Savings Bank of Maine

WATERMARK IMAGE

Q. Why do I need this new security feature?

A. Savings Bank of Maine is proud to deliver the highest level of security for our Internet Banking customers. We’re adding an additional layer of security to our log in process. This helps ensure that your information is secure, protecting you from fraud and identity theft. On the Internet today, fraudsters attempt to gain access to your information in many ways, including impersonating the Web sites you trust. We are committed to protecting you and your information against these threats. This feature helps us do that. This new level of security helps you guard against fraudulent online activities like “Phishing” and “Pharming”, through which unsuspecting account holders are tricked into divulging their user names and passwords on phony websites. These phony websites have been designed to resemble those of their actual financial institution.

Q. What do Phishing and Pharming mean?

A. Phishing, (pronounced fishing) is the attempt to fraudulently acquire sensitive information, such as passwords and credit card details. The act of sending an email to a user falsely claiming to be a legitimate enterprise in an effort to scam the user into surrendering private information is a common way of obtaining this information. The email may state something like “Your account will expire if you do not log on and update your profile” The email would contain a false link for you to follow and most likely look like a legitimate website. Pharming (pronounced farming) is a hacker’s attack aiming to redirect a website’s traffic to a bogus website.

Q. How does it work?

A. Every time you log in to Online Banking, Savings Bank of Maine identifies you, and it lets you identify Savings Bank of Maine using a secret image (watermark). When you access Online Banking, you will first enter your Online Banking ID on our homepage. Your Personal Image will appear to the left of the page, verifying you have entered Savings Bank of Maine’s website. It is important that you NEVER enter your password without seeing your secret image. Once you view your image, you may enter your password on the same screen. You will then be directed to your homepage with your personal account information. Your image should always remain in the left bottom corner.

Q. How do I choose my secret image and can I change it?

A. In the near future you will choose your own secret image from our library during sign-on. You may change your secret watermark image at anytime by clicking on the image. If the image does not appear, do not enter ANY personal information. You may not upload your own Personal Image. Images only from our specific library may be used.

Q. Has my password changed?

A. No. You can still use your current password for logging in to Online Banking.

Q. Where do I enter my password?

A. The login process has improved – you must still enter your password, but not until we give you the opportunity to verify that you are at the correct Website.

Q. How will I know that I am not at a fraudulent site?

A. Previously you logged into Online Banking using your Online Banking ID and Password. Now, you’ll also use an image. Your image helps you identify that you are on our website, not a fraudulent one.

Q. What should I do if my image is missing or incorrect?

A. Do not enter your Password and immediately call us at (207)582-5550, or 1-888-424-4184, Option 7.

Q. I am not an Internet expert. How easy is this new security feature to use?

A. Our new login solution is extremely simple for anyone to use. You don't need to memorize anything new—just use the site as usual and look for your secret image at login.

Q. Why do I need this new security feature?

A. Savings Bank of Maine is proud to deliver the highest level of security for our Internet Banking customers. We’re adding an additional layer of security to our log in process. This helps ensure that your information is secure, protecting you from fraud and identity theft. On the Internet today, fraudsters attempt to gain access to your information in many ways, including impersonating the Web sites you trust. We are committed to protecting you and your information against these threats. This feature helps us do that. This new level of security helps you guard against fraudulent online activities like “Phishing” and “Pharming”, through which unsuspecting account holders are tricked into divulging their user names and passwords on phony websites. These phony websites have been designed to resemble those of their actual financial institution.

Q. What do Phishing and Pharming mean?

A. Phishing, (pronounced fishing) is the attempt to fraudulently acquire sensitive information, such as passwords and credit card details. The act of sending an email to a user falsely claiming to be a legitimate enterprise in an effort to scam the user into surrendering private information is a common way of obtaining this information. The email may state something like “Your account will expire if you do not log on and update your profile” The email would contain a false link for you to follow and most likely look like a legitimate website. Pharming (pronounced farming) is a hacker’s attack aiming to redirect a website’s traffic to a bogus website.

Q. How does it work?

A. Every time you log in to Online Banking, Savings Bank of Maine identifies you, and it lets you identify Savings Bank of Maine using a secret image (watermark). When you access Online Banking, you will first enter your Online Banking ID on our homepage. Your Personal Image will appear to the left of the page, verifying you have entered Savings Bank of Maine’s website. It is important that you NEVER enter your password without seeing your secret image. Once you view your image, you may enter your password on the same screen. You will then be directed to your homepage with your personal account information. Your image should always remain in the left bottom corner.

Q. How do I choose my secret image and can I change it?

A. In the near future you will choose your own secret image from our library during sign-on. You may change your secret watermark image at anytime by clicking on the image. If the image does not appear, do not enter ANY personal information. You may not upload your own Personal Image. Images only from our specific library may be used.

Q. Has my password changed?

A. No. You can still use your current password for logging in to Online Banking.

Q. Where do I enter my password?

A. The login process has improved – you must still enter your password, but not until we give you the opportunity to verify that you are at the correct Website.

Q. How will I know that I am not at a fraudulent site?

A. Previously you logged into Online Banking using your Online Banking ID and Password. Now, you’ll also use an image. Your image helps you identify that you are on our website, not a fraudulent one.

Q. What should I do if my image is missing or incorrect?

A. Do not enter your Password and immediately call us at (207)582-5550, or 1-888-424-4184, Option 7.

Q. I am not an Internet expert. How easy is this new security feature to use?

A. Our new login solution is extremely simple for anyone to use. You don't need to memorize anything new—just use the site as usual and look for your secret image at login.

SECURITY CHALLENGE QUESTIONS

Q. Why is the new Online Banking Security System necessary?

A. The Internet Banking enhancement is Savings Bank of Maine’s response to Federal Financial Institutions Examination Council (FFIEC) guidelines, which recommend that all financial institutions utilize multiple methods to identify electronic banking users (also known as multifactor authentication) to help prevent fraud. Today’s single-factor methods of authentication (such as ID-password systems) can make sites more vulnerable to account fraud and identity theft.

Q. How will the update affect my use of Internet Banking?

A. With the new update, you will be required to set up three questions (called Challenge Questions) and provide answers that only you would know. Once online, the new security system will work in the background to establish your technological fingerprint as it analyzes your online activities. The system will build your unique profile based upon the computers you use, the time of day you log in, your IP address, and other characteristics. If your activities online match your profile (i.e. technological fingerprint), it is unlikely that a challenge question will be asked. However, if you sign on at an unusual time of the day, conduct a transaction that is outside of your regular patterns, or use an unrecognized computer (such as at the public library), the bank may ask a challenge question.

Q. How do I establish my challenge questions?

A. Starting sometime in February, we will present a special screen after you log in to Internet Banking. This screen will request that you select and answer three questions. This activity will take just two or three minutes to complete and will provide an additional level of protection for your valuable information.

Q. Why am I being asked challenge questions for my normal activities?

A. While the security platform is new, it is possible that you will be asked challenge questions when conducting your normal online activities. It will take a few online sessions for the system to analyze your online habits and behaviors. Once your profile is established, challenge questions should occur only when your activities do not appear to match your technological fingerprint.

Q. Why was this particular security system selected?

A. We felt that it was important to choose a security system that not only met the regulatory guidelines, but also provides opportunities to improve upon them. We also believe the online security platform selected will offer the necessary safeguards in the most unobtrusive manner available.

Q. Won’t the new challenge questions take up more of my time online?

A. We recognize that these new security measures may create additional steps for customers when conducting certain online activities. Just as travelers are getting used to airport screening procedures, we believe most bank customers will welcome and understand that additional security is needed in order to help protect their account information.

Savings Bank of Maine's Online Banking system uses industry-standard technology including password-controlled entry, Secure Sockets Layer (SSL) protocol, data encryption, public-private key pair, firewalls and filtering routers. Each security component acts as a layer of protection to safeguard sensitive data from unauthorized users.

This system requires customer identification through a private login ID and Password before you can get into the front-end of the system. You should keep this login ID and Password absolutely private. Click on Protect your Online Banking ID and Password for important information about your responsibilities in protecting access to your Online Banking accounts.

Once you have logged on correctly, you will enter a secure environment in which you can conduct your transactions. The browser automatically secures the session using Secure Socket Layer (SSL) protocol. With SSL, data that travels between the bank and customer is encrypted and can only be decrypted with what is called the public and private key pair. As Netscape, the developers of the technology, put it, "Data that is encrypted with the public key can be decrypted only with the private key. Conversely, data encrypted with the private key can be decrypted only with the public key. This asymmetry is the property that makes public key cryptography so useful".

Finally, once requests arrive at the data center, the server is protected by a series of firewalls and routers, which verify the source and destination of the requests traveling in information packets. The firewall is set up to reject any unauthorized traffic. This reemphasizes the importance of the Password, which is the only legitimate entry into the program. The firewall "opens holes only when necessary and closes them back down as soon as useful work is completed". The purpose of the router is to keep out traffic that does not emanate from one of the only two legitimate ends of a secured transaction: the customer or the bank.

No Savings Bank of Maine employee, or employee of any company affiliated with Savings Bank of Maine will contact you via email or phone requesting your Online Banking ID or Password. If you are contacted by anyone requesting this information, please contact us immediately.

You can help us keep your information secure by protecting your Online Banking Login ID and Password.

Don’t use obvious numbers or easily accessible information for your Login ID and Password.
Ensure that no one is watching when entering your Login ID and Password.
Don’t record your Login ID and Password on paper. Try to memorize them, if possible.
If you do record your Login ID and Password, keep them in a safe, secure location.
Do not share your Login ID and Password with anyone.
Review your account information often. Report any unusual activity immediately.
If you’ll be away from your computer for any length of time, log out of Online Banking.
Never give account information to anyone over the telephone unless you’ve initiated the call.

You should always guard your Online Banking ID and Password from unauthorized use. If you share this information with someone, all transactions they initiate with the information are considered authorized by you, even for transactions you did not intend for them to make.

There’s a new type of Internet Piracy called “Phishing”. It’s pronounced “fishing,” and that’s exactly what these thieves are doing, “fishing” for your personal financial information. What they want are account numbers, passwords, Social Security numbers, and other confidential information that they can use to loot your checking account or run up bills on your credit cards.

In the worst case, you could find yourself a victim of identity theft. With the sensitive information obtained from a successful phishing scam, these thieves can take out loans or obtain credit cards and even driver’s licenses in your name. They can do damage to your financial history and personal reputation that can take years to unravel. But if you understand how phishing works and how to protect yourself, you can help stop this crime.

Here’s how phishing works – In a typical case, you’ll receive an e-mail that appears to come from a reputable company that you recognize and do business with, such as your financial institution. In some cases, the e-mail may appear to come from a government agency, including one of the federal financial institution regulatory agencies. The e-mail will probably warn you of a serious problem that requires your immediate attention. The e-mail will then encourage you to click on a button to go to the institution’s Web site.

In a phishing scam, you could be redirected to a phony Web site that may look exactly like the real thing. Sometimes, in fact, it may be the company’s actual Web site. In those cases, a pop-up window will quickly appear for the purpose of harvesting your financial information. In either case, you may be asked to update your account information or to provide information for verification purposes: your Social Security number, your account number, your password, or the information you use to verify your identity when speaking to a real financial institution, such as your mother’s maiden name or your place of birth.

If you provide the requested information, you may find yourself the victim of identity theft.

How to Protect Yourself

1. If you get an e-mail or pop-up message that asks for personal or financial information, don't reply and don't click on the link in the message.

2. If you receive a phone call from a company or financial institution you do business with asking for your personal or account information, do not give them any information. Instead, get the person's name and phone number where you can call them back. Then call the business and verify whether or not the call was legitimate.

3. Use anti-virus software and a firewall, and keep them up to date.

4. Don't e-mail personal or financial information. Regular email is not a secure method of transmitting personal information. However, Savings Bank of Maine's online banking area is secure, and is marked by the indicators that state the site is safe: a lock icon on the browser's status bar and a URL that begins with "https:" (the "s" stands for "secure").

5. Review credit card and bank account statements as soon as you receive them to check for unauthorized charges.

6. Be cautious about opening any attachment or downloading any files from e-mails.

Report any suspicious activity to the Federal Trade Commission. If you get spam that is phishing for information, forward it to spam@uce.gov. If you believe you've been scammed, file your complaint at www.ftc.gov, and then visit the FTC's Identity Theft Web site at www.consumer.gov/idtheft to learn how to minimize your risk of damage from ID theft. Visit www.ftc.gov/spam to learn other ways to avoid email scams and deal with deceptive spam.

Here are ten safety tips to help you protect your personal information and avoid identity theft.

1. Check your credit report. The Fair Credit Reporting Act requires each of the three national credit reporting companies to provide consumers with a free copy of their credit report once every 12 months (visit www.annualcreditreport.com).

2. If you bank or pay credit cards on-line, avoid passwords that include personal information, such as mother’s maiden name or date of birth. Instead, use something unique that only you know.

3. Don't give out personal information over the phone, through the mail, or on the Internet unless you've initiated the contact and are sure you know who you're dealing with. If you must share personal information, confirm that you are dealing with a legitimate organization.

4. Don’t use your Social Security Number on your driver’s license or other forms of identification.

5. Banks will not ask you to verify personal information over the phone or via email. If you receive a phone call or email asking you to verify information, end the call, do not respond, and call the bank directly.

6. If you receive an e-mail asking for personal information, do not hit the reply button or click on any website link in the e-mail. Instead, go directly to the sender's website by typing in the sender's website address.

7. Protect your personal information. Don’t leave sensitive documents containing personal information where anyone can see it.

8. Use a shredder before disposing of personal records, especially financial records – preferably a cross-cut shredder (thieves have been known to paste together single-shred documents to obtain information).

9. When going on vacation, temporarily stop mail delivery; the U.S. Postal Service will hold mail for you.

10. Don’t use an automatic log-in feature on your computer.