We want to keep your personal and account data secure. Central Virginia Federal Credit Union fully follows regulatory guidance and statutes to ensure the safety and soundness of the credit union, and of our members’ data at all times.
Our goal is help you keep your account information private and educate you on ways to diligently watch your account for suspicious activity.
We will never contact you by phone, email or text asking for personal or account information. If you receive a contact of this nature do not provide any information and call the credit union directly at 434/528-9016.
Passwords: Your First Line of Defense
A strong username and password provide extra security for your account. Here are some tips for creating strong sign-in credentials:
- Choose a unique username that you don’t use for any other site (and one that can’t be guessed easily).
- Use a combination of letters (both capital and lower case), numbers and special characters (like “&” or “%”) for your password.
- Never use personally identifiable information like name, birth date, Social Security Number, or email address.
- Never use common dictionary words.
There’s an App for that!
Use Apps for your Debit and Credit Card to help you keep track of your spending and alert you to any unauthorized transactions in real time.
CardValet. Your debit card, on your terms
- Turn your debit card on and off
- Set transaction controls for dollar amount limits, merchant categories and geographic locations
- Receive alerts when your debit card is used, approved or exceeds the transaction controls set by you
- Stay informed of potential fraud with alerts on attempted, declined transactions
- Get real-time balances for your accounts
- Learn more about CardValet
SecurLOCK. The Power to Protect your Credit Card
- Turn your credit card on and off
- Control where your cards can be used
- Receive instant alerts about card activity
Read up! Be aware!
Use reliable sources to educate yourself on current fraud trends and how to avoid them.
Account Takeover: What is Account Takeover (ATO) and what should I do?
Account takeover is an attack in which cybercriminals take ownership of online accounts using stolen passwords and usernames. These cybercriminals then use these credentials to commit fraud. These bad actors purchase cardholders’ Personally Identifiable Information (PII) via the dark web—typically gained from social engineering, e.g., phishing, vishing, or smishing attacks (detailed below) or data breaches. Stolen PII (e.g., name, address, email, phone number, date of birth, business name, cellphone provider, social media and login accounts and passwords) provides the necessary credentials for a fraudster to pose as a cardholder.
With this information fraudsters can engage with the cardholder’s financial organization and make changes to accounts or card settings to execute fraud. They may make demographic changes (e.g., phone numbers, emails, passcodes), or apply for increased limits, Personal Identification Number (PIN) changes and/or travel exemptions to suppress or interfere with our fraud-monitoring tools.
The activities described above are most commonly associated with merchant data breaches described in media reports. However, in the case of account takeover, the stolen data is not obtained from a payment system.
Schemes that Contribute to Account Takeover
Skimming and Malware
Skimming and deployment of POS terminal malware continue to be widespread methods for stealing data. Smaller, local merchants are now more likely to be compromised than in years past. Stolen data, which is collected using POS malware, is passed to criminal networks through remote, wireless technologies with increasing speed. By reacting to fraud events quickly, your organization can significantly mitigate losses
Phishing
The prevalence of phishing (tricking cardholders into revealing confidential information) and its variants continue to rise. Phishing schemes are becoming more targeted (such as “spear-phishing”) and more difficult to identify than in the past. Instead of using only suspicious links in poorly designed emails, phishing emails are mimicking legitimate websites and appear more polished and credible. The use of web address shortening tools, such as TinyURL, make detection of suspicious links more difficult, even by savvy users. It is important to remind cardholders to safeguard their financial data and their online banking credentials against criminals trying to harvest it.
Vishing and Smishing
Smishing and Vishing schemes use sophisticated methods combined with social engineering to deceive cardholders into revealing critical information and disregarding legitimate fraud warnings. Smishing is the fraudulent practice of sending text messages claiming to be from reputable companies to induce individuals to reveal personal information, such as passwords or credit card numbers. Vishing is the fraudulent practice of making phone calls or leaving voice messages claiming to be from reputable companies to induce individuals to reveal personal information, such as bank details and credit card numbers.
Cardholders may be sent a voice or text message with transaction details and requesting the cardholders confirm. When they respond, they may be questioned for account details, or they may be asked to call back a number to provide account information. In some instances, they are sent a one-time passcode (OTP). The caller or text message then instructs the cardholder to reply “No Fraud” to text/voice messages.
It is important to be on the lookout for these kinds of fraudulent messages that disguise themselves as legitimate fraud notifications. These schemes use sophisticated methods combined with social engineering to deceive cardholders into revealing critical information and disregarding legitimate fraud warnings. Additional red flags of note include hyperlinks and grammatical and punctuation mistakes.
Malicious Software
Malicious software, including software which compromises account-holder computers locally via Man-in-the-Browser (MitB) attacks are a significant threat to the security of financial data. Man-in-the-Browser attacks install malicious software in the background via “drive by download.” This malware is then able to monitor and hijack user web sessions to then transfer funds or harvest payment cards and online banking credentials, while redirecting the legitimate cardholder to a fictitious error page. This type of malware often deploys automatically when a user visits a compromised website.
Maintaining a secure, up-to-date operating system along with robust security and anti-malware software are critical first steps in preventing this type of fraud. Availability and deployment of automation and crime-ware is increasing in the card fraud world. Both all-in-one malware packages designed to compromise computer systems (e.g., Zeus, Citadel, Tilon) as well as individual tools able to crack passwords and to automatically carry out brute force attacks are available for purchase on underground websites and on criminal forums.
Heavy reliance on one type of security tool or on older tools could lead to more fraud loss. We recommend a dynamic, multi-layered detection and prevention strategy.
Recommendations:
- Be aware of what information you are choosing to submit online and never easily provide your personal information.
- If you are concerned about an automated message, do not respond to the call, text, or email. Contact the company in question using the official customer service number on your card or contact information listed on the company’s legitimate website. Do not contact any number provided by the fraud call or message and never click on links in text messages.
- Always keep two-factor authentication codes private. Do not provide them via phone, text, or email. These codes should only be used to sign into the banking, merchant, or payment account when your are attempting to access it.
