Technology Risks Associated with Online Trading

Transcription

1 Technology Risks Associated with Online Trading The Internet allows investors to access account information 24/7, initiate securities transactions from virtually anywhere, and quickly and inexpensively research investment opportunities. But the Internet is not fail-safe. Many criminals use malicious software programs to attack vulnerable computers of online users. These software programs can monitor your computer activity and send information back to the thief's computer. Sometimes, these programs will log your key strokes, which allows criminals to easily obtain username and password information for any of your online accounts, including your brokerage account. Malware Malware, short for malicious software, includes viruses and spyware to steal personal information, send spam, and commit fraud. Criminals create appealing websites, desirable downloads, and compelling stories to lure you to links that will download malware especially on computers that don t use adequate security software. But you can minimize the havoc that malware can wreak and reclaim your computer and electronic information. If you suspect malware is on your computer: Stop shopping, banking, and other online activities that involve user names, passwords, or other sensitive information. Confirm that your security software is active and current. At a minimum, your computer should have anti-virus and anti-spyware software, and a firewall. Once your security software is up-to-date, run it to scan your computer for viruses and spyware, deleting anything the program identifies as a problem. If you suspect your computer is still infected, you may want to run a second anti-virus or anti-spyware program or call in professional help. Once your computer is running, think about how malware could have been downloaded to your machine, and what you could do to avoid it in the future. Malware is short for malicious software; it includes viruses programs that copy themselves without your permission and spyware, programs installed without your consent to monitor or control your computer activity. Criminals are hard at work thinking up creative ways to get malware on your computer. They create appealing web sites, desirable downloads, and compelling stories to lure you to links that will download malware, especially on computers that don t use adequate security software. Then, they use the malware to steal personal information, send spam, and commit fraud. It doesn t have to be that way. OnGuardOnline.gov says consumers can minimize the havoc malware can wreak, and reclaim their computers and their electronic information. Computers may be infected with malware if they:

2 slow down, malfunction, or display repeated error messages won t shut down or restart serve up a lot of pop-up ads, or display them when you re not surfing the web display web pages or programs you didn t intend to use, or send s you didn t write. If you suspect malware is on your computer If you suspect malware is lurking on your computer, stop shopping, banking, and other online activities that involve user names, passwords, or other sensitive information. Malware on your computer could be sending your personal information to identity thieves. Then, confirm that your security software is active and current: at a minimum, your computer should have anti-virus and anti-spyware software, and a firewall. You can buy stand-alone programs for each element or a security suite that includes these programs from a variety of sources, including commercial vendors or from your Internet Service Provider. Security software that comes pre-installed on a computer generally works for a short time unless you pay a subscription fee to keep it in effect. In any case, security software protects against the newest threats only if it is up-to-date. That s why it is critical to set your security software and operating system (like Windows or Apple s OS) to update automatically. Some scam artists distribute malware disguised as anti-spyware software. OnGuardOnline offers a list of security tools from legitimate security vendors selected by GetNetWise, a project of the Internet Education Foundation. Resist buying software in response to unexpected pop-up messages or s, especially ads that claim to have scanned your computer and detected malware. That s a tactic scammers have used to spread malware, and that has attracted the attention of the Federal Trade Commission, the nation s consumer protection agency, as well as a number of state law enforcement agencies. Once you confirm that your security software is up-to-date, run it to scan your computer for viruses and spyware. Delete everything the program identifies as a problem. You may have to restart your computer for the changes to take effect. If you suspect that your computer still is infected, you may want to run a second antispyware or anti-virus program. Some computer security experts recommend installing one program for real-time protection, and another for periodic scans of your machine as a way to stop malware that might have slipped past the first program. Finally, if the problem persists after you exhaust your own ability to diagnose and treat it, you might want to call for professional help. If your computer is covered by a warranty that offers free tech support, contact the manufacturer. Before you call, write down the model and serial number of your computer, the name of any software you ve installed, and a short description of the problem. Your notes will help you give an accurate description to the technician.

3 If you need professional help, if your machine isn t covered by a warranty, or if your security software isn t doing the job properly, you may need to pay for technical support. Many companies including some affiliated with retail stores offer tech support via the phone, online, at their store, or in your home. Telephone or online help generally are the least expensive ways to access support services especially if there s a toll-free helpline but you may have to do some of the work yourself. Taking your computer to a store usually is less expensive than hiring a technician or repair person to come into your home. Once your computer is back up and running, think about how malware could have been downloaded to your machine, and what you could do to avoid it in the future. If your security software or operating system was out-of-date, download the newest version and set it to update automatically. Use the opportunity to back up important files by copying them onto a removable disc. Other ways to minimize the chances of a malware download in the future: Don t click on a link in an or open an attachment unless you know who sent it and what it is. Links in can send you to sites that automatically download malware to your machine. Opening attachments even those that appear to come from a friend or co-worker also can install malware on your computer. Download and install software only from websites you know and trust. Downloading free games, file-sharing programs, and customized toolbars may sound appealing, but free software can come with malware. Talk about safe computing. Tell your kids that some online activity can put a computer at risk: clicking on pop-ups, downloading free games or programs, or posting personal information. Finally, monitor your computer for unusual behavior. If you suspect your machine has been exposed to malware, take action immediately. Spyware Spyware is software installed on your computer without your consent to monitor or control your computer use. Clues that spyware is on a computer include a barrage of popup ads, a browser that takes you to sites you don't want, unexpected toolbars or icons on your computer screen, keys that don't work, random error messages, and sluggish performance when opening programs or saving files. To lower your risk of spyware infections: Update your operating system and Web browser software, and set your browser security high enough to detect unauthorized downloads. Use anti-virus and anti-spyware software, as well as a firewall, and update them all regularly. Download free software only from sites you know and trust. Enticing free software downloads frequently bundle other software, including spyware. Don't click on links inside pop-up windows.

4 Don't click on links in spam that claim to offer anti-spyware software; you may unintentionally be installing spyware. Just when you thought you were Web savvy, one more privacy, security, and functionality issue crops up spyware. Installed on your computer without your consent, spyware software monitors or controls your computer use. It may be used to send you pop-up ads, redirect your computer to websites, monitor your Internet surfing, or record your keystrokes, which, in turn, could lead to identity theft. Many experienced Web users have learned how to recognize spyware, avoid it, and delete it. According to OnGuard Online, all computer users should get wise to the signs that spyware has been installed on their machines, and then take the appropriate steps to delete it. The clues that spyware is on a computer include: Barrage of pop-up ads Hijacked browser that is, a browser that takes you to sites other than those you type into the address box A sudden or repeated change in your computer's Internet home page New and unexpected toolbars New and unexpected icons on the system tray at the bottom of your computer screen Keys that don't work (for example, the "Tab" key that might not work when you try to move to the next field in a Web form) Random error messages Sluggish or downright slow performance when opening programs or saving files The good news is that consumers can take steps to lower their risk of spyware infections: Update your operating system and Web browser software. Your operating system (like Windows or Linux) may offer free software "patches" to close holes in the system that spyware could exploit. Download free software only from sites you know and trust. It can be appealing to download free software like games, peer-to-peer file-sharing programs, customized toolbars, or other programs that may change or customize the functioning of your computer. Be aware, however, that some of these free software applications bundle other software, including spyware. Don't install any software without knowing exactly what it is. Take the time to read the end-user license agreement (EULA) before downloading any software. If the EULA is hard to find or difficult to understand think twice about installing the software. Minimize "drive-by" downloads. Make sure your browser security setting is high enough to detect unauthorized downloads, for example, at least the "Medium" setting for Internet Explorer. Keep your browser updated.

5 Don't click on any links within pop-up windows. If you do, you may install spyware on your computer. Instead, close pop-up windows by clicking on the "X" icon in the title bar. Don't click on links in spam that claim to offer anti-spyware software. Some software offered in spam actually installs spyware. Install a personal firewall to stop uninvited users from accessing your computer. A firewall blocks unauthorized access to your computer and will alert you if spyware already on your computer is sending information out. If you think your computer might have spyware on it, experts advise that you take three steps: Get an anti-spyware program from a vendor you know and trust. Set it to scan on a regular basis at least once a week and every time you start your computer, if possible. And, delete any software programs the anti-spyware program detects that you don't want on your computer. Phishing How Not To Get Hooked by a "Phishing" Scam "We suspect an unauthorized transaction on your account. To ensure that your account is not compromised, please click the link below and confirm your identity." "During our regular verification of accounts, we couldn't verify your information. Please click here to update and verify your information." Have you received with a similar message? It's a scam called "phishing" and it involves Internet fraudsters who send spam or pop-up messages to lure personal information (credit card numbers, bank account information, Social Security number, passwords, or other sensitive information) from unsuspecting victims. According to OnGuard Online, phishers send an or pop-up message that claims to be from a business or organization that you may deal with for example, an Internet service provider (ISP), bank, online payment service, or even a government agency. The message may ask you to "update," "validate," or "confirm" your account information. Some phishing s threaten a dire consequence if you don't respond. The messages direct you to a website that looks just like a legitimate organization's site. But it isn't. It's a bogus site whose sole purpose is to trick you into divulging your personal information so the operators can steal your identity and run up bills or commit crimes in your name. OnGuard Online suggests these tips to help you avoid getting hooked by a phishing scam: If you get an or pop-up message that asks for personal or financial information, do not reply. And don't click on the link in the message, either. Legitimate companies don't ask for this information via . If you are concerned about your account, contact the organization mentioned in the using a telephone number you know to be genuine, or open a new Internet browser session and type in the company's correct

6 Web address yourself. In any case, don't cut and paste the link from the message into your Internet browser phishers can make links look like they go to one place, but that actually send you to a different site. Area codes can mislead. Some scammers send an that appears to be from a legitimate business and ask you to call a phone number to update your account or access a "refund." Because they use Voice over Internet Protocol technology, the area code you call does not reflect where the scammers really are. If you need to reach an organization you do business with, call the number on your financial statements or on the back of your credit card. In any case, delete random s that ask you to confirm or divulge your financial information. Use anti-virus and anti-spyware software, as well as a firewall, and update them all regularly. Some phishing s contain software that can harm your computer or track your activities on the Internet without your knowledge. Anti-virus software and a firewall can protect you from inadvertently accepting such unwanted files. Anti-virus software scans incoming communications for troublesome files. Look for anti-virus software that recognizes current viruses as well as older ones; that can effectively reverse the damage; and that updates automatically. A firewall helps make you invisible on the Internet and blocks all communications from unauthorized sources. It's especially important to run a firewall if you have a broadband connection. Operating systems (like Windows or Linux) or browsers (like Internet Explorer or Netscape) also may offer free software "patches" to close holes in the system that hackers or phishers could exploit. Don't personal or financial information. is not a secure method of transmitting personal information. If you initiate a transaction and want to provide your personal or financial information through an organization's website, look for indicators that the site is secure, like a lock icon on the browser's status bar or a URL for a website that begins " (the "s" stands for "secure"). Unfortunately, no indicator is foolproof; some phishers have forged security icons. Review credit card and bank account statements as soon as you receive them to check for unauthorized charges. If your statement is late by more than a couple of days, call your credit card company or bank to confirm your billing address and account balances. Be cautious about opening any attachment or downloading any files from s you receive, regardless of who sent them. These files can contain viruses or other software that can weaken your computer's security. Forward spam that is phishing for information to spam@uce.gov and to the company, bank, or organization impersonated in the phishing . Most organizations have information on their websites about where to report problems. You also may report phishing to

7 The Anti-Phishing Working Group, a consortium of ISPs, security vendors, financial institutions and law enforcement agencies, uses these reports to fight phishing. Security Tip: Even though a web address in an may look legitimate, fraudsters can mask the true destination. Rather than merely clicking on a link provided in an , type the web address into your browser yourself (or use a bookmark you previously created). Investing Wisely Online Protect your passwords for your online investment accounts. Keep passwords in a secure place, and don t share them on the Internet, over , or on the phone. Use anti-virus and anti-spyware software, and a firewall, and keep them up-to-date. If your firewall was shipped in the "off" mode, be sure to turn it on and set it up properly. Avoid using public or other shared computers to access your financial accounts online, and use extra caution when using your own computer in a wireless hot spot. Don t believe everything you read in online newsletters, investing blogs, or bulletin boards. Fraud artists often float false information and hot tips as part of their efforts to rip-off investors or manipulate the market for a particular security. Turn to unbiased sources when researching investments, such as the U.S. Securities and Exchange Commission, your state securities regulator, and securities industry selfregulatory organizations (including FINRA, Amex, and Nasdaq). How to Use the Internet to Invest Wisely and Avoid Costly Mistakes Securing Your Information The Internet serves as a powerful tool for investors. But hackers and identity thieves can wreak havoc on your personal finances unless you take steps to protect the security of your account numbers, passwords, and PINs. And investment opportunities that sound like no-brainers all too often turn out to be frauds. Protect your personal information. It s valuable. If you get an or pop-up message asking for personal information, don't reply or click on the link in the message. is not a secure way to transmit personal information, and you don t want to risk downloading a virus or piece of spyware that can log your key-strokes when you type in an account number, password, or PIN. The safest course of action is not to respond to requests for your personal or financial information. If you believe there may be a need for

8 such information by a company with which you have an account, contact that company directly in a way you know to be genuine. Don't access your online investment account until you have checked for indicators that the site is secure, like a key or closed padlock icon on the browser's status bar or a website URL that begins https: (the s stands for secure ). Unfortunately, no indicator is foolproof; some scammers have forged security icons. Tip: Even if a web page starts with "https" and contains a key or closed padlock, it's still possible that it may not be secure. Some phishers, for example, make spoofed websites which appear to have padlocks. To double-check, click on the padlock icon on the status bar to see the security certificate for the site. Following the "Issued to" in the pop-up window you should see the name matching the site you think you're on. If the name differs, you are probably on a spoofed site. Protect your passwords. Keep your passwords in a secure place, out of plain view, and avoid storing them on your computer. Don't share your passwords on the Internet, over , or on the phone. Your Internet Service Provider (ISP) should never ask for your password. And if you access your accounts in a public place, be sure to position yourself so that no one can see your hands or your screen as you type your PIN or password. In addition, hackers may try to figure out your passwords to gain access to your computer. You can make it tougher for them by: Using passwords that have at least eight characters and include numbers or symbols. The longer your password is, the tougher it is for a hacker to discover it. Avoiding common words: some hackers use programs that can try every word in the dictionary. Not using your personal information, your login name, or adjacent keys on the keyboard as passwords. Changing your passwords regularly (at a minimum, every 90 days). Not using the same password for each online account you access. Use anti-virus and anti-spyware software, and a firewall, and keep them up-to-date. These programs are a must-have if you make financial transactions online. Look for antivirus software that removes or quarantines viruses, and for anti-spyware software that can undo changes spyware makes to your system; check that both programs will update automatically. If your firewall was shipped in the "off" mode, be sure to turn it on and set it up properly. It s also important to keep your operating system up-to-date with the latest security patches. Use a Security Token (if available). Using a security token can make it even harder for an identity thief to access your online investment account. That's because these small number-generating devices offer a second layer of security a one-time pass-code that typically changes every 30 or 60 seconds. These unpredictable pass-codes can frustrate identity thieves.

9 Use Extra Caution with Public Computers or Wireless Connections. Avoid using public or other shared computers to access your financial accounts online. If you do use one, when you finish a session, log off completely, delete your temporary internet files, and clear your Internet history. Many cafes, hotels, airports, and other public establishments offer wireless networks for use by their customers. These hot spots are convenient, but they may not be secure. Ask the proprietor what security measures are in place. Regardless, if you have personal, financial, or other sensitive information on your computer, you may decide that accessing your online investment account or any account, for that matter through a public wireless connection isn't worth the security risk. Log Out Completely. Closing or minimizing your browser or typing in a new web address when you're done using your online account may not be enough to prevent others from gaining access to your account information. Instead, click on the "log out" button to terminate your online session. In addition, don't permit your browser to "remember" your username and password information. If this browser feature is active, anyone using your computer will have access to your investment account information. Avoiding Investment Scams Online Independently Verify Claims. Never, ever, make an investment based solely on what you read in an online newsletter, bulletin board posting, or blog especially if the investment involves a small, thinly-traded company that isn't well known. It's easy for a company or its promoters to make grandiose claims about new product developments, lucrative contracts, or the company's financial health. Before you invest, make sure you've independently verified those claims. Get started by turning to unbiased sources, such as the U.S. Securities and Exchange Commission (SEC), your state securities regulator, and securities industry self-regulatory organizations (including FINRA, Amex, and Nasdaq). Do Your Homework. Offers to sell securities must be registered with the SEC or eligible for an exemption otherwise the offering is illegal. To see whether an investment is registered, check the SEC's EDGAR database and call your state securities regulator for more information about the company and the people promoting it. The fact that a company has registered its securities and files reports with the SEC doesn't guarantee the company will be a good investment. Likewise, the fact that a company hasn't registered and doesn't file reports doesn't mean the company is a fraud. But many investment frauds, including online scams, involve unregistered securities so always investigate before you invest. Be Skeptical of Self-Provided References. Fraudsters will falsely assure you that an investment is properly registered with the appropriate agency and purport to give you the agency s telephone number so that you can verify that fact. Sometimes they will give you the name of a real agency other times they will fabricate one. But even if the agency does exist, the contact information they provide invariably will be false. Instead

10 of speaking with a government official, you ll reach the fraudsters or their colleagues who will give the company, the promoter, or the transaction high marks. Thoroughly Check Out Promoters and Company Officials. Many fraudsters are repeat offenders. Whenever the SEC sues an individual or entity, the agency issues a "litigation release." Litigation releases going back to 1995 are available on the SEC s website, simply run a search for the promoter, his or her company or newsletter, the company being touted, and its officers and directors. You also can check the licensing and disciplinary history of the person or entity promoting the opportunity by using FINRA s free BrokerCheck service or by calling your state securities regulator. Find Out Where the Stock Trades. Many small, thinly-traded companies cannot meet the listing requirements of a national exchange. The securities of these companies trade instead in the "over-the-counter" market and are quoted on OTC systems, such as the OTC Bulletin Board or the Pink Sheets. Stocks that trade in the OTC market generally are among the most risky and most susceptible to manipulation. Watch Out for High-Pressure Pitches. Beware of promoters who pressure you to buy before you have a chance to think about and fully investigate an investment opportunity. Don't fall for the line that you'll lose out on a "once-in-a-lifetime" chance to make big money if you don't act quickly. Remember: if an opportunity sounds too good to be true, it probably is. Consider the Source and Be Skeptical. Whenever someone you don't know offers you a hot stock tip, ask yourself: Why me? Why is this stranger giving me this tip? How might he or she benefit if I trade? Never forget that the person touting the stock may well be an insider of the company or a paid promoter who stands to profit handsomely if you trade.

11 RISK DISCLOSURE ACKNOWLEDGEMENT By signing below, the undersigned acknowledges that he/she has received the disclosure document Technology Risks Associated with Online Trading and is aware of the special risks inherent in online trading through the Internet. Printed Name Signature Date