Protecting Your Privacy and Funds
First Business Financial Services, Inc., which includes First Business Bank and First Business Bank-Milwaukee collectively “First Business” or “Banks”, takes the security of your financial information very seriously. We have a robust Information Security Program that includes investing in technology to protect your confidential information from outside attack, ensuring that bank records are maintained in secured facilities, and providing regular training to employees on the Banks’ security policies as well as proper methods to communicate with you, our clients, in a secure and confidential manner.
Identity theft, check fraud, corporate account takeover, and other financial fraud schemes are ever increasing and becoming more sophisticated. We recognize the importance of having security procedures to assist and protect you from these types of fraud schemes and have put together best practices to minimize risk while managing personal and corporate accounts.
If you are a business, please share this information with employees that interact with your finances.
First Business staff will never initiate a request for sensitive information from you (i.e. social security number, personal login ID, password, PIN or account number) through an unsolicited e-mail message or phone call.
How to Protect Yourself
- Take advantage of all security options provided to you by the Banks. For clients with bank deposit accounts, we offer certain products, such as Positive Pay, ACH debit blocks and filters that may reduce the risks associated with certain of the Services. These products may be subject to a fee. We may also make you aware of additional products in the future designed to further mitigate the risk of future threats to the Services. If you continue to use internet banking services without subscribing for the enhanced security measures that we may offer now and in the future, you understand and agree that you assume all liability resulting from any losses or damages that could otherwise have been prevented with such measures.Immediately notify First Business of any suspicious activity. Call Client Services at 608-232-5938 (Madison), 262-792-1400 (Milwaukee), 920-734-1800 (Northeast, Wisconsin), or First Business Trust & Investments at 608-218-8000.
- Review your banking transactions on a daily basis and your credit report at least annually.
- Store extra checks, credit cards, documents that list your Social Security number or Tax Identification Number, and similar items in a safe place. Shred all credit or debit card receipts and solicitations, ATM receipts, bank account and credit card statements, canceled checks, and other financial documents before you throw them away.
- Replace paper invoices, statements and checks with electronic versions, if offered by your employers, utility company or other third party vendor. First Business offers electronic statements for deposit and employee benefit accounts and the Banks offer bill payment to eliminate outgoing mail being stolen.
- Always have updated phone numbers, including a cell phone when possible, set up in online banking and with the Banks in the event you are contacted by First Business to validate your identity. Out-of-band-authentication will be performed for our internet banking systems (Business Internet Banking or Consumer Internet Banking) if your access device is not recognized when logging in, or you originate ACH or wire transactions.
- Usernames and Passwords:
- Use complex passwords with at least 10 characters, including lower-case and upper-case letters, numbers and special characters. Do not use names, birthdays, or other personal details that might be guessed or easily determined.
- Change your password regularly – every 30 or 60 days
- Commit passwords and answers to security questions to memory, or, if you must write them down, store in a secure location where only you know what it is and where it is.
- Never share your password or answers to security questions with others.
- Avoid using the same username, password or security question for accessing your online accounts.
- Web Browser:
- Use the latest version of web browser available with "pop-up" blockers enabled.
- Clear the web browser cache before you begin an online session.
- Limit browsing to websites that you know are safe.
- Limit, or avoid altogether, downloading of programs and information.
- Access Devices:
- Never access an online session using a public computer, public Wi-Fi or kiosk.
- Never leave a device unattended while accessing an online session.
- Keep your devices up-to-date with the latest operating systems and patches, applications, and security software such as anti-virus and malware protection.
- Use a firewall and intrusion detection and/or prevention with your access device whenever possible.
Identity theft occurs when your personal or business information is stolen and used without your knowledge to commit fraud or other crimes. Identity theft can cost you time and money. It can destroy your credit and ruin your reputation.
First Business offers the following best practices related to avoiding identity theft from the Federal Trade Commission:
- Deter identity thieves by safeguarding your information.
- Shred financial documents and paperwork with personal information before you discard them. Protect your Social Security number.
- Don't give out personal or business information on the phone, through the mail or over the Internet unless you know the entity you are dealing with. Avoid disclosing personal or business financial information when using public wireless connections.
- Never click on links sent in unsolicited emails. Instead, type in the source page of the website using a separate tab or window. Use firewalls, anti-spyware and anti-virus software to protect your home computer. Keep this software current. If you use peer file sharing, check the setting to make sure you are not sharing other sensitive private files.
- Keep your personal information in a secure place at home, especially if you have roommates, employ outside help or are having work done in your house.
- Promptly retrieve incoming mail to limit the opportunity for theft. Know your billing and statement cycles. Contact your vendor if you stop receiving your regular invoice or statement.
- Detect suspicious activity by routinely monitoring your financial accounts and billing statements.
- Be alert to the following signs that require immediate attention:
- Unexpected credit cards or account statements
- Denials of credit for no apparent reason
- Calls or letters about purchases you did not make
- Charges on your financial statements that you don't recognize.
- For consumers, inspect your credit report. Credit reports contain information about you, including?
- Know what accounts you have and your bill paying history. The law requires the major credit reporting companies, Equifax, Experian, and Transunion, to give you a free copy of your credit report every 12 months if you request it.
- Visit www.AnnualCreditReport.com or call 1-877-322-8228. This is a service created by these companies to allow you to order your free annual credit report. You can also write to: Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281.
- If you think you are a victim of fraud such as ID theft or corporate account takeover:
- For consumers, place a "Fraud Alert" on your credit reports, and review the reports carefully. The alert tells creditors to follow certain procedures before they open new accounts in your name or make changes to your existing account. The three nationwide consumer reporting companies have toll-free numbers for placing an initial 90-day fraud alert; a call to one company is sufficient:
- Experian: 1-888-EXPERIAN (397-3742)
- Transunion: 1-800-680-7289
- Equifax: 1-800-525-6285
- Placing a fraud alert entitles you to free copies of your credit reports. Look for inquiries from companies you haven’t contacted, accounts you didn't open and debts on your accounts that you can’t explain.
- Immediately cease all activity from computer systems that may be compromised.
- Immediately contact First Business so the following actions may be taken:
- Online access to the accounts must be disabled
- Online account passwords must be changed
- A new account(s) may need to be opened
- Fraud detection and prevention services such as ID theft insurance for consumers, ACH debit block and filter, and positive pay are strongly recommended.
- File a police report. File a report with law enforcement officials to help expedite the potential for correction and as proof to third party vendors who may want proof of the crime. Obtain a police report number with the date, time, department, location and officer’s name taking the report. A filed police report will help facilitate reporting a claim with insurance companies or other third parties.
- Report the theft to the Federal Trade Commission (“FTC”). Your report helps law enforcement officials across the country in their investigations. Review the FTC’s recommendations.
- Online: ftc.gov/idtheft
- By phone: 1-877-ID-THEFT (438-4338) or TTY, 1-866-653-4261
- By mail: Identity Theft Clearinghouse, Federal Trade Commission, Washington, DC 20580
Contact the Internet Crime Complaint Center at www.ic3.gov. This organization is a partnership between the Federal Bureau of Investigation and the National White Collar Crime Center. This site provides a place to file claims of victims of identity theft. It also houses sources of internet crime prevention and current schemes.
- Maintain a written chronology of what happened. What was lost? What were the steps that were taken to report the incident and prevent fraud from happening in the future? Record the date time, contact phone number, person spoken to, and any relevant report of reference number and instructions.
- Consider hiring a consultant to have your network and systems reviewed by a computer forensic or information security professional.
Corporate Account Takeover
Corporate Account Takeover is the business equivalent of personal identity theft. Hackers, backed by professional criminal organizations, are targeting businesses to obtain access to their online banking credentials or remote control of their computers. These hackers will then drain the compromised bank accounts, funneling the funds through mules that quickly redirect the monies overseas into hackers’ accounts.
The steps of a typical Corporate Account Takeover include:
As a business owner, it is your responsibility to understand how to take proactive steps to avoid, or at least minimize the threat of a Corporate Account Takeover.
First Business offers the following best practices related to avoiding corporate account takeover risk:
- Use an access device that is dedicated solely to browsing to legitimate, known financial websites to conduct legitimate financial business. No other activity should be conducted on the dedicated device, including accessing email.
- Use a host-based firewall protection.
- Ensure that anti-virus/spyware software is installed, functional, and is updated with the most current version.
- Use the latest version of web browser with 'pop up' blockers enabled.
- Keep versions of operating systems, security software, and applications up-to-date and patched.
- Consider purchasing cyber liability insurance.
- Review your banking transactions daily.
- Do not batch approve transactions; be sure to review and approve each item individually.
- Use dual controls for high risk transactions such as wires, ACH, loan disbursements and external transfers. Have one user create the transaction; have a second user approve the disbursement form a different computer. This will reduce the risk of internal fraud, while at the same time making it more difficult for outside programs to find both usernames and passwords.
- Establish transaction dollar limits for employees who initiate and approve online payments such as ACH, wire transactions and transfers.
Malware, short for malicious software, is software designed by criminals to disrupt computer operation, gather sensitive information, or gain unauthorized access to computer systems. It is a general term used to describe any kind of software or code specifically designed to exploit a computer, or the data it contains, without consent.
Examples of malware include computer viruses, worms, Trojan horses, and other malicious programs. Malware works to remain unnoticed, either by actively hiding or by simply not making its presence on a system known to the user.
First Business offers the following best practices related to avoiding malware risk:
- Keep versions of operating systems, security software, and applications up-to-date and patched.
- Only open e-mail or Instant Message attachments that are expected and come from a trusted source
- Scan all e-mail attachments with security programs prior to opening
- Scan all files with security programs prior to transferring to your device or opening
- Delete all unwanted messages without opening
- Do not click on web links sent by an unknown party
- If a person on your ‘Friends List’ is sending strange messages, files, or web site links, terminate your Instant Message session immediately
- Always encrypt emails that contain sensitive information.
Social engineering attacks use human interaction (social skills) to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity. They may be able to piece together enough information to infiltrate an organization’s network by asking questions of several people over a period of days.
First Business offers the following best practices related to social engineering risk:
- Never provide passwords or answers to security questions to anyone.
- Never provide usernames, full names, IP address, etc. to anyone without verifying the legitimacy of the request.
- Always alert others at your organization if you receive a suspicious phone call where the caller is requesting this type of information. If a social engineering attacker is not able to gather enough information from one source, they may contact another source within the same organization in order to add to their credibility.
Fake Check Scams
First Business offers the following best practices related to avoiding fake check scams:
- If someone gives you a check or money order and asks you to send money somewhere in return, it’s a scam. Here are some examples of common fake check scams. Legitimate sweepstakes operators or other companies will not send you a check then ask you to forward money to a third party. If you have really won, you will pay taxes directly to the government. Do not remit payments for taxes to any third parties, only government agencies. Legitimate mystery shopper or account manager jobs do not use money transfer services to send money.
- A familiar company name doesn’t guarantee that it is legitimate. Crooks often pretend to be from well-known companies to gain people’s trust. Find the company's contact information independently, online or through directory assistance, and contact it yourself to verify the information.
- A check or money order may be fake even if your bank lets you have the cash. You have the right to get the cash quickly, usually within 1-2 days, but your bank cannot tell if there is a problem with the check or money order until it has gone through the processing system to the person or company that supposedly issued it. Sometimes that can take weeks. By the time the fraud is discovered, the crook has pocketed the cash and left you responsible for covering the charge.
- When the check or money order is returned unpaid, you will have to pay the money back to your bank. You are responsible because you are in the best position to know if the person who gave it to you is trustworthy. If you don’t pay the money back, your account could be frozen or closed, and your credit may be affected. Some victims are even charged with fraud.
- Sending money using a money transfer service is like sending cash – once the crook picks it up you can’t get it back from the service. It's not like a check that you can stop after you’ve given it to someone or a credit card charge that you can dispute. But if the money has not been picked up yet, you may be able to stop the transaction. Contact the money transfer service immediately if you think you’ve been scammed.
Phishing is a new twist on an old telemarketing scam, but uses e-mail. These criminals send e-mails to millions of people hoping that even a few will give away valuable information such as your username, password, or credit card number. The criminal then uses this information to steal the victim’s identity.
First Business offers the following best practices related to avoiding phishing scams:
- Do not click on links within an email unless you are sure of the sender. Many phishing emails include company logos or appear to come from government agencies, and appear legitimate. However, the links take you to a fraudulent website that has been set up to look like and feel just like the legitimate site. Check the URL carefully for differences in spelling, or go directly to a known website without the link. You may often find an alert on the legitimate site warning that a phishing email has been circulated by fraudsters.
- Never give out your personal or financial information in response to an unsolicited phone call, fax or e-mail, no matter how official it may seem.
- Do not respond to e-mail that may warn of dire consequences unless you validate your information immediately. Contact the company to confirm the e-mail's validity using a telephone number or web address you know to be genuine.
- Check your investment, retirement plan and bank account statements regularly and look for unauthorized transactions, even small ones. Some thieves use small transactions in hopes that they will go unnoticed. These small transactions are also used to test the bank account and routing numbers for future use. Report discrepancies immediately.
- When submitting financial information online, look for the padlock or key icon within your web browser. Most secure Internet addresses, though not all, use "https" in the URL.
- Report suspicious activity to the Internet Crime Complaint Center referenced at the bottom of this page. This organization is a partnership between the FBI and the National White Collar Crime Center.
- If you have responded to an e-mail that you suspect to be a phishing email, contact First Business immediately so we can protect your account and your identity.
Scam Prevention Best Practices
- Be suspicious of any offer made by telephone, on a web site or in an e-mail that seems too good to be true.
- Before responding to a telephone, mail or Internet offer, determine if the person or business making the offer is legitimate.
- Do not respond to an unsolicited e-mail that promises some benefit but requests personal identifying information.
- Beware of 'work from home' schemes that are offered on career websites. If they are asking you to open accounts or move money for the company, this is most likely a scam.
- You are responsible and liable for items you cash, borrow or deposit into your account; whether they are a check money order, cashier’s check, loan proceeds, etc.
How We Protect You
General online security:
- We have strict password requirements for online systems and password characters are masked to maintain confidentiality.
- We require your browser to be, at a minimum, a fully SSL-compliant, 128 bit encrypted browser.
- We require username, passwords at least eight characters long, and challenge questions to authenticate users at login for our remote deposit capture, retirement and employee benefit online systems.
- We provide multi-factor authentication that utilizes user IDs and passwords (“Codes”), to identify clients.
- We utilize secure socket layer (SSL) certificates to encrypt information.
- Account numbers are masked.
- We evaluate the latest security technologies and upgrade our systems whenever relevant improvements are available. We use multiple firewalls, network and application access controls, multi-tier architecture and ongoing preemptive forensics to protect your information.
- We have strict policies and procedures in place to safeguard your personal information.
- We require clients that are locked out of the system due to a failed login attempt to contact us for reinstatement.
- We partner with Cisco Systems to offer a no-charge email encryption service to our clients to send secure business communications to First Business representatives.
Business and Consumer Internet Banking security:
- We provide you with the date and time of last login when using the Business and Consumer internet banking systems.
- We utilize out-of-band-authentication at login if your device (PC, laptop, tablet, and smart phone) is not recognized. For your security, you will receive a system generated phone call or text message if someone attempts to login from an unrecognized device.
- We have account daily limits set up for bill payment, funds transfer, wires, ACH and other treasury management services.
- We require token use at sign on and transaction level for Business Internet Banking clients with high risk payment capabilities such as ACH and wire transfers.
- We have security alerts in place. These alerts are emails automatically sent to your primary email address when certain events occur. Events such as changes to your e-mail address, password changes, balance related events, user’s role changes, ACH template changes, new investment elections, etc. will trigger an alert. Alerts do not reference your specific name or account number. Being alerted promptly about these types of changes can help you detect and stop potential fraud.
- We recommend multiple approvals to add/change/delete a user within your Business Internet Banking system.
- We require dual control for high risk transactions such as ACH and wire transfers. (The Security Addendum addresses dual control as follows: Dual Controls. Certain products, such as wire transfers, offer the ability to require dual signers or dual authorization before we will honor a payment request. If you have elected to forgo the use of dual control where allowed, you agree to assume any liability that may arise from unauthorized transactions that may have been detected and/or prevented with the use of dual control Security Procedures. Perhaps we could restate this information to have it coincide with the contract.)
- We will never display a pop-up message indicating that you cannot use your current browser or send a message that includes an amount of time to wait before trying to login again.
- We require out-of-band-authentication for the final approver of all ACH and wire transactions, in addition to using security tokens.
- We require pre-note for new ACH transactions.
- We offer ACH Positive Pay and Payee Positive Pay. These services allow you to set up limits for authorized electronic debits and provide an automated means of monitoring the transaction activity within your account.
- We store client electronic statements in the system and we never sent them to clients via email.
- OnGuardOnline.gov provides tips to avoid scams, secure your computer, and protect kids online. The site also has a blog that is updated with recent fraud trends.
- IDtheftinfo.org provides the latest news from Consumer Federation of America and other sources. It also provides an ID theft library with education materials for consumers and businesses, a Privacy Information Website, and a victim resources guide.
- The Consumer Federation of America provides information to consumers through research, advocacy, and education. CFA also partners with financial institutions to help educate clients through advertising, readings, and other publications.
- The FDIC provides a consumer protection site to help educate consumers about the risks of identity theft, and also provides tips on how to guard themselves against it. Topics include online and electronic banking scams, identity theft, phishing scams, and safe internet banking.
Internet Crime Complaint Center
- The Internet Crime Complaint Center is a partnership between the Federal Bureau of Investigation and the National White Collar Crime Center. This site provides a place to file claims of victims of identity theft.