Customer Fraud Protection

Customer Fraud Protection

At FirstBank, protecting our customers, their accounts, and personal information is one of our main priorities. These are just some of the many services we leverage to protect our customers:

• 24 hour fraud detection
• Customer education
• Customer payment and account controls and alerts
• Facial recognition and Touch ID biometric logins for iPhone and Android users

Types of Fraud and Fraud Mitigation

Phishing Emails and Text Messages

Fraudsters continually think up new ways to steal your personal information or to trick you into releasing this information. Fraudsters create look alike websites or use emails with malicious link. These tactics are ways fraudsters attempt to gather your personal information. Many of these attempts are convincing, as they may include legitimate company names and logos. Remember that FirstBank already has your personal information on file and we will not request this information unless you are already logged into our secure website.

If you receive an email or text message confirming a change on your account or payment that you did not do, or if you have given your personal or banking information out, please contact FirstBank immediately at 1-800-964-3444.

Spoofed Calls

Fraudsters spoof phone numbers to impersonate bank call centers to appear like your actual bank is calling. Once personal or bank information is obtained, the scammers use this information to reset account credentials and access online banking accounts.

What you need to know:

• Scammers claiming to be from FirstBank may call and say there is a fraud alert regarding suspicious account activity that they need to confirm with you.
• They may reference a fraudulent "pending charge" to make the call seem legitimate. They may also claim that unauthorized access to your online banking has occurred and they need to secure it.
• During the call, the scammer may ask you to provide your online banking user ID, password, answers to your online banking security questions, or for a one-time passcode (OTP) that was sent to your phone. Do not ever give personal information over the phone.
• FirstBank does make outbound service calls to our customers, when we call, we will NOT ask you to provide or verify your:
  • Full Social Security number
  • Card Personal Identification Number (PIN)
  • One-time passcode
  • Online banking user ID
  • Online banking password
  • Online banking security question answers

Imposter Scam

A recent "imposter scam" has increased within the banking industry. Unsolicited phone calls from individuals claiming to be from certain merchants (such as Amazon or Microsoft) will notify potential victims of a recent unauthorized purchase, pending account refund, or recent account access issues. The fraudsters then instruct the individual to contact the business' customer service to resolve the issue, and provide a phone number to contact. The number connects the individual with another fraudster who is also associated with the fraud scheme. Eventually, the fraudster gains access to the victim's computer and instructs the individual to log into their bank's online banking for further assistance. Once the fraudster has gained access, they can either steal funds directly, ask for card information to "fix" the issue, or continue to trick and influence the victim.

Tips to avoid this scam:

• Do not answer phone calls from numbers you do not recognize.
• Do not allow anyone to remote into your computer unless you contacted the company at a known and trusted phone number.
• Do not download software onto any computer, tablet or cellular phone that allows unknown individuals access to your personal devices.
• Reputable businesses such as Amazon, EBay, Microsoft, Apple, etc. will not request payments or re-payments in the form of wires, cryptocurrency, gift cards, or real-time payments such as Zelle®.

If you have given out your credentials or banking information, contact FirstBank at 1-800-964-3444 immediately to report the situation.

To learn more about imposter scams visit the Federal Trade Commission website.

Mobile Payment Scams

Imposters are continuously creating new ways to steal your money. That's why it's important to only send money using a mobile payment service like Zelle® to individuals and small businesses you know and trust. Mobile payment services should not be used to purchase certain goods and services, such as paying your utilities, purchasing tickets, buying items off of social media websites, or for purchasing pet insurance for that new puppy you just bought unless you know the person personally or have meet them in person.

Be aware of the current scams:

• Utilities Payments: Scammers are claiming to be from a utility company requesting payment due to a past due amount on your account. Scammers will threaten to shut-off your electricity if they do not receive payment immediately. If you receive a call, email, or text, immediately stop all communication. Call the utility company using the phone number on your bill. Utility companies DO NOT accept mobile payment services as a form of payment.
• Tickets: Scammers are placing ads to sell tickets to concerts, sporting events, and plays/musicals. Beware when purchasing tickets that are not through reputable ticket vendors, as many of these turn up to be fraudulent advertisements. Not only will you not be attending the event, but you will also be out your hard-earned money.
• Listing Items for Sale: Legitimate customers place ads on social media selling goods such as furniture, electronics, and appliances. A scammer contacts you and is interested in purchasing your item and asks if you have a mobile payment service account. The scammer will then send you a fake email that appears to be from a mobile payment service. This email is to confirm payment and includes messaging that you, the seller, must upgrade to a business account, at a cost, to complete the transaction. The email claims the cost to upgrade your account will be reimbursed once your transaction has processed. You then send money to upgrade your account expecting a refund, however the reimbursement, nor the funds promised for purchase of your listed item, are ever received.
• Puppy Scams: Scammers pose as reputable breeders looking to sell dogs, often at a large discount. Scammers target people looking for purebred dogs that do not want to pay full price. Once you send money to place a deposit or purchase the dog, additional requests will ask for money to cover shipping costs or to purchase pet insurance. You are not only out the dog you thought you purchased but also your money.

If at any time you feel you may have fallen victim to one of these scams, stop all communication and contact FirstBank at 1-800-964-3444.

Zelle® and the Zelle® related marks are wholly owned by Early Warning Services, LLC and are used herein under license.

Identity Theft

Identity theft is defined as the stealing of a person's financial information, especially name, address, mother's maiden name or social security number, with the intention of using that data to commit fraud.

Here are some tips to prevent Identity Theft:

• Never provide personal identifying or financial information during a telephone call you did not initiate.
• Never provide personal identifying or financial information over the telephone to anyone claiming to represent a contest or sweepstakes promotion.
• Never carry your social security card in your purse or wallet.
• Never have your social security number printed on your checks, driver's license or other financial documents.
• Never respond to e-mail or "pop-up" messages on your computer claiming some problem with a credit card, Internet or other account.
• Password protect all financial information when this option is available.
• Use a "cross-cut" shredder to destroy financial records.
• Use known, valid phone numbers to contact financial institutions, internet providers, etc.

Tax-Related Identity Theft

Tax-related identity theft occurs when someone uses your stolen personal information, including your Social Security number, to file a tax return claiming a fraudulent refund.

Know the Signs of Identity Theft: You may not know you're a victim of identity theft until you're notified by the IRS of a possible issue with your return. Be alert to possible tax-related identity theft if:

• You get a letter from the IRS inquiring about a suspicious tax return that you did not file.
• You can't e-file your tax return because of a duplicate Social Security number.
• You get a tax transcript in the mail that you did not request.
• You get an IRS notice that an online account has been created in your name.
• You get an IRS notice that your existing online account has been accessed or disabled when you took no action.
• You get an IRS notice that you owe additional tax or refund offset, or that you have had collection actions taken against you for a year you did not file a tax return.
• IRS records indicate you received wages or other income from an employer you didn't work for.

The IRS will Never:

• Initiate contact with taxpayers by email, text or social media to request personal or financial information.
• Call taxpayers with threats of lawsuits or arrests.
• Call, email or text to request taxpayers' Identity Protection PINs.

Investment Scams

Investment scams involve convincing you or your business to send money electronically or otherwise with the promise of a foolproof financial venture. The scammer may claim to be a stockbroker, portfolio manager, or other financial professional and offer one or more investment opportunities. They will typically promise high, often guaranteed returns on the investment with little or no risk. These scams can involve cryptocurrencies or other financial products and usually follow standard fraud techniques like Ponzi schemes, bait and switch, or others. The scammer may even have a fraudulent website to help them appear legitimate. To protect yourself and your money, always seek independent legal and financial advice from a trusted professional before investing with anyone you don't know.

Too Good to Be True

Fraudsters are clever and constantly devise new methods to commit fraud at your expense. There are a number of known payment-forwarding or payment-scams. These scenarios typically involve online job seekers who are asked to accept payment into a personal bank account and then forward or transfer money from this personal account to another bank account. As payment for this "service," the job seeker is instructed to keep a small percentage of the original money. Common sense in these cases is often the best protection: "if it sounds too good to be true, it probably is."

Business Email Compromise (BEC)

A business email compromise is a sophisticated online crime where criminals send email messages that appear to come from a known source making a legitimate request. Scammers will gain access to an email account and intercept email threads regarding billing, invoices, title, and real estate. The information that is gained is used to send a request using an email address with slight variations to what the legitimate email address is. The new email address is then used to send a notification to update payment information. Once the payment is processed the funds are then sent to the scammer.

How to protect yourself against BEC:

• Verify payment and purchase requests in person if possible or by calling the person to verify the information.
• Don't click on anything in an unsolicited email or text message.
• Carefully examine the email address, URL, and spelling used in correspondence.
• Be cautious of what you download. Be wary of email attachments forwarded to you.
• Be wary if the requestor is pressing you to act quickly.

Keep Yourself and Your Accounts Protected

There are several actions you can take in order to protect yourself and your business against fraud.

• Set up account alerts.
• Be wary of unsolicited opportunities that seem too good to be true - they could be a scam.
• Never provide any sensitive information to someone who has contacted you - via text message, phone or email - claiming to be your bank, a government entity, or company.
• Be wary of clicking on links within emails or SMS text messages, especially when the link was sent from an unsolicited source.
• Always contact FirstBank if you believe you have experienced fraud or have been the victim of a scam on a FirstBank account.

Online Banking Alerts

Security Alerts: FirstBank will automatically enroll you in Security Text message alerts if your mobile carrier offers free text messaging on the mobile phone number you provide us. These alerts will allow you to respond to account changes that have taken place on your account such as contact information updates and even high risk transactions that seem unusual for your spending patterns. To opt out of receiving FirstBank Security Alerts you may reply "STOP" to any security alert text message, or update your settings in Online Banking. You may always enroll or re-enroll in FirstBank Security Alerts by accessing the Communication Center of Online Banking, select Alerts and then select Security Alerts. You may call 1-800-964-3444, or visit your local branch for assistance.

Transaction and Notification Alerts: Online Banking also provides the ability for customers to enroll and receive account activity information by email or text message. Among other alert options, you may choose alerts for specific account activity, such as deposits and withdrawals, and in instances where a preset limit, a daily balance for example, is met for your account. If you receive an alert for a transaction that you don't recognize or didn't perform, please contact our Online Banking Customer Service at 303-232-5522 or 1-800-964-3444.

Protect Your Online Banking User ID, Password, and Security Questions

Your Online Banking login credentials are important and keeping them secret is essential to preventing unauthorized access to your account. In order to protect you and the bank, make your password unique to you. Your password should be something that would be hard to guess for someone who knows you.

Additional methods to secure your accounts:

• Security Features: Use security features whenever they are offered. These features allow for an additional layer of security to authenticate your identity. Enroll for biometric log in such as a fingerprint or facial recognition for mobile banking.
• Alerts: Use FirstBank Security Alerts to be notified when a change is made to your online banking profile or to your alert settings. These changes include: Address, Email Address, Phone Number, Your Alert Delivery Settings, Passwords, Security Questions, Online Banking User Name. If you enable your cell phone for this service, you will also be notified of unusual or higher risk debit card transactions via text messaging.
• Use Unique Passwords: Don't use the same password for different sites and never share your password with anyone.
• Push Notifications: FirstBank utilizes push notifications to confirm certain high risk transactions initiated by our customers. Never "approve" transactions you have not initiated.

To learn more about other ways FirstBank is protecting our customers' accounts and information review our Login and Authentication efforts.

Visa Secure®

What is Visa Secure®?

Visa Secure® is a service that adds multiple layers of protections to help prevent fraudulent online activity and requires additional validation for certain online transactions. Some transactions may require a one-time passcode via text or email. This passcode is required in order to complete the transaction. You will not need to enroll in this service to be protected by Visa Secure®.

How does Visa Secure® work?

Visa Secure® is a risk based process where only the riskiest transactions will require additional verification. Additionally, not all merchants participate in the Visa Secure® program. Because of this, only a small percentage of online card transactions will require additional cardholder verification. All participating merchants will have this badge to indicate their use of this service.

Do I need a new debit or credit card to use Visa Secure®?

No. Visa Secure® will work with your current debit or credit card. However, the one time passcode is only available for consumers, not commercial accounts.

Why is it necessary to ask for a one time passcode? How does Visa Secure® protect my card?

Visa Secure® protects you by requiring an additional verification step for higher risk transactions. This additional requirement is an effective way of preventing online debit and credit card fraud.

How is the one time passcode used in the verification process?

Because the one time passcode is sent to the phone number or email we have on file, it requires you to access your email or text message in order to complete the transaction.

What happens if the one time passcode is entered incorrectly?

If the one time passcode is not entered correctly, the following message will be displayed: "Please re-enter your code". You will have the ability to reenter the passcode or click the link to request another code.

What happens if the transaction is blocked?

If you receive this message, "For security reasons, your card has been blocked and your transaction cannot be authenticated. Please contact customer support at the number on the back of your card or 1-800-964-3444" for assistance.

What safeguards are in place to protect my privacy?

Merchants do not have access to the one time passcode if one is required for the purchase. This code is generated and verified directly with Visa®. Visa's® commitment to consumer privacy insures they do not sell personal information and will only use information on the basis of providing authentication, fraud management, loyalty, consulting and data processing services. For more information, visit Visa's® privacy policy.

Visa Secure® is a trademark owned by Visa® International Service Association and used under license.

Use Privacy Settings on Social Networking Sites

Use privacy settings on social networking sites to control who has access to the information you publish. Don't publish personal information such as your social security number, your mother's maiden name, your home address, your full date of birth, your phone number, your kids' names or when you won't be at home. All this information invites identity theft.

Review Your Credit Report

Review your credit reports carefully. Each major credit reporting agency is required to provide you with a free copy of your credit report once a year, upon your request. Look for any credit inquiries from companies unfamiliar to you or for accounts that you did not open. These can be red flags for identity theft. Order your free annual credit report, or call toll-free 1-877-322-8228.

Additional methods to protect your identity and credit:

• Credit Report Freeze: Adding a credit freeze will protect your credit accounts and history by requiring a PIN code to unlock a freeze placed on your credit report. If someone other than you tries to apply for credit while a freeze is in place, they will receive a denied decision as the credit company will not be able to authenticate the person applying for credit. This service is free and can be added simply by logging into the three major credit reporting agencies, TransUnion, Equifax, or Experian. Also consider freezing credit on your loved ones social security number, such as a minor or dependent, spouse, or parent.
• Sign Up for Credit Monitoring Alerts: Sign up for a credit monitoring services that monitors your credit report on your behalf and alerts you to any changes or inquires.

Protect your Business

Business customers can also be victims of fraud. Review our Commercial Fraud Prevention Guide (PDF) to learn more about how to protect your business.

These are only a few examples of the different types of fraud out there. Fraudsters use these and other similar techniques to try to gain access to your personal and banking information. If you suspect you have been a victim of fraud or were involved in a suspicious activity, please contact us immediately.