Fraud & Security Center

Phishing is the method used to steal personal information through spamming or other deceptive means. There are a number of different phishing techniques used to obtain personal information.

Phone Phishing (Vishing)

Voice Phishing ‘Vishing’ is the telephone equivalent of phishing, using the telephone in an attempt to scam people into surrendering private information that will be used for identity theft. They may claim to work for a company you trust, or they may send mail or place ads to convince you to call them.

Should you receive a call that you think is suspicious, you should ask for:

• the caller’s name
• name of the business they are calling from
• phone number

Do not provide any information to the caller until you have conducted research to determine if the call is a scam. If you need more information, call them back at a publicly listed number, rather than the one they provided you.

Phishing Emails

One of the primary delivery methods of ransomware are phishing emails. Why? Because people are so conditioned to open emails and click on links and attachments.

Here’s how it works: botnets send spam or tailored phishing emails randomly or to personnel within an organization. These are often in the form of mail delivery notifications, energy bills, résumés, notifications from law enforcement, or tax returns.

• Never click on unknown emails
• Never open attachments or click on URLs in unsolicited emails, even if they come from people in your contact list. Instead, close out the email and visit the organization’s website directly
• Be vigilant about clicking on ads, even from reputable sites
• Bookmark frequently visited websites to prevent typing the wrong URL
• Make sure you have updated antivirus software on your personal computer
• Never connect unprotected personal devices [such as flash drives] to company systems
• Have strong passwords, and don’t use the same passwords for everything
• Use a pop-up blocker
• To prevent the loss of essential files, regularly perform system back-ups and store the back-up data offline

Remember, we will never ask members for personal information by phone, email or text.

What is Credential Stuffing? 

Credential stuffing is a relatively new cyberattack scheme that is on the rise and affecting online users around the globe. With this method, cybercriminals compile stolen login credentials from previous security breaches (such as Yahoo, Facebook, Door Dash, etc.).  The cybercriminals then use these stolen credentials to search for online accounts that may use the same Login ID and password combinations.   

How is Chartway keeping you safe? 

Depending on your alert settings in Online Banking, you may receive “invalid password” alerts if your account is included in a credential stuffing event. This does not mean that your account was compromised, but it is an alert to monitor your online accounts and proactively manage online credentials. 

Chartway uses a security protection tool called “multifactor authentication” to ensure your account is protected.  Because of this protocol, a user will need three, unique pieces of information to successfully access your account: your username, password, and a Secure Access Code. Remember – we will never ask you for your Secure Access Code, or any other personal information, by phone, email, or text. 

In addition, Chartway and its business partners are constantly working behind the scenes to safeguard member account information and stay ahead of cybercriminals and cyberattacks.  

How can you help protect yourself? 

The best way to thwart credential stuffing is to change your password on all your accounts, and use a long, complex password that is unique for each account.  Avoid using the same password on multiple accounts. Also, change your login ID to one that is equally long and unique.

If you need help managing your passwords, consider using a password manager, such as 1Password or LastPass to help.

Scammers will falsify the information transmitted to your Caller ID display to disguise their identity and appear as though a call is coming from a trusted business, like Chartway. These individuals are doing what is known as Caller ID “Spoofing,” by trying to request personal account information including Account Numbers, Social Security Numbers, Debit/ATM PIN Numbers, and Online Passwords. 

Caller ID "Spoofing” is an attempt at fraud. Although the call appears to be from Chartway, any direct request for personal/account information should be treated very cautiously. If you receive this type of suspicious or questionable call, do not respond or simply hang up. If you receive a Caller ID spoofing call, please call us at 800-678-8765. We’re here to help keep your financial accounts safe and secure.

Please review the following to help avoid phone scams: 

• Ask the caller for their name and the number where they can be reached. If this number doesn’t match the one where the call originated, this should serve as a major red flag
• Never provide confidential information (address, account / payment information, etc.) to solicitors by phone, email, or text
• Many fraudsters use scare tactics, such as threatening to disable your account. Don't feel pressured into providing information
• Never click on links in an email or text unless you are absolutely certain from whom they are being sent
• As always, accounts should be frequently reviewed for any unusual transactions. 

What is identity theft?

Identity theft, or ID theft, is the fraudulent use of an individual’s personal information—such as Social Security number or date of birth—to commit financial fraud.

What happens to victims of identity theft?

Identity thieves harm and inconvenience victims by using their names and other personal information to open new credit accounts or access existing credit and bank accounts, and by placing fraudulent charges on these accounts. Victims of identity theft have to dispute these charges as fraudulent, and locate and close down all bogus accounts opened in their names.

Are victims of ID theft held liable for the losses?

No. But while victims of identity theft are not held liable for the losses, it may take years for victims to clean up the financial and credit problems caused by the crime.

Prevent ID theft/account fraud

Your credit:

• Check your credit reports regularly. You can get free copies every 12 months at AnnualCreditReport.com (www.annualcreditreport.com) or by calling 877-322-8228.
• Before you discard documents and mail that contain your SSN, account numbers and other personal information, shred them or tear them into tiny bits.

Personal identification:

• Don’t carry your Social Security card in your wallet or purse. Memorize your SSN.
• Watch your wallet or purse at all times. At work, keep your purse in a locked drawer or cabinet. Don’t hang your purse on your chair in restaurants.

What should I do when my card is lost or stolen?

If you lose your credit cards or realize that they have been lost or stolen, call the issuers immediately. Most credit card companies have 24-hour customer service lines to deal with emergencies. Ask your issuer if it recommends that you follow up with a letter, and if so, ask what information you need to include in the letter. Report the loss of your card as soon you can. If someone has used your card without your permission, your maximum liability under federal law is $50 per card.

What law protects my credit history from being damaged if I am a victim of identity theft or credit card fraud?

The federal Fair Credit Reporting Act (FCRA) gives you the right to get a free credit report if you are the victim of identify theft. It also gives you the right to place a fraud alert in your file. Many states have their own consumer reporting laws that may give you additional rights. Contact your state or local consumer protection agency or your state attorney general for more information. You can find these agencies in the government pages of the phone book.

When I checked my account online, I saw a charge I didn’t make on my credit card. What should I do?

With online access, you can monitor posted transactions on daily basis. This can help you monitor your account for fraud. If you look at your account online and see a charge that you didn’t make, contact your credit card company immediately. Notify the company even if the card is still in your possession. You may be told that you must wait because you can’t dispute “unbilled activity” until it shows up on a monthly statement. Tell the company that this is more than just a dispute—you suspect fraud.

What is my liability for charges made without my permission by someone who found or stole my credit card?

You’ll owe nothing if you report the lost card before unauthorized charges are made. When unauthorized purchases or cash advances were made, federal law restricts your liability to $50 per card. However, if you card has a “zero liability” policy, you will not be liable for fraudulent charges.

What is a “charge back”?

A charge back is a credit from your credit card company. When you purchase goods or services using a credit card and something goes wrong with the purchase, you have the right to dispute the charge and ask for a credit or charge back.

Your card has been used for an unauthorized transaction, but is it a Fraud or a Dispute?

Dispute: 

A dispute is a situation in which a Chartway member questions the validity of a transaction that was registered to the account.  Members dispute charges for a variety of reasons, including unauthorized charges, excessive charges, failure by the merchant to deliver merchandise, defective merchandise, dissatisfaction with the product(s) or service(s) received, or billing errors.

Disputes can arise between a merchant and a cardholder for a variety of reasons. These reasons can range from overcharging the cardholder, charging the cardholder for merchandise that wasn’t received, or charging the cardholder for a monthly subscription or service that was previously cancelled. 

Asking the following questions may help you to determine whether the your claim is a dispute or fraud.

1. Do you know who made the transaction using your debit card?
2. Is the transaction a result of you signing up online for a “free trial” where you used your debit card to pay for shipping only or as a payment method after the free trial ends?
3. Did you voluntarily give your debit card number to anyone over the phone, provide it on a mailed form or email, or enter it on a website through a mobile app?
4. Did you voluntarily give or loan your debit card to anyone?

Fraud:

Fraud is defined as the intentional, false representation, or concealment of a material fact for the purpose of inducing another to act upon it to his or her loss.  A fraudulent transaction occurs only when you have no knowledge of who used your debit card and you can state with certainty that you were not aware of the transaction.  Debit card fraud can be characterized as a third-party unauthorized use of a debit card.  If the transactions were never authorized or initiated by you, a fraud claim may be filed.