Fraud Information and Security

Transcription

1 Fraud Information and Security Updated: January 13, 2015 How We Protect You At WySTAR Global Retirement Solutions security is a top priority. We understand that your trust in us depends on how well we keep your personal, business, and account information secure. We are committed to your online security. Here is what we're doing to keep your information safe. Individualized password When you sign up for online access, we ask you to create your own username and password to access your accounts. This information is encrypted during transmission. We now allow you to select your own, personal username to sign on, instead of your Social Security number. We strongly recommend that you do not use your Social Security number as a username or password. We may request a participant's online username to authenticate the participant by phone or ; however, we do not request a participant's online password to verify their identity. Our s may include a sign-on link. If there is ever a question regarding the legitimacy of an , participants should sign on from their homepage. Security questions Online users are required to select four security questions and provide answers. If we ever need to confirm your identity, your correct answers to security questions will help us verify it's you. Timed log-off Our website will automatically log you off after 10 minutes of inactivity. This reduces the risk of others accessing your information from your unattended computer. Firewall Our computer systems are protected 24 hours a day by a powerful firewall that blocks unauthorized entry. In order to gain access to authorized information, the Web browser you are using must know the proper protocol, or language, and even then only select information is available. Encryption From the moment account information leaves your computer to the time it enters our system, all online access sessions are encrypted. We employ some of the strongest forms of encryption commercially available for use on the Web today.

2 During any transaction, our encryption turns your information into a coded sequence with billions of possible variations, making it nearly impossible for unwanted intruders to decipher. Our computers possess the proper formulas to turn this code back into meaningful information and complete your transaction. Look for a "closed lock" icon in the lower right-hand corner (Microsoft Internet Explorer) or in the right end of the address bar (Firefox 2) or in the top right corner (Safari) of your browser to determine if encryption is being used on any Web page you are viewing. Any Web address beginning with " " indicates the page you are viewing uses encryption. The "s" stands for "secured." Constant Surveillance Our security team constantly monitors our security systems to help ensure that your accounts are safe and secure. Additional security measures Our layered approach to online security extends beyond a unique username and password, 128- bit encryption, a powerful firewall, technology updates, and continuous surveillance. We have additional security measures that may be activated in response to certain activities or events. If we are suspicious of any online behavior, we may restrict online access to accounts or prevent certain types of transactions. These measures safeguard your identity and your accounts. Further proof of identity may be required before online access is restored. Technology updates To resist constantly evolving online threats, we have adopted proven industry standards for technology to protect your account security. In addition, we collaborate closely with major Internet software manufacturers like Microsoft, Mozilla, and Apple to ensure that new web browsers meet our high security standards and can be included in our list of supported browsers. Common Methods Fraudsters Use Fraudulent s (phishing) Phishing is usually a two-part scam involving s and spoof websites. Fraudsters, also known as phishers, send an to a wide audience that appears to come from a reputable company. This is known as a phish . In the phish , there are links to spoof websites that imitate a reputable company's website. Fraudsters hope to convince victims to share their personal information by using clever and compelling language, such as an urgent need for you to update your information immediately or a need to communicate with you for your own safety or security. Once obtained, your personal information can be used to steal money or transfer stolen money into another account. Use caution if you receive an expressing an urgent need for you to update your information, activate your online banking account, or verify your identity by clicking on a link.

3 These s may be part of a phish scam conducted by fraudsters to capture your confidential account information and commit fraud. Never open attachments, click links, or respond to s from suspicious or unknown senders. If you receive a suspicious from us, report it and delete it. How fraudsters obtain addresses Fraudsters obtain addresses from many places on the Internet. They also purchase lists and sometimes guess addresses. Fraudsters generally have no idea if people to whom they send financial-related phish s are actual account holders. Their hope is that a percentage of those phish s will be received by actual account holders. If you receive a fraudulent that appears to come from WySTAR Global, this does not mean that our computer systems have been breached. Fraudulent websites (phish or spoof websites) Fraudsters may attempt to direct you to spoof websites via s, pop-up windows or text messages. These websites are used to try to obtain your personal information. One way to detect a phony website is to consider how you got to the site. Use caution if you may have followed a link in a suspicious , text message, online chat or other pop-up window requesting your personal or account information. Text-message phishing (smishing) A phishing attempt sent via SMS (Short Message Service) or text message to a mobile phone or device. This tactic is also referred to as smishing, which is a combination of SMS and phishing. The purpose of text message phishing is the same as traditional phishing: convince recipients to share their confidential information. Never take action on a request for your personal or financial information, including account numbers, passwords, Social Security number or birth date. If you receive a text message expressing an urgent need for you to update your information, activate an account, or verify your identity by calling a phone number or submitting information, on a website, do not respond and delete it. These messages may be part of a phishing scam conducted by fraudsters in an attempt to capture your confidential account information and may be used to commit fraud. Telephone or voice phishing (vishing) Known as vishing, or voice phishing, this tactic is a phishing attempt made through a telephone call or voice message. Fraudsters may have the ability to spoof their caller ID so it could appear that the telephone call is coming from a legitimate company. Fraudsters may also have identifying personal information, such as your name, which they may use to make the call appear more authentic. If you are uncomfortable with a phone call that was not initiated by you, ask for the purpose of the call and then hang up. Then, contact the company using legitimate sources such as contact phone numbers found on the company's website, your bank statements, and those listed on your ATM, debit or credit card.

4 Paper mail or fax phishing Some fraudsters still use low-tech methods to obtain your personal and financial information. Phishing attempts can be made through regular mail or fax machines. If you are suspicious about a piece of mail or fax you have received requesting personal or financial information, you should discard it. If you responded to a suspicious mailing or fax and provided confidential information, contact the company the mail or fax appears to be from. Use a legitimate source such as the phone number listed on the company's website, billing statement, or on the back of your ATM, debit or credit card to determine if your information was compromised. Pop-up windows Fraudsters may use pop-up windows small windows or ads to obtain personal information. These windows may be generated by programs hidden in free downloads such as screen savers or music-sharing software. If you encounter a suspicious pop-up window, close it. To protect yourself from harmful pop-up windows, avoid downloading programs from unknown sources on the Internet and always run anti-virus software on your computer. Your Responsibilities If you have registered for online access to your retirement account, you have agreed to additional obligations under the Online Access and Use Agreement. You are responsible for keeping your online username, password, and other account data confidential. What You Can Do When it comes to keeping your personal and financial information safe, it's important to be proactive. Follow these tips to help protect yourself from fraud and identity theft. Protect your identity Safeguard your personal and financial information so that it doesn't fall into the wrong hands. Identity Protection Tips Carry only necessary information with you. Leave your Social Security card and unused credits cards at home in a safe and secure location. Do not provide your Social Security number unless absolutely necessary. Make photocopies (front and back) of vital information you carry regularly and store them in a secure place, such as a safety deposit box. Then, if your purse or wallet is lost or stolen, you have contact information and account numbers readily available. If you are uncomfortable with a phone call that was not initiated by you, hang up or ask for the purpose of the call. Then contact the company using legitimate sources such as contact phone numbers found on the company's website, your bank statements, and those listed on your ATM, debit or credit card. Never provide payment information on a call that you did not initiate. Replace paper invoices, statements and checks with electronic versions, if offered by your employer, bank, utility provider or merchant.

5 Shred documents containing personal or financial information before discarding. Many fraud and identity theft incidents happen as a result of mail and garbage theft. Review your credit report at least once a year to look for suspicious or unknown transactions. You can get a free credit report once a year from each of the three major credit bureaus at Get a copy at any time directly from: o Equifax: or o Experian: or o TransUnion: or Subscribe to a daily credit monitoring service. Promptly retrieve incoming mail and place outgoing mail in a U.S. Postal Service mailbox, instead of your home mailbox, to reduce the chance of mail theft. Consider paperless options for your bills and financial statements. Know your billing and statement cycles. Contact the company's customer service department if you stop receiving your regular bill or statement. Checking Account Security Tips Report lost or stolen cards and checks immediately. Review account statements carefully. Regular account review helps to quickly detect and stop fraudulent activity. Ask about suspicious charges. Limit the amount of information on checks. Don't print your driver license number or Social Security number on your checks. Store new and cancelled checks in a safe and secure location. Carry your checkbook with you only when necessary. Use tamper-resistant checks. Credit Card and Debit Card Security Tips Always keep your credit or debit card in a safe and secure place. Treat it as you would cash or checks. Do not send your card number through , as it is typically not secure. Do not give out your card number over the phone unless you initiated the call. Regularly review your account statements as soon as you receive them to verify transactions. When selecting a PIN, don't use a number or word that appears in your wallet, such as name, birth date, or phone number. Ensure no one sees your PIN when you enter it. Memorize your PIN. Don't write it down anywhere, especially on your card, and never share it with anyone. Cancel and cut up unused credit and other cards. If you receive a replacement card, destroy your old card. Shop with merchants you know and trust. Make sure any internet purchase is secured with encryption to protect your account information. Look for secure transaction symbols such as a lock symbol in the lower right-hand corner of your web browser, or " " in the address bar of the website. The "s" indicates "secured" and means the web page uses encryption.

6 Always log off from any website after a purchase transaction is made with your credit or debit card. If you cannot log off, shut down your browser to prevent unauthorized access to your account information. Safe-keep or securely dispose of your transaction receipts. Be safe online and on your mobile device Whether you're sending s, shopping online, using social media, or just surfing the Web, it's important to keep your account information and identity secure. Follow these tips to avoid compromising your information. Online Security Tips Do not use your Social Security number as a username or password. Change your password regularly and use a combination of letters and numbers. Do not use your retirement website credentials for other online accounts. To change your password: o From your login screen, select Change Your Password o Follow the instructions on the page Protect your online passwords. Don't write them down or share them with anyone. Protect your answers to security questions. Do not write down or share your answers with anyone. We will never ask you to provide answers to security questions via . Use secure websites for transactions and shopping. Shop with merchants you trust. Make sure internet purchases are secured with encryption to protect your account. Look for secure transaction signs like a lock symbol in the lower right-hand corner of your browser or "https" in the address bar. Social media is increasingly popular, but it's a good idea to keep certain personal information private. Avoid sharing personal details that are used by financial institutions to identify you, such as your birth date, home address, mother's maiden name, schools attended/mascots and pet's name. Fraudsters may use this type of information to help gain access to an account since they are common answers to security questions. Always carefully review the privacy options for any social network you join. The privacy options and tools for social networks can be complex and should be reviewed carefully so that there is no disclosure of information you meant to remain private. Keep your browser current The browser software you use to connect to the Internet is an important link in protecting your security online. We recommend that you use one of the supported browsers listed below. Desktop Browser Website Supported Version(s) (as of m-dd-yy) Microsoft Internet Explorer 8.x 11.x Mozilla Firefox Apple Safari Not Supported Google Chrome Up to 29.x

7 Security Tips Be wary of suspicious s. Never open attachments, click on links, or respond to s from suspicious or unknown senders. If you receive a suspicious that you think is a phish, do not respond or provide any information. Delete it. If you respond to a phish with personal or account information, contact the number on your statement or website or you can call the general number at Mobile Security Tips When you use a mobile device for browser or text-based account access, keep these tips in mind: Use the keypad lock or phone lock function on your mobile device when it is not in use. These functions password-protect your device to make it more difficult for someone else to view your information. Frequently delete text messages from your financial institution, especially before loaning out, discarding, or selling your mobile device. Keep your account numbers, passwords, Social Security number and date of birth private. Never share your personal or financial information in a text message, phone call or . If you lose your mobile device or change your mobile phone number, sign on to your retirement account to remove the old number from your Delivery Preferences under My Settings, or call the number on your statement or website or call the general number at Avoid storing your banking password or other sensitive information on your smartphone or in an app where it could be discovered if your phone is stolen. When you finish an online session, always log off. This reduces the risk of others accessing your information from your device. Keep your mobile operating system up to date to ensure the highest level of protection. Before downloading an update to your mobile device be sure to go to the company's website to confirm the update is legitimate. Be cautious when using public hotspots. Carefully consider your Wi-Fi and Bluetooth connection settings, even at a trusted retailer, as fraudsters can spoof the name of reputable hotspots. Applications are programs you can download to your mobile device. Applications or "apps" that let you monitor your finances and conduct certain transactions are increasing in popularity. Download banking applications from reputable sources only to ensure the safety of your account information. For your security, sign off when you finish using an app rather than just closing it. QR codes (quick response codes) are two-dimensional barcodes that can be scanned with a mobile device to provide easy access to online information. Much like links in , QR codes can be used by fraudsters to send you to websites that may request your personal and financial information or could corrupt your mobile device.

8 Treat QR codes with the same suspicion as you would any URL or link you find in an . Use caution on which QR codes to scan, as some may have been tampered with if placed in a public place. Use a QR code scanner from a reputable source that will check links for malicious content. This capability can be found in the app description before downloading. Computer Security Tips Avoid downloading programs from unknown sources. Ensure your computer operating system, software, browser version and plug-ins are current. Before downloading an update to your computer program, first go to the company's website to confirm the update is legitimate. Install a personal firewall on your computer and keep anti-virus software installed and updated. Be wary of conducting online financial activities on computers that are shared by others. Public computers should be used with caution. Online financial activities and viewing or downloading documents (statements, etc.) should be conducted, when possible, on a computer you know to be safe and secure. Configure your devices to prevent unauthorized users from remotely accessing your devices or home network. For example, if you use a home wireless router for your home internet connection, follow the manufacturer's recommendations to configure the router with appropriate security settings. How to Report Identity Theft To report lost or stolen information, or if you have entered personal information in response to a suspicious , pop-up window, or phony Website claiming to be affiliated with us, call the Retirement Service Center listed on your statement or website or call the general number at immediately. The Retirement Service Center is open Monday through Friday, excluding New York Stock Exchange and other holidays. Contact the major credit bureaus You can request that the three main credit bureaus place a short or long-term fraud alert on your credit file. This alert requires creditors to verify your identity before opening any new accounts in your name or changing any existing accounts. You will only need to contact one bureau, which will notify the others. Credit bureaus must provide victims of identity theft a free copy of their credit report. You should request one from each bureau, as the information can differ. Review your credit reports

9 carefully for fraudulent activity. If fraud has occurred, notify the credit bureau and the companies where accounts were opened to report the fraud directly. Once a dispute has been resolved, the credit bureaus you contacted will send you another copy of your credit report. Review the report to make sure that all fraudulent activity has stopped and your file has been corrected. For more information about the steps to take and for credit reports, contact: Equifax: or Experian: or TransUnion: or Contact other creditors Contact your other creditors, including credit card and phone companies, banks, and other lenders, to notify them of potential fraud or identity theft. Consider following up your telephone conversations with a letter. Close any accounts that have been breached and reopen them with new account numbers and passwords. Do not use your Social Security number as a username or password. File a report with the local police Contact your local police department if you suspect that your personal or financial information was stolen. A police report may lend credibility to your case when dealing with creditors, who may require proof of criminal activity. Report the criminal activity to the Federal Trade Commission (FTC) Call the FTC hotline at ID THEFT ( ) to speak with a trained identity theft counselor or you can submit a complaint to the FTC on their website, Contact other agencies as appropriate Postal Inspection Service: If you believe your mail was stolen or redirected, notify your local post office. Social Security Fraud Hotline: If you suspect someone is using your Social Security number for fraudulent purposes, call the hotline. Department of Motor Vehicles (DMV): If you believe someone is trying to get a driver's license or identification card using your name and information, contact your local DMV. Carefully review all your accounts Since identity theft takes time to resolve, you should continue to review all charges and transactions appearing on account statements and online. Immediately report any discrepancies. More information on identity theft and fraud

10 Federal Trade Commission Stop. Think. Connect. Financial Fraud Enforcement Task Force How to Contact Us You may contact the Retirement Service Center listed on your statement or website or call the general number at , Monday through Friday, excluding New York Stock Exchange and other holidays. Fraud Information and Security Updates and Effective Date If we make updates to this Security Statement, we will update the Fraud Information and Security page with the changes and revise the "date of most recent update" posted at the top of this statement. Any updates to the Fraud Information and Security page become effective when we post the updates on the Site or as of the effective date indicated. Your use of the Site following the update to the Fraud Information and Security page means that you accept the updated statements. WySTAR Global Retirement Solutions, a business unit of Wells Fargo Bank, N.A. Links to third-party sites are provided for your convenience. Such sites are not within our control and may not follow the same privacy, security, or accessibility standards as ours. WySTAR Global Retirement Solutions, a business unit of Wells Fargo Bank, N.A., neither endorses nor guarantees offerings of the third party providers, nor are we responsible for the security, content or availability of third-party sites, their partners, or advertisers. Contact Us: WySTAR Global Retirement Solutions WySTAR Global Retirement Solutions Work 9210 Corporate Blvd Suite 300 Rockville, MD PhonePhone: (800) :00am - 5:00pm ET Monday - Friday rsmarketing@wystar.com "Our commitment to excellent service keeps us consistently at the top of our industry in terms of customer satisfaction."

11