indicators, ensuring prevention and detection systems also are updated with the latest detection techniques. At this time, FNB has not identified any FNB systems that have been compromised by this vulnerability.

FNB recommends following the guidance from the Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) or Apache to implement the recommended patches or mitigations.

OCC Warns of Unauthorized Bank
The OCC has issued an alert that an entity using the name “FNB” is misrepresenting itself as a national bank and is calling and texting consumers in an attempt to obtain sensitive information. For example, consumers have reported receiving text and voice messages from “FNB” stating that a loan has been approved with a request for a follow-up phone call. If you receive a message from “FNB,” do not respond. This fictitious entity is not a licensed or chartered bank and is not affiliated with a legitimate financial institution. For additional information, including what to do if you believe you have been a victim of this scam, see the OCC alert.

Social Engineering Schemes
FNB has observed an increase in social engineering fraud attempts. In these phishing scams, you may be called, emailed or texted by someone pretending to be from an organization you are likely to engage with, including popular retailers, government agencies or technology providers. The scammer may claim false information about a product or service to trick you into sharing account access or other personal information. For example, he or she may tell you that a payment error has occurred and an account number is needed for reimbursement, that funds need to be mailed or transferred at once or that you need to purchase gift cards and provide him or her with the numbers.

If you receive a similar call, email or text, be aware of the following best practices:

• Always use caution and never provide personal information to an unknown contact.
• Confirm the authenticity of the message by using publicly available email addresses or phone numbers for the organization the individual claims to represent.
• Do not purchase gift cards unless they are intended as gifts for family and friends.
• Never send funds to unknown recipients via person-to-person payments (for example, Zelle®), cash or wire payments.
• Use online and mobile banking tools to check your account regularly for unauthorized activity.

If you believe that you have been the victim of a phishing scheme or if you identify potential fraudulent activity on your account, notify local law enforcement immediately and contact our Customer Service Center to file a report.

SolarWinds Security Breach – December 2020
SolarWinds, a leading provider of IT infrastructure management software, recently experienced a significant security breach. FNB is closely monitoring the situation. We have reviewed our systems infrastructure and we are currently not aware of any systems or customer impact caused by the SolarWinds breach. For additional information, we encourage you to review the security advisory and FAQs that SolarWinds has published on their website.

COVID-19 Phishing Scheme
The FBI's Internet Crime Complaint Center (IC3) has warned of a phishing campaign delivering spam that uses fake government economic stimulus checks as bait to steal personal information from potential victims.

Be on the lookout for phishing emails asking to verify personal information in order to receive an economic stimulus check from the government, the alert said. Government agencies are not sending unsolicited emails seeking private information in order to send money.

Similar campaigns might ask potential victims for donations to various charities, promise general financial relief and airline carrier refunds, as well as try to push fake COVID-19 cures, vaccines and testing kits.

Other active phishing attacks are taking advantage of the COVID-19 pandemic to infect victims with malware and harvest their personal information through spam impersonating the Centers for Disease Control and Prevention (CDC) and other similar organizations, such as the World Health Organization (WHO).

The FBI adds that scammers are trying to sell products claiming to prevent, treat, diagnose or cure the COVID-19 disease, as well counterfeit sanitizing products and personal protective equipment, including but not limited to N95 respirator masks, gloves, protective gowns, goggles and full-face shields. 

Possible COVID-19-themed scams and attacks as highlighted by U.S. Attorney Andrew Murray include:

• Individuals or businesses selling fake cures for COVID-19
• Online offers for vaccinations and test kits
• Phishing emails or texts from entities posing as the World Health Organization (WHO) or the Centers for Disease Control and Prevention (CDC)
• Malware inserted in mobile apps designed to track the spread of COVID-19 that can steal information stored on devices
• Malicious COVID-19 websites and apps that can gain and lock access to devices until a ransom payment is made
• Solicitations for donations to fake charities or crowdfunding sites

To report COVID-19 Fraud, contact the Disaster Fraud Hotline 866-720-5721 or email disaster@leo.gov. You can find more information on the National Center for Disaster Fraud webpage.

Caller ID Spoofing
Please be aware of spoofing scams in which a caller intentionally falsifies or disguises a caller ID to appear as someone they are not. Scammers may act or say they are with a legitimate organization, including as a representative of a financial institution, to get you to respond with personal information they can then use to engage in fraudulent activity such as stealing your identity or money.

First National Bank will never call, email or text you to request personal information such as Personal Identification Numbers (PIN numbers) or passwords. For additional information, visit the FCC’s website for more information. 

Use caution at all times and never answer calls from unknown numbers, respond to questions or provide personal information of any kind. If you suspect the call might be a spoofing scam, hang up immediately and call the company or government agency the caller claimed to represent to verify the authenticity of the call/request. 

Text and Email Scams
Be aware of phony text and email messages to customers and non-customers appearing to come from First National Bank. These messages often reference irregular/unauthorized account activity, or inform you that your profile has been accessed from a different device. These messages also request that you review/update your profile and include a link to enter personal information. These texts and emails are not legitimate First National Bank communications. First National Bank will never request personal or confidential data such as account numbers or passwords via email or text. Recipients should not respond to these types of messages or click any links contained in them.

Update Your Operating System and Web Browser
For the optimal and most secure Online and Mobile Banking user experience, remember to always use the most up-to-date version of your operating system or browser.