General fraud awareness

Trojans - what are they?

A Trojan takes its name from the term Trojan Horse in Greek mythology and is a type of computer virus that can be installed on your computer without you realising.

The fraudster will try to manipulate you into doing something in order to install the Trojan. These are some of the more common methods used:

• Email attachments - fraudsters send out emails that try to trick you into following a website link, downloading a piece of software or opening an attachment. If you take this action, the Trojan is installed.
• Websites containing executable content (eg a Trojan horse in the form of an ActiveX control).
• Application exploits (eg flaws in a web browser, media player, instant-messaging client, or other software that can be exploited to allow installation of a Trojan horse). This is why it's important to keep your PC applications up to date.
• Software downloads, for example games and free software.
• Bundling (eg a Trojan horse included as part of a software application downloaded from a file-sharing network).

Trojans can be capable of recording passwords and other personal details by capturing keystrokes or taking screen shots of sites you visit. This information is then sent to the fraudsters over the internet.

How to protect yourself

The best way to protect yourself is to install firewalls, anti-virus software and anti-spyware programmes and keep them up to date. In addition:

• Never accept instructions to synchronise your card reader, either online or through any other method. The card reader does not require synchronisation.
• Never accept instructions from anyone asking you to enter an account number and amount into the card reader unless you wish to make that payment.
• Never send confidential information by email. We will never ask you to email personal details, account information or passwords.
• Keep your PIN confidential at all times.

To learn more, visit the UK banking industry's site Bank Safe Online.

Phishing - what is it?

Phishing is a way of attempting to obtain your personal information in order to access your account fraudulently, for example through an email purporting to be from Nationwide (or another financial services institution).

Latest phishing emails in circulation

How to spot a phishing email:

1. Fraudulent / phishing emails will often tell you that they require or demand that you update or confirm your account details in the subject field.
   Nationwide will never ask you to update any information by email.
2. Fraudulent emails are not normally addressed to you personally as all the fraudsters know about you is your email address. It may be addressed to 'Dear Valued Customer' or something equally vague.
   From time to time, we may email you with details of our products and services that we feel may be of interest to you. These emails will always come from nationwide@nationwidebuildingsociety-email.co.uk and will always display your postcode at the top and bottom so you can be sure that it is genuine.
3. Fraudulent emails will include a link that you are asked to click on to take you to the site. The site may look genuine but be assured it is not. The link in the email may be 'spoofed' to look like a genuine Nationwide email address but if you hover over the link it will show the real address you will be directed to in the status bar at the bottom of the window.
   never follow a link to online banking. Always type www.nationwide.co.uk into your browser's address bar and access online banking that way.
4. If you do visit a website after clicking on a link in a phishing email, there are many ways of disguising the true location of a fake website in the address bar. The site address may start with the genuine site's domain name (www.nationwide...), but that is no guarantee that it points to the real site. Other tricks include using numerical addresses, (000.123.123.123), registering a similar address as your bank (w ww.nationwidebank-verify.com), or even inserting a false address bar into the browser window.
5. Many of the links from these fake pages may actually go to the genuine website, but don't be fooled.
6. We are often referred to as Nationwide Bank. We are a building society.
7. Fraudulent emails are often written by people without a good grasp of the English language. There will often be spelling and grammatical errors.

View further examples

To learn more, visit the UK banking industry's site Bank Safe Online

Identity fraud - What is it?

Identity fraud involves fraudsters obtaining key pieces of personal information that they use to pretend to be you. Fraudsters use these personal details to obtain financial services products in your name such as credit cards, loans, state benefits, mortgages and documents such as driving licences and passports. Alternatively fraudsters can use your information to gain access to your existing accounts.

How to protect yourself

Help keep your identity safe by following these steps:

• Always keep important personal documents, plastic cards and chequebooks in a safe and secure place. Without access to this information a criminal will find it very difficult to pretend to be you
• Don`t share personal information unless you are entirely confident you know who you are dealing with
• Safely store or shred your statements, receipts and documents that contain information relating to your financial affairs
• Carefully check bank and card statements, as soon as they arrive. If you find an unfamiliar transaction contact your card company or bank/building society immediately
• Cancel lost or stolen cards immediately
• Contact the supplier if you fail to receive a bank statement, card statement, utility bill or other financial information. Your post is valuable information in the wrong hands
• Redirect your mail to your new address when you move home by contacting Royal Mail Redirection Service on 0845 7740740, visiting your local branch or www.royalmail.com
• Never give out any personal information to unidentified individuals or organisations who contact you by phone, email or face-to-face
• Regularly obtain a copy of your credit report from credit reference agencies such as Equifax or Experian
• Take care when using social networking sites. The most popular ones are actively being used by criminals to harvest users' personal financial details. Fraudsters can obtain a range of personal information such as name; address; birthday; phone number; place of business; income and relationship status. We recommend that if you use such sites, you don’t publicly display detailed personal information that isn’t necessary

What to do if you have been affected

• Call Special Investigations Department on 08457 778833 - option 1, option 1, option 3
• If you have been a victim of identity fraud contact your nearest Police Station or visit www.met.police.uk/fraudalert/section/identity_fraud.htm or www.police.uk
• If you have information about identity fraud contact the police or call Crimestoppers to give information anonymously on 0800 555 111

Useful contacts

APACS has worked closely with the Home Office to develop www.identitytheft.org.uk, which provides practical advice on how to avoid becoming a victim of identity theft and what to do if you become a victim.

www.ukpayments.org.uk - UK Payments Administration Ltd is the new name for the service company providing people, facilities and expertise to the UK payments industry.

www.cifas.org.uk - the UK's fraud prevention service, which enables its members to share information on fraudulent activity to help identify and prevent fraud taking place, including on card accounts.

www.experian.co.uk - a credit reference agency that helps consumers businesses and the public sector manage their credit information.

www.equifax.co.uk - a credit reference agency that provides information to businesses, consumers and the public sector.

www.callcredit.co.uk - a credit reference agency with a range of information services for businesses and individuals.

www.stop-idfraud.co.uk - National Identity Fraud Prevention Week took place in October 2009 which raised awareness of the threat of identity fraud and the simple steps that consumers can take to protect themselves. Please visit this site for more information.

To learn more, visit the UK banking industry's site Bank Safe Online

Card fraud - What is it?

Card Not Present fraud - This usually involves the theft of genuine card details that are then used to make a purchase over the internet, by phone, or by mail order. You as the genuine cardholder may not be aware of this fraud until you check your statement.

Counterfeit card fraud - This occurs when a fake card is created using compromised card details, often stolen by fraudsters from the magnetic stripe of a genuine card.

Cash Machine (ATM) fraud - This can also be a target for fraudsters as a point of card compromise, where they attempt to steal cards or card details by 3 main ways:

• Card-trapping devices - Device inserted into a cash machine card slot, this then retains the card and the fraudster tricks the victim into re-entering the PIN while the fraudster watches. After the card holder gives up and leaves, the fraudster removes the device, with the card and withdraws cash
• Skimming from the magnetic stripe - A skimming device is attached to the cash machine to record the electronic details from the magnetic stripe of the genuine cards as they are inserted. A miniature camera is also hidden overlooking the PIN pad to capture the PIN entered. Fraudsters then use the card details to produce a fake magnetic stripe card, which is then used with the genuine PIN to withdraw cash at cash machines overseas that have not yet upgraded to chip and PIN
• Shoulder surfing - Fraudsters observe the PIN being entered by the cardholder, then steal the card using distraction techniques or pick pocketing, before using the stolen card and genuine PIN

Lost/Stolen fraud - This covers fraud on cards that have been reported by the cardholder as lost or stolen. Lost and stolen cards could be used in shops that do not have chip and PIN equipment, or they could potentially be used to commit fraud via a phone, internet or mail order transaction (i.e. where no PIN is required).

How to protect yourself

• Remember to always keep your card safe and never give it to anyone, particularly in bars and restaurants and especially when abroad - try not to let your card out of your sight when making a transaction
• Pay attention to card expiry dates - If your replacement card hasn't arrived, call your bank or building society to check the status of your new card
• Do not carelessly disregard receipts - tear up or shred them
• Check your balance regularly - i.e. when making a withdrawal or deposit
• Every month check your statement and notify us of any transactions you do not recognise
• Memorise your PIN and Passwords and never disclose it to a third party or write it down
• If you spot anything unusual about an ATM machine don't use it. Never put yourself at risk by attempting to remove any suspect devices from an ATM machine. Report it to your local branch or if the branch is closed report it to your local Police station
• Be aware of others around you when entering your PIN, always remember to shield your PIN
• If the ATM does not return your card report this to Nationwide immediately
• Ensure that you do not use traceable facts about yourself i.e. your date of birth when choosing a PIN or password
• Register for Verified by VISA if you shop online
• Only shop at secure websites - ensure the security icon (the locked padlock or unbroken key symbol) is showing in your browser window before sending your card details
• Always ensure that we have your most recent address and contact numbers on record by visiting your local branch
• Make sure you know who you are dealing with before disclosing card details. If in doubt undertake additional checks before handing over the details
• Use a computer that you know is secure - which means one with up to date anti virus software and a firewall installed. Be particularly wary of making a transaction using internet cafes or public computers
• Card Reader Security - If you're registered for our Internet Banking service, and have a FlexAccount Visa debit card, we'll send you a Card Reader. This generates a unique eight digit passcode using your FlexAccount Visa debit card for you to use to authorise transactions when using our Internet Banking Service. It's a small hand held device which works independently of your PC. It doesn't contain any personal information; it just reads the chip on your card

Additional tips when using cards overseas:

• It's a good idea to take another card or alternative payment method with you so that you are not reliant on just one card
• Make sure you have your card company`s 24 hour contact telephone number
• Always try and use modern ATMs owned by reputable institutions and avoid freestanding ATMs wherever possible

What to do if you have been affected

If you have identified transactions on your account that you do not recognise or have not authorised, then please call Special Investigations Department on 08457 778833 - option 1, option 1, option 1 or from Abroad +44 1793 653000 option 1, option 1, option 1 (Monday - Friday - 08:00am - 17:00pm, Saturday - 09:00am - 15:00pm, Sunday Closed)

Lost, stolen credit card or forgotten PIN (Credit Cards) Call 08457 99 22 22 (24 hours 7 days a week)?International number: + 44 2476 438996

Lost, stolen, damaged card or forgotten PIN (All cards except credit card) Call 08457 30 20 10 (Option 2) 24 hours 7 days a week International number: + 44 1793 656789

Useful contacts

www.apacs.org.uk - APACS is the UK payments association. This site examines its role and different aspects of its work.

www.cardwatch.org.uk - information about how card fraud takes place in the UK, what is being done to prevent it and how you can help prevent yourself from becoming a victim.

www.callcredit.co.uk - a credit reference agency with a range of information services for business and individuals.

www.chipandpin.co.uk - archive information, guidance and downloadable materials about chip and PIN.

www.cifas.org.uk - the UKs fraud prevention service, which enables its members to share information on fraudulent activity to help identify and prevent fraud taking place, including on card accounts.

www.theukcardsassociation.org.uk - the UK Cards Association is the leading trade association for the card payments industry in the UK.

To learn more, visit the UK banking industry's site Bank Safe Online

Cheque fraud - What is it?

There are five common types of cheque fraud in the UK:

Counterfeit cheque fraud - Counterfeit cheques are manufactured or printed on non-bank paper to look exactly like genuine cheques and are drawn by a fraudster on genuine accounts held by the bank.

Forged cheque fraud - A forged cheque is a genuine cheque that has been stolen from an innocent customer and used by the fraudster with a forged signature.

Fraudulently altered cheques - A fraudulently altered cheque is a genuine cheque that has been made out by the payer, but a fraudster has altered the cheque in some way before it was paid in, e.g. by altering the beneficiary's name or the amount of the cheque.

Funds not available - This is a genuine cheque; however there are no funds in the account to honour it.

Overpayment - This is where a customer advertises an item for sale in a magazine or internet and the fraudster sends a cheque for more than the item was advertised for. They then ask the difference to be sent back normally by money transfer (e.g. Western Union - global money transfer service). The cheque subsequently bounces and the customer suffers the loss.

How to protect yourself

• Don't accept a cheque or counter draft from someone unless you absolutely know and trust them. Be wary when accepting a high-value cheque e.g. if you are selling a car. Consider other payment options e.g. cash.
• Counter drafts are not necessarily safe from fraud. If you receive a counter draft in payment for goods, you should wait until the end of day 6 after paying it in to be certain that the cheque is cleared and the money is in your account before you release the goods. A counter draft can be stolen or altered like any other cheque and if it is altered, stolen or counterfeit it will not be honoured.
• Keep your cheque book in a safe place, report any missing cheques to your bank/building society immediately and always check your bank statement thoroughly.
• If you are making a cheque payable to a bank/building society or to a credit card company, you must ensure that you provide sufficient details on the payee. Enter the full details for the account holder in the payee line for example XYZ Bank - J.Jones - Account Number XXX. This helps to guard against fraud. It also helps to ensure the money gets to the right account without unnecessary delay.
• Never pre-sign blank cheques. When writing cheques, be sure to complete all sections, including the payee name, and the amount in both words and figures. To help prevent fraudulent alteration leave as little blank space as possible, if necessary by drawing a line through unused spaces. Include the word `only` after writing the amount in words.

What to do if you have been affected

Call our Special Investigations Department on 08457 778833 - option 1, option 1, option 3 for Banking & Savings Investigations.

Useful contacts

www.oft.gov.uk - provides information and advice for consumers about your rights when shopping, scams to avoid and where to go for help and assistance.

www.bcca.co.uk - the British Cheque Cashers` Association, the trade association of the cheque cashing industry in the UK.

www.dcpcu.org.uk - explains how the specialist Dedicated Cheque and Plastic Crime Unit is tackling plastic card and cheque crime.

www.chequeandcredit.co.uk – the cheque and Credit Clearing Company is a membership-based industry body which manages the cheque clearing system in Great Britain.

To learn more, visit the UK banking industry's site Bank Safe Online

Fraud scams - What are they?

A scam is a scheme designed to con people into handing over money or personal details that can be used to get access to a person’s money, or commit fraud in their name. Scams come in many forms and increase in sophistication as time goes on.

Unfortunately some people are fooled by clever scams but this information should help prevent you becoming a victim. These may be deceptive premium rate competition scams, bogus sweepstakes and lotteries, get-rich-quick schemes or fake health cures.

Investment scams

• Share scams (also known as boiler rooms) - a stranger rings you out of the blue and tries to offer you shares in a company. The company may not exist and you receive no shares, or if it does, you pay an inflated price.
• Affinity fraud - investment scams that target members of a group, such as a community or a religious, ethnic, elderly or professional group.
• Chain letters - letters or emails that contain a list of names and guarantee you a huge return for your small initial investment.

Online scams

• Fund transfer schemes - money laundering scams that tempt you to use your bank account by offering a commission, often in exchange for foreign transfers. These can lure the victim into committing a crime.
• Online fraud (phishing) - emails asking you to confirm your security details. The links in these emails take you to fake online bank websites that record your personal details.

Current scams include:

• Bogus FSA and FOS communications - letters or emails claiming to be from the Financial Services Authority or Financial Ombudsman Service asking for your personal information or money.
• Bank charge cold callers - telephone calls or emails out of the blue, offering to help reclaim bank charges - often claiming to be from the Office of Fair Trading (OFT) – and asking for your personal details.
• Advance fee schemes - letters or emails that offer large rewards for small up front payments.
• Selling - if you are selling something, the buyer will pay you more than you expect by cheque and claim it is an error before asking you to return the overpayment to them. The cheque they gave you then returns unpaid.
• Inheritance Money - if you 'inherit' money from a relative you never knew you had but have to pay some 'fees' to get the money released.
• Job Scams - having taken a new job, you may be sent a salary cheque (before you start work) which is in excess of the amount you are to be paid. You are then asked to return the overpayment to them before the cheque they gave you is returned unpaid.
• Overpaid Tax - telephone calls or emails out of the blue which inform you you have been overpaying tax and that a rebate is due to you. You will be asked for some financial / account details so they can refund you this tax.

How to protect yourself from becoming a victim

Our advice is not to accept cold calls, however persistent a caller may be. Always seek legal or independent financial advice. Again, with emails, if you are not expecting email contact from an organisation or are in doubt about the message, don't reply and don't provide whatever information they are asking for.

Scams often have similar features that may alert you to the fact that they are not genuine:

• If it sounds too good to be true, it probably is. Maintain a healthy level of scepticism.
• If you are asked for money up front to pay unexpected fees (such as customs) before a 'prize' you have won can be released, particularly if you were not aware you had entered the competition in question. You should not have to provide personal details or financial information to claim any winnings.
• If you are asked to provide financial details (e.g. bank account or credit card details) or other sensitive personal information. Be sure you know who you are dealing with before providing them with any information at all. If in doubt just don't respond.
• If you are put under pressure to reply immediately or the money/'prize' will be given to someone else. This may indicate the people you are dealing with are not reputable.
• If you are asked to keep the details of a call secret. Fraudsters will try to prevent anyone finding out about what they have done so that they can continue doing it to other people.

To avoid these scams:

• Never be afraid to simply hang up on a cold-caller who asks you for personal / financial information or puts pressure on you over the phone.
  • If it is a genuine company, they will treat their customers appropriately.
  • If you do have an existing relationship with a company, you can always contact them instead to be sure you are speaking to the right people before proceeding.
• Think hard before parting with your cash - if the deal on offer feels unofficial then consider why that is:
  • Are you being asked to give unnecessary or inappropriate details?
  • Does it sound like you're being recruited to help someone avoid taxes, customs, or fees of some kind?
  • Does it sound like you could be doing something illegal if you go along with it?
• Do not be tempted by offers where you have to pay in advance for something. These scams, including those telling you a prize is waiting for you if you send some money, have become increasingly popular. Don't be fooled.
• Be wary of firms insisting you pay in cash. Any legitimate business should accept payment by a credit or debit card, a cheque or bank transfer. And always ask for a full receipt - if you don't, you have no record of the transaction.
• Seek independent financial advice if you are unsure about an investment or financial product. Investments often carry risks, but you can understand them with the help of a financial adviser.
• Think carefully before making an investment solely on the recommendation of an organisation or religious group you belong to and seek independent financial advice. In addition, a well known con-artist's trick is to say the investment will only pay out significantly to early investors.
• Throw away chain letters and delete chain emails without reading them. If they contain any personal information, shred them. Ignore threats of bad luck if you don't continue the chain - they're simply attempting to scare you. Don't let them. Some bogus emails may threaten that if you do not provide information your account may be closed or at risk. These are likely to simply be scare tactics, but if in doubt contact the company yourself on a publicly available number / email address to ask if the message was from them.
• Charities. It can be difficult to spot a scam claiming to be a charity as there are many legitimate charities that do not need to be registered. If in doubt ask for the annual report and accounts and ensure that the organisation has a postal address instead of a PO Box, and a landline you can call them on, rather than a mobile telephone number. You can also check the status of a UK charity by looking them up on the Charity Commission's website.

What to do if you have been affected?

If you hold accounts with Nationwide and have given out any personal information or account details (e.g. account or card details) in what you believe may be a scam and/or you believe that fraudulent transactions have occurred on one of your accounts, then please report this immediately to Nationwide's Special Investigations department on 08457 778833 option 1, option 1, then option 3.

However, if you have not given out your personal/account details to anyone and there is no suspicious / fraudulent activity on your accounts, you do not need to contact us.

Useful links

http://www.fsa.gov.uk/ - Regulator of all providers of financial services in the UK; Bank of England retains responsibility for systemic risk.

http://www.homeoffice.gov.uk/crime-victims/how-you-can-prevent-crime/telephone-scams/ - Information provided by the government regarding telephone scams.

http://www.consumerdirect.gov.uk/watch_out/ - Information about a range of scams from this government funded consumer advice website.

To learn more, visit the UK banking industry's site Bank Safe Online

http://www.actionfraud.org.uk - A service that is run by the National Fraud Authority - the government agency that helps to co-ordinate the fight against fraud in the UK.