FNB Security Center

Overview:
Building on long-standing spoofing tactics, cyber criminals attack personal devices, such as a smartphones, to hijack legitimate apps where confidential data is stored. Scammers can break into a device after a user downloads an infected, or malicious, app. Once the device is infiltrated, the scammers may deploy virtual copies of other apps to capture the user’s credentials and information. Frequently, banking apps are targeted in this type of attack.

How to identify:
Malicious app attacks are almost impossible to detect after a device is compromised. Do not download apps from any source other than an official app store, such as Google Play or the Apple App store.

How to protect yourself:
Practice good device hygiene and take care to safeguard your device from potential threats. Make sure that your device is updated to the most current operating software. Consider employing reputable mobile security solutions and features like Google Play Protect. Most importantly, only download apps from official app stores, which employ vetting protocols to help protect users from malicious activity.

Overview:
Social Engineering is the method of intrusion or compromise that relies on deceptive interaction and manipulation to:

• Circumvent standard security procedures or protocols.
• Convince the target to provide confidential information.

How to identify:
The scammer may call, email or text, pretending to be from an organization you are likely to engage with, including popular retailers, government agencies or technology providers. The scammer may claim false information about a product or service to trick you into sharing account access or other personal information.

How to protect yourself:

• Always use caution and never provide personal information to an unknown contact.
• Confirm the authenticity of the message by using publicly available email addresses or phone numbers for the organization the individual claims to represent. Never use the contact information provided by the suspicious contact.
• Do not purchase gift cards unless they are intended as gifts for family and friends.
• Never send funds to unknown recipients via person-to-person payments (for example, Zelle®), cash or wire transfer payments.
• Use online and mobile banking tools to check your account regularly for unauthorized activity.
• Keep your operating system and web browser up to date.

Overview:
Phishing is an email, telephone or texting scam that typically involves an attempt to trick the recipient into taking some sort of action that will enable cybercriminals to perpetuate fraud. These may include:

• Sending an unsolicited attachment or link designed to install malware on the user’s computer.
• An attempt to trick the user into providing confidential information, such as account numbers or passwords.
• An attempt to convince the user to send money or other financial instruments such as gift cards.

How to identify:

• Cybercriminals send email messages designed to trick you into opening an attachment or clicking on a link that installs malware on your computer or mobile device or attempts to steal your account credentials (i.e. user IDs and passwords).

How to protect yourself:

• Do not click on any links within an unexpected email and do not open unsolicited email attachments.
• Ignore and delete emails that ask for sensitive or personal information.
• Keep your computer and mobile phone up to date with recent updates and patches.

Overview:
Smishing is the fraudulent practice of sending text messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords or credit card numbers. These text messages may include:

• A link to a malicious website.
• An attempt to trick the user into providing confidential information, such as account numbers or passwords.
• An attempt to convince the user to send money or other financial instruments such as gift cards.

How to identify:
The scammer will use SMS text and send messages appearing to be from a legitimate individual or organization. Attackers want the recipient to open a URL link within the text message, where they then are led to a phishing tool prompting them to disclose their private information. This phishing tool often comes in the form of a website or app that also poses under a false identity.

How to protect yourself:

• Urgent messages or limited time offers are signs of possible smishing.
• Contact the bank or organization directly, using your bank's contact information from your monthly statement or the back of your debit card, if a message requests account or personal information.
• Do not click on a link within an unsolicited text message.
• Always use publicly available contact information when contacting your bank or financial institution. Do not use the contact information provided in a suspicious call, text or email.
• Do not reply to any suspicious text message (even to request that they "STOP" sending text messages) because it will alert the attackers that they have reached an active phone number.

Overview:
Vishing is the fraudulent practice of making phone calls or leaving voice messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as bank details and credit card numbers. These calls/messages may include:

• A callback number to a fraudulent call center.
• An attempt to trick the user into providing confidential information, such as account numbers or passwords.
• An attempt to convince the user to send money or other financial instruments, such as gift cards.
• An attempt to permit the actor access to the user’s computer.

How to identify:
Criminals place phone calls and inform you that your card has been locked, blocked or restricted due to potential fraud. In order to release the hold, you are directed to enter your card number, expiration date and PIN (or other sensitive financial or personal information).

How to protect yourself:
Financial Institutions, including First National Bank, will never call you and ask you for your card number, expiration date and PIN or other sensitive personal or financial information. If you receive a call requesting personal information, hang up and call your financial institution’s customer service number (using the phone number on your monthly account statement or the back of your card, not the phone number in the email) or visit a local branch.

Overview:
Spoofing is the practice of deceiving users by masquerading as a trusted individual or source. Websites, email addresses, IP addresses and online identities can all be “spoofed.”

“Spoofing” aims to trick the target into providing confidential information, taking action based on the instructions provided by the hacker or to redirect users to a fraudulent site that appears to be legitimate.

How to identify:
Spoofing attacks often attempt to get you to visit a fraudulent website by clicking on a link or attachment sent to you through email or text. Additionally, some spoofing occurs when you mistype the website address (URL) for your financial institution and visit a fake site.

How to protect yourself:

• Do not click on links in unsolicited text messages or emails.
• When typing in your financial institution's website address (URL), always be sure you are using the correct address as it is listed on your official account materials.
• Do not enter sensitive personal or financial information into an unfamiliar website or screen.
• Close out any screens or windows that ask for your information (even after you've successfully logged in).
• Keep your computer and mobile phone up to date with recent updates and patches.