I. INTRODUCTION
On March 12, 2004, the FDIC issued a Guidance on Safeguarding Customers against E-Mail and Internet-Related Fraudulent Schemes (FIL-27-2004) to alert financial institutions to the increasing prevalence of e-mail and Internet-related fraudulent schemes that are aimed at financial institution customers. The guidance describes particular schemes and how institutions may assist in protecting their customers from becoming victims of such schemes.
II. SUMMARY OF GUIDANCE
According to the FDIC’s Guidance on Safeguarding Customers against E-Mail and Internet-Related Fraudulent Schemes(FIL-27-2004), typical schemes involve the use of seemingly legitimate e-mail messages and Web sites to deceive consumers into disclosing sensitive information, e.g., bank account information. The perpetrator’s goal includes gaining access to financial accounts, committing identity theft or other illegal acts. Financial institution customers that provide confidential information to criminals engaged in e-mail and internet-related fraudulent schemes face immediate risk. The guidance states that “criminals will normally act quickly to gain unauthorized access to financial accounts, commit identity theft or engage in other illegal acts before the victim realizes the fraud has occurred and takes actions to stop it.” If a financial institution has been impersonated or “spoofed,” that institution is subject to a risk of its reputation, as customers and potential customers may attribute the activity to a weakness in the institution's ability to conduct business securely and responsibly.
III. CUSTOMER EDUCATION INITIATIVES
The guidance suggests that financial institution customers should be educated about prevalent or new e-mail and internet-related fraudulent schemes, e.g. “phishing,” and how to avoid such schemes. Statement stuffers and web site notices may convey messages, such as the following that are listed in the guidance:
Financial institutions may refer customers to or use resources distributed by the Federal Trade Commission (FTC) to explain the red flags and risks of phishing and identity theft, including the following FTC brochure: How Not to Get Hooked by the ‘Phishing’ Scam (published July 2003 and available at http://www.ftc.gov/bcp/edu/pubs/consumer/alerts/alt127.shtm).
IV. MITIGATION OF RISKS
The FDIC also advises that in mitigating risks associated with e-mail and Internet-related fraudulent schemes, financial institutions should implement appropriate information security controls as described in the FFIEC “Information Security Booklet.” Specific actions included in the guidance are:
V. REPORTING FRAUDULENT ACTIVITIES
The guidance advises that a financial institution should promptly notify its FDIC Regional Office and appropriate authorities if an e-mail or Internet-related fraudulent scheme is detected. In addition, a financial institution should also report the incident to the appropriate law enforcement agencies and file a Suspicious Activity Report. Any information about possible fraudulent schemes may also be forwarded to the FDIC’s Special Activities Section, 550 17th Street, N.W., Room F-4040, Washington, D.C. 20429 or transmitted electronically to alert@fdic.gov.