Identifying Fraudulent Emails - Phishing
Identifying Fraudulent Emails - Phishing
Phishing is usually an email with a malicious attachment or an email with links that will take you to malicious websites.
How to Identify Fraudulent Emails
The first step is to make sure your computer is secure as possible. Install anti-virus software from a reputable source and always keep it up to date. Periodically check the computer to make sure the most current updates for your applications are installed.
If you receive an email from an unknown, suspicious sender do not open or respond. Be especially careful and do not click on links contained in emails from unknown senders as these types of links often contain harmful malware that may allow intruders to compromise your computer, laptop, tablet or smartphone.
Phishing is usually an email with a malicious attachment or an email with links that will take you to malicious websites. In either case, if you open the attachment or go to the website, it is highly likely that software will be secretly installed on your computer for the purpose of stealing your information. In some cases the unauthorized software may turn your computer into a base to spread even more malicious software to other users on the internet or in your company. Phishing emails are sent out to thousands of recipients in the hope that a small percentage of the recipients will fall for the trick and install the software.
Fraudsters who use phishing hope to convince victims to share their personal information by using clever and compelling language, such as an URGENT need for you to update your information IMMEDIATELY (“We will shut down your account if you do not log on today and update your password!”) or a need to communicate with you FOR YOUR OWN SAFETY OR SECURITY (“We have determined that your computer is not protected and you need to install our software to prevent further infections!”). Phishing emails also prey on user’s feelings (“I’m at a funeral and need to transfer money”, “I was on a trip in Europe and was mugged” or “My husband died, left me a large sum of money and I need your help to move it out of the country.”) Once obtained, your personal information can be used to steal your identity, your money or transfer stolen funds into another account.
How Fraudsters Obtain Email Addresses
Fraudsters obtain email addresses from many places on the internet including long email trails shared among friends. They also purchase email lists and will guess at email addresses. Fraudsters generally have no idea if people to whom they send banking-related phish emails are actual bank customers. Their hope is that a percentage of those phish emails will be received by actual bank customers.
***If you receive a fraudulent email that appears to come from First Republic Bank, this does not mean that your email address, name, or any other information has been taken from First Republic Bank’s systems. In any case, WE WILL NEVER EMAIL YOU AND REQUEST YOUR CONFIDENTIAL PERSONAL IDENTIFYING OR ACCOUNT INFORMATION INCLUDING YOUR USER IDENTIFICATION, PINS OR OTHER CONFIDENTIAL INFORMATION.
Pop-Up Windows
Fraudsters may use pop-up windows – small windows or ads – to obtain personal information. These windows may be generated by programs hidden in free downloads such as screen savers or music-sharing software. To protect yourself from harmful pop-up windows, avoid downloading programs from unknown sources on the internet and always run anti-virus software on your computer.
Never take action on an email request for your personal or financial information, including account numbers, passwords, Social Security Number or birth date. Use caution if you receive a text message expressing an urgent need for you to update your information, activate an account, or verify your identity by calling a phone number or submitting information on a website. These messages may be part of a phishing scam conducted by fraudsters in an attempt to capture your confidential account information and may be used to commit fraud.
Manipulating Email and Online Banking Accounts
Criminals break into email and online banking accounts using several different techniques. For example, if you log into a public Wi-Fi hotspot, criminals can monitor your internet communications and steal your user name and password as you access your accounts. If you received a phishing email and unknowingly opened a malicious attachment or clicked on a deceptive link, the criminal could have downloaded software to your computer that monitors your activity, including when you type in your user name, password or debit/credit card number. If you use the same password for all your online accounts, a criminal may be able to break into one of the websites that you use, steal your user name and password and then try to log into other popular internet sites using your user name and password. If you use simple, easy to guess passwords, you increase the risk that criminals can guess your password and access your account.
There are numerous international crime rings that specialize in stealing passwords to email and online banking accounts and selling them to the highest bidder. While only a small percentage of accounts are actually broken into each year, the effects can be devastating.
If a criminal is able to break into your email account, they will surf the messages looking for sensitive information that they can exploit, such as communications with financial institutions. Once they understand how you communicate with your bank, they will craft deceptive emails that will be sent to the bank in an attempt to have funds moved to the criminal’s account.
There are several telltale indicators that a criminal may have accessed your account:
If you notice any of these types of activity with your First Republic Bank account, please contact the Bank as soon as possible.
Sources of Further Information
The following sites may provide you with further help in identifying fraudulent emails:
Millions of fraudulent emails are sent and circulated daily. They claim to come from a wide variety of sources, including First Republic. These emails are known as phish emails and the fraudsters sending them are known as phishers.
At First Republic Bank, we take the security of our customer’s financial information very seriously. We work around the clock to monitor phishing activity and close fraudulent websites. Our customers are valuable partners in reporting and helping to prevent fraud.
The emails below are provided solely to give you an idea of what fraudulent emails may look like. First Republic Bank did not send them, and our systems have not been compromised in any way.
Fraudulent Email Example 1 (subject lines vary)
SUBJECT: NOTIFICATION FOR CUSTOMER OF E-MAIL ADDRESS CHANGE
E-MAIL CHANGE NOTIFICATION
Dear Customer!
Thank you for banking online at firstrepublic.com. Our records indicate that you recently added or made a change to one of your email address(es). This notification is to confirm that you initiated this change.
If you feel you have received this email in error and did not add or change your email address(es), please click here.
Sincerely,
Online Banking Team
Fraudulent Email Example 2 (subject lines vary)
SUBJECT: REGARDING YOUR First Republic Account
Dear First Republic customer,
We have noticed that you experienced trouble logging into First Republic Online Banking.
After three unsuccessful attempts to access your account, your First Republic Online Profile has been locked. This has been done to secure your accounts and to protect your private information. First Republic is committed to making sure that your online transactions are secure.
To unlock your account, and verify your identity please follow this link and sign in
Sincerely,
First Republic
Online Customer Service
Fraudulent Email Example 3 (subject lines vary)
SUBJECT: PERIODIC ACCOUNT REVIEW
Dear customers:
First Republic is constantly working to increase security for all Online Banking users. To ensure the integrity of our online payment system, we periodically review accounts.
Your account might be place on restricted status. Restricted accounts continue to receive payments, but they are limited in their ability to send or withdraw funds.
To lift up this restriction, you need to login into your account (with your username or SSN and your password), then you have to complete our verification process. You must confirm your credit card details and your billing information as well. All restricted accounts have their billing information unconfirmed, meaning that you may no longer send money from your account until you have updated your billing information on file.
To initiate the billing update confirmation process, please follow the link bellow and fill in the necessary fields:
Thank you,
First Republic - Online Banking
The first step is to make sure your computer is secure as possible. Install anti-virus software from a reputable source and always keep it up to date. Periodically check the computer to make sure the most current updates for your applications are installed.
If you receive an email from an unknown, suspicious sender do not open or respond. Be especially careful and do not click on links contained in emails from unknown senders as these types of links often contain harmful malware that may allow intruders to compromise your computer, laptop, tablet or smartphone.
Phishing is usually an email with a malicious attachment or an email with links that will take you to malicious websites. In either case, if you open the attachment or go to the website, it is highly likely that software will be secretly installed on your computer for the purpose of stealing your information. In some cases the unauthorized software may turn your computer into a base to spread even more malicious software to other users on the internet or in your company. Phishing emails are sent out to thousands of recipients in the hope that a small percentage of the recipients will fall for the trick and install the software.
Fraudsters who use phishing hope to convince victims to share their personal information by using clever and compelling language, such as an URGENT need for you to update your information IMMEDIATELY (“We will shut down your account if you do not log on today and update your password!”) or a need to communicate with you FOR YOUR OWN SAFETY OR SECURITY (“We have determined that your computer is not protected and you need to install our software to prevent further infections!”). Phishing emails also prey on user’s feelings (“I’m at a funeral and need to transfer money”, “I was on a trip in Europe and was mugged” or “My husband died, left me a large sum of money and I need your help to move it out of the country.”) Once obtained, your personal information can be used to steal your identity, your money or transfer stolen funds into another account.
How Fraudsters Obtain Email Addresses
Fraudsters obtain email addresses from many places on the internet including long email trails shared among friends. They also purchase email lists and will guess at email addresses. Fraudsters generally have no idea if people to whom they send banking-related phish emails are actual bank customers. Their hope is that a percentage of those phish emails will be received by actual bank customers.
***If you receive a fraudulent email that appears to come from First Republic Bank, this does not mean that your email address, name, or any other information has been taken from First Republic Bank’s systems. In any case, WE WILL NEVER EMAIL YOU AND REQUEST YOUR CONFIDENTIAL PERSONAL IDENTIFYING OR ACCOUNT INFORMATION INCLUDING YOUR USER IDENTIFICATION, PINS OR OTHER CONFIDENTIAL INFORMATION.
Pop-Up Windows
Fraudsters may use pop-up windows – small windows or ads – to obtain personal information. These windows may be generated by programs hidden in free downloads such as screen savers or music-sharing software. To protect yourself from harmful pop-up windows, avoid downloading programs from unknown sources on the internet and always run anti-virus software on your computer.
Never take action on an email request for your personal or financial information, including account numbers, passwords, Social Security Number or birth date. Use caution if you receive a text message expressing an urgent need for you to update your information, activate an account, or verify your identity by calling a phone number or submitting information on a website. These messages may be part of a phishing scam conducted by fraudsters in an attempt to capture your confidential account information and may be used to commit fraud.
Manipulating Email and Online Banking Accounts
Criminals break into email and online banking accounts using several different techniques. For example, if you log into a public Wi-Fi hotspot, criminals can monitor your internet communications and steal your user name and password as you access your accounts. If you received a phishing email and unknowingly opened a malicious attachment or clicked on a deceptive link, the criminal could have downloaded software to your computer that monitors your activity, including when you type in your user name, password or debit/credit card number. If you use the same password for all your online accounts, a criminal may be able to break into one of the websites that you use, steal your user name and password and then try to log into other popular internet sites using your user name and password. If you use simple, easy to guess passwords, you increase the risk that criminals can guess your password and access your account.
There are numerous international crime rings that specialize in stealing passwords to email and online banking accounts and selling them to the highest bidder. While only a small percentage of accounts are actually broken into each year, the effects can be devastating.
If a criminal is able to break into your email account, they will surf the messages looking for sensitive information that they can exploit, such as communications with financial institutions. Once they understand how you communicate with your bank, they will craft deceptive emails that will be sent to the bank in an attempt to have funds moved to the criminal’s account.
There are several telltale indicators that a criminal may have accessed your account:
- You see suspicious activity in your financial accounts;
- You receive an unexpected notice that your email or online banking password was changed or that the address for mailing financial statements was changed; or
- You are locked out of your email or online banking account and you are sure you used the correct password.
If you notice any of these types of activity with your First Republic Bank account, please contact the Bank as soon as possible.
Sources of Further Information
The following sites may provide you with further help in identifying fraudulent emails:
- Federal Trade Commission: “How to Avoid Getting Hooked by a ‘Phishing’ Scam”
- Internal Revenue Service: “Suspicious Emails and Identity Theft”
- Apple: “Identifying Fraudulent ‘Phishing’ Email”
Millions of fraudulent emails are sent and circulated daily. They claim to come from a wide variety of sources, including First Republic. These emails are known as phish emails and the fraudsters sending them are known as phishers.
At First Republic Bank, we take the security of our customer’s financial information very seriously. We work around the clock to monitor phishing activity and close fraudulent websites. Our customers are valuable partners in reporting and helping to prevent fraud.
The emails below are provided solely to give you an idea of what fraudulent emails may look like. First Republic Bank did not send them, and our systems have not been compromised in any way.
Fraudulent Email Example 1 (subject lines vary)
SUBJECT: NOTIFICATION FOR CUSTOMER OF E-MAIL ADDRESS CHANGE
E-MAIL CHANGE NOTIFICATION
Dear Customer!
Thank you for banking online at firstrepublic.com. Our records indicate that you recently added or made a change to one of your email address(es). This notification is to confirm that you initiated this change.
If you feel you have received this email in error and did not add or change your email address(es), please click here.
Sincerely,
Online Banking Team
Fraudulent Email Example 2 (subject lines vary)
SUBJECT: REGARDING YOUR First Republic Account
Dear First Republic customer,
We have noticed that you experienced trouble logging into First Republic Online Banking.
After three unsuccessful attempts to access your account, your First Republic Online Profile has been locked. This has been done to secure your accounts and to protect your private information. First Republic is committed to making sure that your online transactions are secure.
To unlock your account, and verify your identity please follow this link and sign in
Sincerely,
First Republic
Online Customer Service
Fraudulent Email Example 3 (subject lines vary)
SUBJECT: PERIODIC ACCOUNT REVIEW
Dear customers:
First Republic is constantly working to increase security for all Online Banking users. To ensure the integrity of our online payment system, we periodically review accounts.
Your account might be place on restricted status. Restricted accounts continue to receive payments, but they are limited in their ability to send or withdraw funds.
To lift up this restriction, you need to login into your account (with your username or SSN and your password), then you have to complete our verification process. You must confirm your credit card details and your billing information as well. All restricted accounts have their billing information unconfirmed, meaning that you may no longer send money from your account until you have updated your billing information on file.
To initiate the billing update confirmation process, please follow the link bellow and fill in the necessary fields:
Thank you,
First Republic - Online Banking