Contents. What we re doing to protect your accounts. Protecting yourself from the most common scams and types of fraud

Transcription

1 Fraud awareness Being a victim of fraud can be a distressing and worrying time. This leaflet gives you advice and guidance to help you protect yourself.

2 02

3 Contents Help keep yourself safe from fraud 4 What we re doing to protect your accounts Automated fraud monitoring 5 One Time Passcodes (OTP) 6 Trusteer Rapport 6 Image and phrase security 6 Apple Pay 7 Verified by Visa and MasterCard Secure (3D Secure) 7 In branch 7 Protecting yourself from the most common scams and types of fraud Vishing 8 Internet banking and online fraud 9 Phishing 9 Text message phishing 9 Remote access fraud 10 Malware 10 Payment re-direction and invoice fraud 11 Card fraud 12 Identity theft and account takeover 14 Cheque fraud 15 Reporting fraud 16 03

4 Help keep yourself safe from fraud If you re ever unsure of what you re being asked to do, we urge you to take your time and don t be rushed. A genuine organisation will never rush you to take action on your account. Protect yourself by following our top three tips: n Never share a Santander One Time Passcode (OTP) with another person. Not even a Santander employee. n Never download software or let anyone remotely log on to your computer or other devices either during or after a cold call. n Never enter your Online Banking details after clicking on a link in an or text message. How to report fraud If you think you have been a victim of a fraud or scam, or are concerned that you may have revealed personal or security details or information, please contact us immediately on More information As well as the information provided in this leaflet, you can also visit our online security centre at santander.co.uk/securitycentre 04

5 What we re doing to protect your accounts As well as giving you advice on how to keep yourself safe, we wanted to tell you about some of the things we re doing too. Automated fraud monitoring We re always monitoring your accounts for any suspicious behaviour. We may contact you to authenticate certain requests such as payment instructions, card purchases or changes to the information we hold about you. We may also use your location data to prevent and detect fraud. For example, we may check if you re in the country your payments are being made if we suspect fraud on your account. Don t worry, we won t use this information for any other purpose. We ve listed what to expect if you re contacted by our automated fraud monitoring service via interactive text message or automated phone call. Interactive text message n This will list the transactions we want to check with you. It will ask if you recognise them and you should either reply Y or N to the message. n If you reply N, we ll call you back as soon as possible. We ll also give you a number that you can call us on if you prefer. Automated phone call n This will ask you to confirm some transactions, but first it will ask for some security details so that we know we ve reached the right person. n You ll never be asked to confirm your security details in full, such as your PIN, passwords, or a One Time Passcode (OTP). n Throughout the call you ll have the option of speaking to one of our advisers if you don t recognise a transaction. n If any of the transactions haven t been made by you, we ll take steps to protect your account. On some occasions we ll provide you with a 3 digit code which you ll need to enter in the phone when you return our call or respond to the interactive text message. This code is used to help us recognise you when you contact us. It doesn t relate to any of your other security details and should never be shared with anyone. If we can t reach you n If you aren t available, we may leave a message on your answer machine or voic , or send a text message, or letter, letting you know we re trying to get in touch and ask you to call us back as soon as you can. n We may need to stop or hold your account or payment until we can speak to you. This is to protect your money and keep your accounts safe. Are your details correct? n We use an automated service so we can reach you as quickly as possible. To do this we need your up-to-date contact details. n You can check this online, on the phone or in branch. If you re suspicious of a call or feel you are being asked too much personal information, you can end the call and phone us back on a few minutes later. 05

6 One Time Passcode (OTP) An OTP is a security code we send to your registered mobile phone to authenticate certain transactions you ve made online. It s a different code for every request and saves you having to remember extra passwords or carry around a separate device. n It s important that you keep us up to date with your current mobile number so that you can continue to receive these codes. n Always make sure the details within the OTP message match your original request. n You should only enter the OTP codes online when you re making a transaction or a change of details request yourself. n Never disclose your OTP code verbally, or otherwise, to anyone. Santander will never ask you to do this. If you receive an OTP when you re not expecting it, please call us on Trusteer Rapport We recommend a service called Trusteer Rapport. It doesn t replace your normal anti-virus software, but works alongside it to give you more protection on your computer: n It strengthens your online security by locking down the connection between your computer, keyboard and Santander internet banking. n It helps stop your data going to counterfeit sites, so you can be safe in the knowledge that only you are transacting on your account. n It can also help identify and remove malicious software (malware), protecting you and your PC. How to download Visit santander.co.uk/securitycentre for further information and instructions on how to download the free security software. Image and phrase security Each time you log in online you ll see an image and phrase after you enter your personal ID number, but before entering your passwords. This is an additional security measure so that you can recognise our site. n When setting up your Online Banking for the first time, we ll ask you to choose an image and phrase. This will appear every time you log on.* n Always type the Santander web address into your browser so you re sure you re always accessing the real Santander site: santander.co.uk *Please be aware that the image and phrase won t appear on the mobile app. If your image and/or phrase are different or don t appear, don t continue or enter any details, but call us on

7 Apple Pay Apple Pay allows you to use your iphone, ipad or Apple Watch to pay for things instead of using your physical bank card. n Any of the fingerprints registered on your Apple device s Touch ID are able to authorise payments on any of the registered cards. n To protect your Apple device, you should keep your passcode secret. This will stop somebody adding their own fingerprint to your device. n When registering your card in your Wallet app, we ll send you an OTP code to authorise the set up. Please make sure you ve registered your mobile number and address with us so you can receive this. n If you lose your phone there s no need to cancel your physical debit or credit card/s as the details aren t stored in the Apple Pay phone or device. However you must either cancel your digital cards using find my iphone or call us to do this on your behalf on For information on how to secure your device if it s lost or stolen, please visit the Apple website Verified by Visa and MasterCard Secure (3D Secure) Santander Secure, in partnership with Verified by Visa and MasterCard SecureCode, helps protect your card against unauthorised use when you shop online. It s free to use and covers you when you use your Santander card at over 300,000 online retailers. For your security you may, from time to time, be prompted to provide some additional details to authenticate your payment. In branch If you visit a branch, you ll be asked to use your card in our Chip and PIN device. This helps us identify you as the account holder and reduces the risk of impersonation fraud. n Once you ve entered your PIN successfully, we can access any of your Santander accounts. n Keep your PIN secure and don t share it with anyone. n For some transactions we need extra identification, so it s useful to bring your ID with you. n We ll check your ID to confirm that it s a genuine document and that it s on our list of acceptable identification. n If we can t verify the document you provide, you may be asked for more ID before we can complete your request. 07

8 Protecting yourself from the most common scams and types of fraud Vishing Increasingly, fraudsters are resorting to convincing people to disclose their personal and confidential details through phone calls. They do this by pretending to be from the bank, the police or other legitimate organisations, and taking advantage of the person s trust in that company. This is known as vishing (voice phishing). How to protect yourself Never be afraid to simply hang up on a coldcaller who asks you for personal or financial information or puts pressure on you over the phone. n Never share a Santander One Time Passcode (OTP) with another person. Not even a Santander employee. n Never download software or let anyone remotely log on to your computer or other devices either during or after a cold call. n If it s a genuine company, they ll treat their customers appropriately. You can always contact them instead to be sure you re speaking to the right people before going ahead. n Don t be rushed into anything, wait 5 minutes and reflect on what s being asked. n The number they re calling from may be spoofed to make it look like your bank or other legitimate organisations. Don t rely on the caller ID display alone, as this can be falsified. n If you do get phone calls like this, decline the request and terminate the call immediately. Once you re sure the previous call has been disconnected, call us on to report it. n Never enter your Online Banking details after clicking on a link in an or text message. n Never reveal your security details such as your PIN, One Time Passcode (OTP) or security numbers, or let anyone take your card. These are personal to you and shouldn t be shared with anyone not even us. n We ll never contact you to ask you to transfer money out of your account for security reasons. Requests to do this will always be fraudulent attempts to access your funds. 08

9 Internet banking and online fraud This is when a fraudster has been able to obtain your internet banking log-on and password details. They usually do this through malicious software (malware) or by persuading you to disclose your details via s or logging in to fake websites pertaining to be from or operated by Santander. Phishing Phishing is the most common way of obtaining online banking details. This is when you receive bogus s asking you to confirm your security details. The links in these s take you to fake online banking websites that record your information, which the fraudsters then use to access your account. These s can also be used to infect your computer with viruses, Trojans and spyware. How to protect yourself It s important to bear in mind that Santander will never ask you for confidential information, security details or include a link to our online banking site in an . If you do get an that appears to have been sent from Santander asking for your banking details, PIN, passwords or other personal details: If you ve already opened an that you think is an attempt to obtain confidential details, please forward this to phishing@santander.co.uk. Text message phishing (Smishing) Smishing works in the same way as phishing, but uses text messages instead of s to trick you into giving out your personal and financial information. The text message normally contains either a telephone number to call or a link to a fake website that asks you to enter personal details or download a file to update your records. The text message may appear to come from your bank or other known organisations and could even appear in your normal conversation feed. How to protect yourself If you ve received a suspicious text message that appears to have come from Santander please forward it to smishing@santander.co.uk typing this where you d normally enter the phone number. We investigate every report we receive, though we can t guarantee a response. n delete it immediately; n don t open any links or action any request in the ; and n if you think you may have revealed your details, call us immediately on and tell us what has happened. 09

10 Remote access fraud You re contacted, usually out of the blue, by a fraudster impersonating someone else, typically a computer, internet or telecoms company, although it s not limited to this. They may explain that they re calling about slow internet speed or a potential virus on your device. During the call they ll encourage you to run program s and download software to help identify and solve the issue. If you download software, what you re actually doing is installing a program that will allow them to have remote access so they can see your screen and take over your device. They may even make the screen blank so you can t see what s happening. They ll then convince you to reveal your passwords or access your Online or Mobile Banking, sometimes saying they ve credited your account with a refund and want to check it s arrived. Once you ve signed in they may be able to access your accounts and personal details. How to protect yourself n Never give control of your device to a third party who calls out of the blue. n Never log on to your internet banking whilst someone else is connected to your device. n Never disclose your OTP s to anyone not even us. n The phone number they re calling from could be spoofed to make it look like a genuine call. Don t rely on the caller ID display alone, as this can be falsified. n Don t be rushed into anything, wait 5 minutes and reflect on what is being asked. If you think you ve revealed any of your details or have allowed remote access when you shouldn t have, call us to report it on Malware Malware is used by fraudsters to get information from your device or to read information that you input online, such as passwords and log on details. It can change the screens you see whilst using your internet banking, set up fraudulent payments on your account and trick you into entering the OTP to validate those payments. It s not always easy to tell if your device has been infected with malware, it s designed so that it doesn t interfere with the normal running of your device. It s usually installed by clicking on a link or opening an attachment in a suspicious . If you think you have malware on your device download Trusteer rapport immediately, then run an anti-virus scan. And if you think you have revealed any of your security details contact us straight away. How to protect yourself n Never disclose a One Time Passcode (OTP) to anyone - not even us. n Always make sure the details in your One Time Passcode (OTP) message match the transaction you are performing. n If you ever receive an OTP message which you weren t expecting, contact us immediately as it may be a sign of attempted fraud on your account. n Always make sure you ve enabled firewall software, which is available on most operating systems, and check you have anti-virus software installed on your computer. n Santander recommend a service called Trusteer Rapport to help protect your computer from infection. To download this free protective software, log on to our internet banking service.

11 n Set up your computer so that the operating system, browsers and software automatically download updates as they are released. n Run an anti-virus scan weekly and regularly update your anti-virus software. n Always enter our web address into your browser to access our site. Don t click on links in s and don t save our web address to your favourites or as a shortcut. n Don t give your Online Banking details to anyone. n Look out for your unique image and phrase when logging on to Online Banking. If your image and phrase aren t displayed, do not enter your online personal ID or PIN. n Close your secure internet banking sessions by signing off when you re finished. Things to remember n Text messages and s aren t the only way fraudsters will contact you to get your information. They may also contact you by telephone or even through social media. Payment re-direction and invoice fraud Occasionally a company or person you make payments to will contact you informing you of a change to their bank details. They ll ask you to make all future or outstanding payments to the new details. This could be someone you pay regularly or for a one-off payment, such as payment for building work or a solicitor s bill. A fraudster will impersonate the person or company you are paying often by sending you an that looks genuine. They ll ask you to make the payment to a new sort code and account number they ve provided. How to protect yourself n You should take the time to check that any requests like this are genuine. n Contact the company or person directly using contact details you have used before. n Don t rely on the address or phone number in the request in case they are the fraudsters. n Always remain vigilant when being contacted by someone who says they are your bank. Remember, we ll never ask for your security codes in full. We only ask for partial details when we re confirming your identity. For more information please visit our online security centre at santander.co.uk/securitycentre 11

12 Card fraud What is it? Card fraud is when someone uses your card or card details without your knowledge or agreement. There are a number of different types of card fraud: Card not present fraud: This involves the theft of genuine card details, which are then used to make purchases via phone, fax, the internet, or by mail order. In this situation, the fraudster doesn t need the physical card, only the information on the card. Mail non-receipt fraud: This is when a card is stolen on the way from the bank to the customer. Customers who use communal letterboxes, such as those in flats or student halls of residence, are particularly vulnerable to this type of fraud. If you have a shared letterbox, let us know and we can find an alternate way of sending cards to you. Counterfeit card fraud: This occurs when a copy of a card is created. This is no longer a major issue for UK banks who issue chip and PIN cards, but fraudsters still try to copy the magnetic stripe from chip cards at ATMs and retail outlets such as bars, restaurants and petrol stations for use abroad. There are ways you can reduce the risk of counterfeit card fraud take a look at the How to Protect Yourself section. Card capture fraud: Fraudsters may try to steal your card and find out your PIN by manipulating ATMs to make it look like your card has been captured and then trying to watch you enter the PIN. If your card is captured by an ATM, contact Santander immediately. If you spot anything suspicious about an ATM, don t use it. If anything unusual occurs when you re using your card at an ATM or point of sale, let us know so we can take action to protect your account. Lost/stolen fraud: This occurs when a genuine card has been lost or stolen and then used for purchases or cash withdrawals. The fraudster may have watched you entering your PIN at an ATM or while making a purchase this is known as shoulder surfing. If your card is lost or stolen, please call us immediately so we can block your card and sort out a replacement. You may want to make a note of our lost and stolen number:

13 How to protect yourself n Be aware of others around you when you re at an ATM and always remember to shield your PIN with your other hand when entering it into a terminal or ATM. n Always keep your card safe and in your possession at all times. n Don t allow staff to take your card away to process payments, for example in a bar or restaurant. n Pay attention to card expiry dates if your replacement card hasn t arrived, call us to check the status of your new card. n Don t carelessly dispose of your receipts tear them up or shred them. n Check your balance and statements regularly. Tell us straightaway if you think something is wrong. n Memorise your PIN and passwords and never give them to a third party or record them in any way that can be deciphered by anyone else. n Check ATMs for signs of tampering before you use them. If you re unsure don t use it. n If an ATM doesn t return your card, report it to us immediately. n Don t use easily obtainable facts about yourself, such as your date of birth, when choosing a PIN. n Always make sure we have your up-to-date address and contact numbers (particularly your mobile phone number if you have one). n Use a computer that you know is secure and be particularly wary of making a transaction on internet cafes or public computers. n Only enter your card details on secure sites where the web address begins with https and has a padlock in the browser window. n Santander staff will never ask you to disclose your PIN or ask to collect your card. If you re ever asked to do this, refuse and call us immediately on , making sure the previous call has been disconnected first. Additional tips when using cards overseas n It s a good idea to take another card or alternate payment method with you so you re not reliant on one card. n Make sure you have our 24 hour contact telephone number. If you are outside the UK this number is n Always try and use modern ATMs owned by reputable institutions and avoid freestanding ATMs wherever possible. n If an overseas ATM allows you to pay in sterling rather than local currency, refuse until you ve checked the currency exchange rate offered. Santander will normally provide a far better exchange rate for transactions overseas. n Register for 3D Secure (Verified by Visa or MasterCard Secure) if you shop online. 13

14 Identity theft and account takeover What is it? Identity theft is any crime where a fraudster obtains personal information that they can use to impersonate you. Fraudsters may attempt to use your personal details to obtain credit cards, loans, state benefits, mortgages and documents such as driving licenses and passports in your name. Alternatively fraudsters may try to gather enough information about you in an attempt to gain access to your existing accounts or services. What to look out for Modern technology has only increased the risk of becoming a victim of identity fraud. Social networking sites are becoming a rich source of information for criminals to gather personal details such as bank and utility statements, government records, public records, etc. Fraudsters will attempt to obtain a range of personal information such as name, address, date of birth, phone number, place of business and income. They may even call you in the guise of the police, a government official, your bank or even a charity or research agency in order to try and obtain information about you. How to protect yourself n Always keep important personal documents, cards and chequebooks in a safe and secure place. n Do not share personal information unless you are completely sure you know who you are dealing with. n Store your statements, receipts and documents relating to your financial affairs safely, making sure you securely destroy (preferably shred) them when you no longer need them. n Always check bank and card statements thoroughly if you find a transaction you do not recognise, contact us immediately. n Cancel any lost or stolen credit or debit cards immediately. n If you fail to receive a bank statement, card statement, utility bill or other financial information contact the supplier. n When you move home redirect your mail to your new address by contacting the Royal Mail Redirection Service. n Never give out any personal information to unidentified individuals or organisations who contact you by phone, or face to face. n If you re unfortunate enough to have a break in or burglary, make sure your financial documents, cards or passbooks have not been stolen. If in doubt, contact the bank to arrange for replacements and/or details on your account to be changed. We may be able to help you protect yourself if you do have a problem via a Protective CIFAS registration. 14

15 Cheque fraud What is it? There are four different types of cheque fraud. Counterfeit cheque fraud: Counterfeit cheques are manufactured or printed on non-bank paper to look exactly like genuine cheques, which are then drawn by a fraudster on genuine accounts held by the bank. Forged cheque fraud: This is a genuine cheque that has been stolen from a customer or a chequebook sent via post from the bank and used by the fraudster with a forged signature. Fraudulently altered cheques: This is a genuine cheque that has been made out by our customer (drawer), but a fraudster has altered the cheque in some way before it was paid in, e.g. by altering the beneficiary s name or the amount of the cheque. Overpayment fraud: This is where a customer advertises an item for sale in a magazine or via the internet and the fraudster sends a cheque for more than the item was advertised for. They then ask the difference to be sent back normally by money transfer. The cheque subsequently bounces and the customer suffers the loss. How to protect yourself n Try to avoid accepting cheques from anyone unless you know and trust them. Always consider alternative ways of accepting payment e.g. bank transfer. n Don t release goods on a cheque or banker s draft, or corporate cheque until it has cleared. A banker s draft can be stolen or altered like any other cheque and if it is altered, stolen or counterfeit it will not be honoured. n Keep your chequebook in a safe place, report any missing cheques to your bank immediately and always check your bank statement thoroughly. n If you re making a cheque payable to a bank or credit card company, try to include a reference number or surname as well. This helps to guard against fraud and ensures the money gets to the right account without unnecessary delay. n Never pre-sign blank cheques. When writing cheques, be sure to complete all sections, including the payee name and the amount in both words and figures. To help prevent fraudulent alteration, leave as little blank space as possible, if necessary by drawing a line through unused spaces. Include the word only after writing the amount in words. 15

16 Reporting Fraud Please call us on : n if there are transactions on your account that you didn t authorise; n to report lost or stolen bank credentials or literature, including cards or statements; n if you think any of your PIN, password or personal data may have been compromised; or n if you believe you have been victim to a scam, or are being targeted. Remember to ensure you have disconnected the previous call before dialling out. Take Five Take Five is an industrywide campaign supported by Santander. It offers straight-forward and impartial advice to help everyone protect themselves from preventable financial fraud. takefive-stopfraud.org.uk If you think you ve been scammed or you re being targeted, you should also contact Action Fraud, a government organisation closely associated with the police. There are two ways that you can contact Action Fraud n Use the online web reporting tool at actionfraud.police.uk n Call (text phone ). 16

17

18 Santander is able to provide literature in alternative formats. The formats available are: large print, Braille and audio CD. If you would like to register to receive correspondence in an alternative format please visit santander.co.uk/alternativeformats for more information, ask us in branch or give us a call. Santander UK plc. Registered Office: 2 Triton Square, Regent s Place, London, NW1 3AN, United Kingdom. Registered Number Registered in England and Wales. Telephone Calls may be recorded or monitored. Authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. Our Financial Services Register number is Santander and the flame logo are registered trademarks. MISC 1755 JUL 17 H This item can be recycled.