Security Center

Every user must privately maintain a combination of an online banking ID and password. If you are assigned an original password by a bank administrator, the online banking system will force you to change it when you log in for the first time, before any transactions can be requested.  This forces each user to establish an absolutely private password.  If the password is lost or forgotten, please call our Bookkeeping Department at (410)749-1185, and a bank administrator will reset your password for you once your identity has been confirmed.  You can also click on the "Forgot Password" link, and an email to reset your password will be sent to you.  In order to use this feature, however, you must have previously set up your email address and password reset question under the "Options", then "Personal" tab of online banking.

If an unauthorized person attempts entry into an end user’s account by trying to guess a password, the system will disable the online account on the third incorrect attempt, thus invalidating the log-in combination. If you accidentally activate this security feature by unintentionally miskeying a password three times, you will need to call the Bank to reset the password for your account. A common mistake made by the end user is having the caps-lock on while keying in a password.  You can also use the "Forgot Password" link to reset your password if you have previously set up that feature under the "Options", then "Personal" tab of online banking.

To further protect you, a timeout feature is used. This feature will automatically log you out of your current online session after a 10-minute period on our site.

To enhance your online safety, you will be asked to select a watermark when you first log in.  In the future, if you do not recognize that watermark, DO NOT enter your password.  Try re-entering your online banking ID.  If your watermark is still incorrect, call our Bookkeeping Department at (410)749-1185.

The Bank also requires the use of secure browsers to protect you while you access our online banking services. More specifically, the personal and account information that flows back and forth between your PC and the Bank must be encrypted while in transit – secure browsers are how we achieve this level of protection. Encryption is the process of scrambling information (typically for data transmission) so that it can only be reassembled in its original clear text format by someone who has the correct encryption key to do so. When used between you and the Bank, this technology encrypts your personal information as you send it to us, which only Hebron Savings Bank can decrypt. Likewise, when we send personal or account information to you, this technology encrypts it, which only you can decrypt. This is possible through a certified 128 bit secure server by VeriSign so that no unauthorized individuals can read or decipher the data.

It is isolated from the network via "firewall". All requests to the server are filtered through a router and firewall before they are permitted access to the server. A router is a piece of hardware that works in conjunction with the firewall, a piece of software, to block and direct traffic coming to the server. The router and software "firewall" define and limit access that "outside" computers have to the Bank’s server. The configuration begins by disallowing ALL traffic and then opens only when necessary to process acceptable data requests, such as sending customer requests to the Bank.

While Hebron Savings Bank works to protect your banking privacy, you also play an important role in protecting your accounts. There are a number of steps you can take to ensure that your Hebron Savings Bank account information is protected, including:

 

The bank has received a report that scam artists are sending text messages to PPP loan recipients claiming to be referred by Hebron Savings Bank to assist with tax credits related to their PPP loan. The text message invites you to click a link for additional information.

THIS IS A SCAM. Do not click on the link or respond to the message in any way.

Hebron Savings Bank does not sell customer lists or your personal information. So how did the scammer get your PPP loan information? The details of every PPP loan is public information. A significant amount of information regarding each and every PPP loan is available to the general public from the Small Business Administration’s (“SBA”) website. The information provided by the SBA is very detailed (over 50 points of data), and the data includes the PPP loan number, borrower’s name and address, and the name of the lender…more than enough information for a scammer to create a targeted smishing/phishing scam.

General rule of thumb…never click on a link, open an attachment, or otherwise respond to an unsolicited text or email. It’s just not worth it.

Beware - there has been a significant increase in text message fraud. Unfortunately, one of the scams involves text messages saying that your debit/credit card has been compromised. The fake text messages direct you to click on a link and/or call a phone number. At that point you are asked to provide your full debit card number.

Any text message that asks for your full debit card number is fake - under no circumstance should you ever provide your full debit card number based on a text message, email or phone call.

These fake text messages are the same as phishing emails – they can look very convincing, but don’t fall prey to the scammers.

Always be mindful of any information you provide to an unsolicited text, email or phone call. Genuine fraud prevention services do not need your full debit card number. They also do not need the expiration date of your debit card nor the CVV number of your debit card. Your bank’s fraud personnel should only ask for the last 4-digits of your debit card number (no more than the last 4-digits), your zip code, and/or your name. At this point, you may be asked for additional information to verify your identity, but again, be cautious. This additional information should not be your full debit card number, should not be your debit card expiration date, should not be your debit card CVV number, or should not be your social security number.

If you suspect that you have unwittingly provided someone with too much information about your debit card, please contact the bank so that we can issue you a new debit card.

The bank has received several reports of customers receiving phone calls claiming that the Federal Reserve intends to close, block or freeze their deposit account(s).  This is a scam. Please hang up, and do not respond to the call in any way. The Federal Reserve will never contact the public using unsolicited phone calls or emails to ask for money or personal information.

The bank has been made aware of a check cashing scam involving fraudulent checks that appear to be drawn on Hebron Savings Bank. The scam offers to pay people who are willing to “wrap”, or decal their vehicles as part of an advertising promotion. This is a twist on a classic check cashing scam. In the scam, the car owner receives a letter containing a check. The letter instructs the car owner to deposit the check into their bank account and send most, but not all, of the money to a person that is purportedly the graphic artist that will “wrap” their vehicle. The car owner does get to “keep” approximately 20% of the funds for allowing their vehicle to be used in the advertising promotion. The problem is, there is no advertising promotion. The check is fake and will be returned to the car owner unpaid. This means that the car owner is now out the entire amount of the check, including the significant portion sent to the supposed “graphic artist.” Be cautious of anything that sounds too good to be true. In these difficult times, the prospect of earning a little extra cash may be enticing, but anything that involves you depositing a check into your bank account and then sending part of the funds somewhere else is a scam! 

The bank has received information that an email scam is currently circulating that is purportedly from Hebron Savings Bank. In the scam the recipient is alerted to the fact that a large inheritance will be lost unless the recipient quickly responds to the email. Hebron Savings Bank is in no way associated with this or any similar emails. The bank would not use email to contact customers regarding important legal matters. Unfortunately, these sorts of scams are all too common. These “phishing” scams are an attempt to trick you into giving out your personal information and/or to trick you into sending money (often in the form of gift cards).  Remember the old adage, if something is too good to be true, it probably is. Even though the email appears to be from Hebron Savings Bank, the sender’s actual email address is completely unrelated. Never respond to emails similar to the one described or click on any links that the email might contain. If you feel you need to reach out to the sender, then it is best to contact the sender directly by using a phone number or email address obtained using an internet search, and even then, you must still be cautious. Never give out any personal information based on an unsolicited email or phone call. Never send any form of payment (including gift cards) based on an unsolicited email or phone call (while we are on the subject of gift cards…good rule of thumb – anything that involves you having to send gift cards or gift card numbers is a scam).

 

Don't fall prey to Coronavirus tricks!

Banks and Government agencies have noticed a wave of new and evolving phishing schemes in response to upcoming Coronavirus economic impact payments.  Fraudsters may prey upon vulnerabilities of those in financial distress, the elderly, and/or sick individuals. 

Arm yourself against these attempts by knowing how the payments will work:

• The IRS will deposit payments into the direct deposit account taxpayers previously provided on tax returns.
• Those taxpayers who have previously filed but not provided direct deposit information to the IRS will be able to provide their banking information online to a newly designed secure portal on the IRS website in mid-April.
• If the IRS does not have a taxpayer's direct deposit information, a check will be mailed to the address on file.
• Retirees who don’t normally have a requirement to file a tax return will NOT need to file additional documents with the IRS or take any additional action in order to receive their payment. No one from the IRS will be reaching out to ask for any kind of information.  The IRS will automatically send payments to retirees with no additional action on their part.   

Scrutinize requests for information and beware some of the common tricks that scammers may try such as:

• Emphasizing the words "Stimulus Check" or "Stimulus Payment." The official term is economic impact payment.
• Asking you to sign over your economic impact payment check to them.
• Asking by phone, email, text or social media for verification of personal and/or banking information saying that the information is needed to receive or speed up your economic impact payment.
• Suggesting that they can get a tax refund or economic impact payment faster by working on your behalf. This scam could be conducted by social media or even in person.
• Mailing you a bogus check, perhaps in an odd amount, then telling you to call a number or verify information online in order to cash it.

In addition:

• Do not provide your direct deposit or other banking information for others to input on your behalf into the IRS secure portal.
• Do not reply to unsolicited requests for information or engage potential scammers online or on the phone.
• Do call us directly at 410-749-1185 should you have questions about your personal banking information or you think you may have potential fraud on your account.
• Do ensure that any information you read regarding the Coronavirus economic impact payments are from a reliable source.

Reporting Coronavirus-related or other phishing attempts

According to the IRS, those who receive unsolicited emails, text messages or social media attempts to gather information that appear to be from either the IRS or an organization closely linked to the IRS, such as the Electronic Federal Tax Payment System (EFTPS), should forward it to phishing@irs.gov.  Learn more about reporting suspected scams by going to the Report Phishing and Online Scams page on the IRS website.

Official IRS information about the COVID-19 pandemic and economic impact payments can be found on the Coronavirus Tax Relief page on the IRS website. The page is updated quickly when new information is available.

Line-Trapping

 We have received reports from several local banks that scammers may be using something called “line-trapping” to try and trick you into revealing your personal information, including your debit card information. A scammer will call to tell you that something is suspicious, maybe that you’ve been the subject of a fraud attempt or maybe your debit card has been compromised. The scammer then instructs you to immediately call a professional, maybe the police, or maybe the bank’s phone number printed on the back of your debit card, but here’s the trick…in almost all cases the scammer will not give you the phone number they want you to call. Since you get to choose the phone number to call, a known number for the police or maybe the phone number from the back of your debit card, then this has got to be safe, right? What could go wrong? The key is the scammer wanted you to call someone…anyone...right away. The scammer then uses technology to leave the original connection open, even after you hang up the phone. Then when you use your phone to call the police or the bank, the phone number you dialed is ignored because the original connection (the connection that was made when the scammer first called you) is still active – the scammer just sat there on the open line and waited for you to pick up the phone again, but now the scammer “answers” as if they are the police or a bank employee. Now that they have gained your trust, because you made the call to a number you picked, they can start collecting your personal information.

Ways to recognize the scam:

•  It would be very rare that the bank or an official agency would call you just to instruct you to call someone else. If you received such a request, be suspicious.
•  Sense of urgency – if you are told you must call back immediately, then be suspicious.

How to protect yourself:

• Wait a short amount of time before calling the professional. In most cases the line-trapping technology will only leave the connection open for a few minutes, so wait at least 10 minutes before calling the bank or the police.
• If possible, call back using a different phone (different phone number).
• Visit your local branch in-person.

If you think you have been a victim of the line-trapping scam, please contact the bank so that we can block your debit card and issue you a new one.

Read more about Phishing

"Free" Credit Monitoring Solicitation 

The bank has received scattered reports of a company offering to check your credit for free, and the solicitation references Hebron Savings Bank by name. This solicitation is in no way affiliated with Hebron Savings Bank, and the bank in no way endorses or recommends the service. Since only a handful of our customers have reported the issue, we believe the solicitation is likely the result of advertising connected with your web browsing habits, but the examples we have been provided are troubling on several fronts:

• It references Hebron Savings Bank by name. The bank is not connected with or associated with, in any way, this or any other credit monitoring service.

• The solicitation prominently references “data security breach information” that may mislead customers into believing there has been a data breach at the bank if the entire solicitation is not carefully examined. Hebron Savings Bank has never suffered a data breach of any sort. The safety and security of our customers’ personal information will always be our top priority.

• Responding to the offer of a free credit report will require you to provide highly sensitive information and your credit card information. This could be a recipe for disaster. The bank does not recommend, under any circumstances, providing this sort of information for any purpose if you are not absolutely sure that it is being provided to a reputable and secure organization. Again, this solicitation did not originate from Hebron Savings Bank, and is in no way associated with or affiliated with Hebron Savings Bank, so at a minimum, these sort of questionable advertising tactics should bring into question the integrity of any company that would seek to use them.

Never respond to unsolicited requests for your Social Security Number, bank account, credit card number, or other financial data. If you did not initiate the communication, you should never provide any information. Follow this practice even if you receive an e-mail, letter, or phone call from someone claiming to be from your bank.  Do not rely on your phone's caller ID display. Technology exists which allows callers to alter this information.

The IRS and Treasury inspectors have issued warnings about a nationwide phone scam targeting taxpayers. Callers claim to be IRS employees and even alter the caller ID readout to make it look as if the IRS is really calling. Victims are being told they owe taxes and must pay quickly or they will lose their driver's license, be arrested or deported. The IRS NEVER makes unsolicited calls to people to tell them they owe more taxes or are due refunds. If you get one of these calls, DO NOT give them any information! Hang up immediately and file a consumer complaint at www.ftc.gov noting "IRS Telephone Scam".

There is a potential phishing scam targeting debit card holders. An automated telephone message is being delivered to area residents stating that their debit card has been temporarily disabled, deactivated, or expired. THIS MESSAGE IS FRAUDULENT! Hebron Savings Bank would never solicit debit card information through an automated telephone message.

Please consider any attempt to request personal or financial information from you by telephone, text message, email, or websites to be fraudulent unless initiated by you.