Security Tips

1. It is VERY important to choose a strong password. A well-chosen password has two important characteristics; it should be easy to remember and hard to guess.
2. Use a different password for sites that contain financial information from sites that you browse casually or that don't ask for personal information.
3. Do not use people's names, special dates or personal information as passwords. Avoid any combination of characters that friends or acquaintances can easily guess. For example, a password such as "April15" for a TurboTax Online account is not a strong password.
4. Use syllables or acronyms. Avoid using complete words that appear in any dictionary regardless of the language. One option is to start with the first letters of a familiar phrase. For example, "Mary had a little lamb" becomes Mhall, which could be part of a secure password.
5. Mix it up! Use a combination of upper and lower case letters, numbers, and punctuation/special characters, such as &^$#.
6. Keep it to yourself. Do not share your personal password with others. You never know what the future will bring in relationships or coworkers, so do not give your password to anyone.
7. Keep your passwords safe. There are programs available where you can securely store your passwords. Don't write them down in a place where others can find them.
8. Do not use the auto-save feature on your browser.
9. Change your passwords often.

Common Passwords to Avoid:

1. Customer name, family member, or pet's name
2. Social Security, Account, or Phone numbers
3. Any part of your physical address
4. Anybody's birth date
5. Other information that is easily obtained about the user
6. Any username on the computer in any form
7. A word in the English or foreign dictionary
8. A password used on another site
9. Any of the above spelled backwards
10. Out of Wallet or Public Records (e.g. Mother's maiden name)
11. Sequences: "12345678", "222222", "abcdefg"

1. Install and activate a firewall. A firewall is a software program or piece of hardware that blocks communications to and from sources you don't permit. Some operating systems have built-in firewalls. Make sure your firewall is on and that it is updated regularly.
2. Always sign out or log off.
3. Update software frequently and keep systems current.
4. Install and run the most recent version of anti-virus software.
5. Keep your operating system (OS) current.
6. Activate the automatic update feature.
7. Set your browser's security level to the default setting or higher.
8. If you use a wireless network in your home, take precautions to secure it against hackers. Choose a wireless router with an encryption feature and turn it on. Consider turning off your wireless network when you're not using it.

1. Shred receipts, statements, expired cards, and similar documents.
2. Review statements promptly and carefully. Report any suspicious activity immediately.
3. Be positive of the identity of anyone before you divulge personal information, and only if you initiate the contact.
4. Check your credit report at least annually.

1. When making online purchases, use a credit card.
2. Never click on suspicious links.
3. Only give sensitive information to websites using encryption. You can verify this by the URL https://... (the "s" is for secure).
4. Use social media wisely. Don't reveal too much personal information.

1. Avoid storing sensitive information.
2. Use passcodes and lock your device when not in use.
3. Keep software up-to-date.
4. Install remote wipe so it can be cleared if the device is lost or stolen.

1. Protect your debit card and PIN. If it is lost or stolen, report this immediately.
2. Choose a PIN that is different from your address, telephone number, and birthdate.
3. Be aware of people and your surroundings.
4. Put away your card and cash.
5. Observe the card reader; if it appears to be damaged or altered, don't use it. This is called "skimming".

1. Keep your personal information private and secure.
2. Check your account balance regularly.
3. Do not access your account from a public location.
4. If you suspect suspicious activity, report it immediately.
5. Be skeptical of email messages from someone who is unlikely to send an email, such as the IRS.
6. Do not open suspicious emails and do not click on the links. If you do, perform diagnostics on your computer immediately.
7. Don't provide personal or payment information when requested through email.
8. Avoid get rich quick schemes.

1. Monitor accounts frequently (daily as a best practice). Immediately review Wire, ACH, or other transaction confirmations.
2. Implement dual controls and approval for ACH and Wire transfers so that dual approval is required before the transaction is initiated at the Originating Depository Financial Institution (ODFI). Please contact BankFirst if you are interested in this feature.
3. Never share User IDs, passwords, tokens, etc. with anyone. Do not leave them in an area that is not locked/secured.
4. Do not use the same login or password on any other website or software.
5. Obtain and install anti-virus, anti-malware, and anti-spyware software, and consider installation of a firewall (and make sure it is active and automatically updated by the vendor, or take necessary steps to keep it updated.)
6. Limit or eliminate unnecessary web surfing and/or email activity by employees, including personal activity, on computers used for Online Banking.
7. Consider a dedicated computer for Online Banking that is never used for email or general Internet browsing/surfing (cost of computer vs. loss).
8. Educate all company/entity personnel on good cyber security practices, clearing the Internet browser's cache before and after visiting the Financial Institution's website, to avoid having malware installed on a computer. (e.g., if a media player needs to be updated, go to the official media player website to install the update. Clicking on a fake update installation link could just mask a hacker downloading malware onto the computer.)
9. Verify use of a secure session. (https:// and not http://)
10. Avoid saving passwords to a computer.
11. Never leave a computer unattended when using any Online Banking services, and always lock your computer when away.
12. Never access BankFirst's website for Online Banking (or any privileged or sensitive computer system) from a public computer at a hotel/motel, library, coffee house, or other public wireless access point.
13. Be suspicious of any employment position that requires use of a personal account for business purposes. Such offers for employment as a mystery shopper, payment processor, etc., where you are required to use your personal account for someone else's business purposes, are not legitimate.
14. No legitimate business will attempt to move business funds through anyone's personal account, and you should educate yourself on these issues.
15. If you are approached to participate in such schemes, immediately contact local law enforcement, the FBI or the Secret Service to let them know.

1. Enhanced Login Security (Enhanced Multifactor Authentication): Leaving your computer set to "public" when accessing Online Banking will allow for a second factor of authentication. After successfully authenticating with your User ID and Password, a One-Time Passcode (OTP) is sent to your phone. You must then enter this OTP to complete the log in process.
2. Tokens for Online Business Banking: Each user who has online access to Wire Transfers and ACH is issued a token. A code generated by this token is required for file submissions, etc.
3. Trusteer Rapport: This free anti-malware solution isolates the browser process from other processes on the system. Man-in-the-Browser (MitB) malware allows a fraudster to not only steal passwords and User IDs, but also modify the communication between the browser and the banking application. The malware can rewrite the account and payment instructions (such as the payee and amount), without the user's knowledge, in real time. Installing Trusteer's Rapport on your computer can reduce the risk of losses from MitB-based attacks. This offering is strongly recommended for all customers given the nature of the attacks, but it is particularly crucial for users with Wire and ACH transactions authority (Online Business Banking.)
4. Separation of Duty for Online Business Banking: The Separation of Duty control is available for ACH and Wire transactions. With separation of duty, one user has permission to initiate a funds transfer, while a secondary user must approve the transfer. By separating the capabilities in this way, you prevent a scenario where a single user could transfer funds independently without oversight, or where a fraudster could move funds with a single set of user credentials.
5. Limits for Online Business Banking: Organizations should establish limits that restrict the dollar amounts allowed for Wire or ACH transactions. Creating such dollar limits can reveal attempts to violate those limits and reduce single loss expectancies for your organization. Limits may be established at the customer or user level.
6. Activity Reporting for Online Business Banking: On-going data and statistics on the state of online activity is another important best practice for security. Administrators should run activity reports on a daily basis to scan for logins from unidentified IP addresses during off-hours.
7. Text and Email notifications: These notifications offer a fast and easy way to help protect your BankFirst accounts from fraud. Enable one or more of our many alerts to stay on top of your account activity.