Trust is key to any relationship. Cybercriminals count on that when they spoof a webpage.
Scammers create uniform resource locators (URLs) containing subtle misspellings (nbarizona.com vs. nboarizona.com) or using unusual extensions (.com vs. .cam). They also add phrases to legitimate domains (support-nbarizona.com or nbarizona.com[info]) to lure you in. From there, it's just a matter of continuing to make the phony website look like the real deal.
Whether you're looking at a webpage or a login window, examine the URL carefully.
Avoid the fakes
Help protect yourself by dodging dodgy pages altogether. Follow these tips:
- Use a spam filter.
- Don't click links and attachments in emails.
- Go directly to financial institutions’ websites using official web addresses and then save the addresses in favorites.
- Avoid using links from Google, Bing or other browsers. Fraudsters pay to have their phishing site show at the top of the search results.
- Review the URL carefully and look for minor misspellings, extra characters or any other modifications. For example, if the legitimate URL is yourbank.com, the hacker may make a minor change like adding an extra letter, such as yoursbank.com.
- Use a password manager, which can log you into websites, generate passwords and help validate certain websites.
- Update multi-factor authentication (MFA) destination to short message service (SMS) or phone. This offers increased protection and near real-time notification of profile changes.
- Update alert settings to add mobile SMS (mobile or land line) notifications for mandatory and security alerts.
- Install malware and anti-virus software.
- Use online and/or mobile banking to regularly monitor accounts for unusual activity.
If it isn’t legit, don't click it
What if you click a link in an email or a browser search lands you on a fishy page? Follow these tips:
- A hypertext transfer protocol secure (HTTPS connection is not the same as a safe website. You can use Google’s Safe Browsing tool to check whether you should trust an HTTPS website.
- Reputable online retailers accept major credit cards and other payment options. If your only options are PayPal, Western Union, gift cards or cryptocurrencies, press pause on your purchase.
- Look for the Contact Us and FAQ sections. If those sections are missing or there is no physical address or phone number, stop.
- Legitimate services will have many reviews on sites like Trustpilot. If the site isn't listed, has few reviews or they say it's fake, run the other way.
- Run a WHOIS check to see the registrar's name, contact info and domain's age.
- Paste the URL into a fake website checker, like Google’s Safe Browsing tool. It will determine whether it's safe to visit.
Fell for a phony?
- Report it, even if you didn't lose money or data. You can report scam websites to law enforcement and file a complaint to the Federal Bureau of Investigation's Internet Crime Complaint Center. You can also report them to the browser host.
- Lost money? File a police report.
- Stolen banking details? Contact your bank to block credit cards and accounts.
- Stolen personally identifiable information? Report it to the police, your bank, credit bureaus, Social Security Administration and Federal Trade Commission.
- Stolen password? Change it to something more secure and enable two-factor authentication.
- Scammer accessed your personal device? Change your passwords, inform your bank and scan for malware.
Act fast to help protect your information
If you are a National Bank of Arizona client and suspect that someone has gained access to important personal information, such as your login credentials, bank account number or your Social Security Number, and may use that information for illegal purposes or to withdraw money from your account, speak with your banker or call 800.497.8168.
Learn more about shopping safely online and other cybersecurity topics in National Bank of Arizona’s Security Center