How to detect and protect yourself from fraud

More and more, online banking and mobile banking are becoming a way of life. But convenience doesn’t come without risk. Cyber fraudsters are capitalizing on our increased use to find ways to gain access to bank account numbers, login information and other personal data. Their success could spell disaster for your finances, your identity and your credit rating.

Fraud attempts typically come via phone call, email or text. An attacker may pose as a Citizens Bank employee. So how can you tell if it’s a legitimate message or from a bad actor? Here are five ways to recognize fishy (read: phishy) activity and protect yourself.

Grammar and/or spelling errors are telltale signs of an illegitimate source. Every official communication (from us or any other company) is triple checked by an editor. If you find mistakes in an email or text that should have been caught, be suspicious! But don't worry if grammar isn't your strong suit. There are many other ways to spot potential fraud.

Fraudsters are constantly on the hunt for personal data that can help them gain access to online and mobile accounts. Someone tries to trick you into sharing personal information via email (phishing) or text (smishing) by impersonating a business you work with or a name you know.

The grand prize is your Social Security number or bank account number. An ask for either through a text message or email is a big, red flag. But there are others.

Here’s the cybercriminal scorecard for the data they want most:

• Usernames
• Passwords
• One Time Passcodes generated to your phone or email
• Date of birth
• Credit/debit card numbers
• Answers to common security questions
• Email addresses

Citizens will only ask for your login on our official website (citizensbank.com). We will never ask you to send it to us via email.

You should also know that if you contact the Citizens call center, you may be asked to provide personal information so that we can verify your identity and keep your account(s) safe. In this instance, it's OK to provide some sensitive information. However, this is very different from someone calling you first because you can't be sure the person reaching out can be trusted.

And if you're uncertain of an email address or phone number, you can always contact us at another official channel to verify it's us. We take security of your information very seriously so we can protect your finances from fraudulent activity.

If you suspect a link might be unsafe, it’s easy to tell where it will take you before you click.

If you're on a computer, simply hover over the link to find where it leads. Or you can right click next to the link for a “Quick Look Link.” The preview will appear either below the link or at the bottom left corner of your window.

Perhaps you've received a “supposed” alert via text, email or phone call claiming to be from Citizens stating that a balance on your credit card needs to be paid. But your online account information says otherwise.

If you question the legitimacy of a message, or even if you're unsure, do not reply directly. If it’s in the form of a call, hang up immediately.

Contact us by calling 1-800-922-9999 or the phone number located on the back of your credit/debit card or monthly statement.

As always, we're dedicated to protecting your financial information, privacy and safety.

Voice over Internet Protocol (VoIP) is a technology that allows a user to set up a virtual phone number with the capability to send text messages, exchange voice and video calls and record voicemails. Google Voice, Zoom, Vantage and RingCentral are just a few of the companies offering this internet-based phone service. Unfortunately, bad actors are also using these phone services to initiate scams.

Here’s how it works. For example, a fraudster responds to a post — often times someone selling goods or services — indicating interest. But before proceeding, the bad actor requests proof that the poster is not a scammer. How? The fraudster sends a phone number and a Google Voice verification code. If the poster calls the number and recites the code, a Google Voice account can be established using the caller’s number. The criminal controls that account and can use it to scam others.

Why fraudsters like VoIP:

• It makes it very difficult to trace calls and texts back to them. Instead, law enforcement is led to the pilfered phone number.

• A Google Voice number can send phishing, smishing or vishing messages instructing a return call to that Google Voice number and a chance to fall into a trap. 
• A scammer can set up the Google Voice voicemail function with prerecorded messages that play when potential victims return calls to sent alerts (see above). Callers can be tricked into giving away sensitive personal information, believing they are contacting a financial institution or government agency.
• By combining Google Voice with a spoofing software program, the stolen phone number will show up when the fraudulent text is sent or a call is made. The receiver may believe it is a friend or family member and be exposed to a scam to steal money or personal information.

Even if your phone number hasn’t been usurped, you may still be at risk. There’s a good chance that a suspicious call, email or text originated from a Google Voice account. Though it can be tricky to determine the source, here are a couple of helpful tips. 

• The Caller ID setting in some phones include a prompt to show that a message is being sent from Google Voice.

• You could also try a phone carrier lookup tool. When you type the phone number into it, if it is a Google Voice number, it will show the carrier as Bandwidth.com. Phone numbers typically show such familiar carrier names as Verizon, AT&T, T-Mobile, etc…

Technology is constantly evolving and Citizens is committed to providing resources to help you bank safely as it does. Our Cybersecurity Hub is filled with information about keeping cyber alert and cyber safe and our dedicated colleagues are also ready to help you reach your goals securely.