AVOID FRAUDS

• Computer threats

  WHAT MALWARE MEANS?

  Malware (short for “malicious software”) is a generic term and refers to any malicious software that was designed to run unauthorized and hidden from the computer user.

   

  WHAT TROJAN MEANS?

  A Trojan is a malware program that is often presented to the user as a legitimate program, the user being tricked, often through social engineering, to download and execute the malicious application on his computer. Once activated, the Trojan allows the attacker to control and monitor the victim's computer or access sensitive information (passwords, pictures, etc.) stored on it.

   

  WHAT “KEYLOGGER” MEANS?

  Keystroke logging, English “keyloggers”, are programs designed to record user-clicked keys and use them, for example in Trojans, to obtain sensitive information such as passwords, PIN codes, card numbers, etc. These programs run in the background and are invisible to an ordinary user. They can be installed on a computer as a result of a drive-by-download attack or can be installed with pirated programs.

   

  WHAT ADWARE MEANS?

  Adware is a form of malware that downloads or displays unwanted ads when the user is browsing online, also, it collects marketing or other information without the user's knowledge, and redirects user’s searches to different websites displaying advertisments.

  Adware applications are automatically installed with some free software that you install from the Internet or most often "come with" pirated programs.

   

  WHAT “DRIVE-BY DOWNLOAD” MEANS?

  A "drive-by-download" attack refers to unintentional download (without user knowledge) and without observing malware on a computer or mobile terminal. Typically, such an attack succeeds due to lack of security updates (e.g., browser or operating system updates).

   

  WHAT "MAN-IN-THE-MIDDLE" MEANS?

  A "man-in-the-middle" attack is a sophisticated attack in which the attacker interferes as a "transit station" in the communication between two systems, the legitimate user "having the impression" that the two systems actually discuss when, in fact, the attacker actually controls the whole conversation, being able to intercept and modify the messages exchanged by the two parties. Using such an attack, the attacker could modify data of financial transactions.

   

  WHAT "MAN-IN-THE-BROWSER"MEANS?

  A “man-in-the-browser” attack is a type of "man-in-the-middle" attack by which a proxy Trojan infects a web browser by using browser security vulnerabilities. The Trojan modifies web pages, elements of a transaction, or even the entire transaction, all of these actions occurring "in the background" without the user observing. Such an attack could be countered by using a transaction verification method that uses a "channel" (another transmission medium, e.g. SMS) different from the one used to initiate the transaction. (e.g., web).

• Social engineering threats

  Social engineering is the art of manipulating, lying, or influencing others to perform / not perform certain actions or divulge confidential information.

  It is somewhat similar to a truism of gaining confidence or simply fraud. This term is usually applied to those who use tricks to gather information or access information systems; in some cases the attacker never comes face-to-face with the victim.

   

  Here are some of the most popular types of social engineering

   

  WHAT PHISHING / SMSIHING MEANS?

  In computer science, phishing is a form of criminal activity that consists in obtaining confidential data, such as access credentials (username, password, PIN, OTP) for financial applications or credit card information, using techniques for handling the identity of a person or an institution.

   

  A phishing attack is normally represented by the sending of an email by the attacker, using instant messaging programs (e-mail) - PHISHING or phone (SMS) – SMSishing, in which the user is advised to enter access credentials (user name, password), card numbers, PINs, etc.

   

  An example of phishing: You get an email telling you that you have won a trip abroad and all you need to do to get your travel voucher is to enter (on a site similar to the bank's) the following information to confirm identity: your name, address, and card details.

  An example of smsihing: You receive a text message from an unknown number that claims to be your bank and which invites you to download a new version of the mobile banking application.
  ATTENTION! Most likely, in this case, you will download and run a malware that will allow the attacker to control and monitor your mobile phone, including capturing access credentials for the legitimate online banking application.

   

  WHERE DO THEY HAVE MY EMAIL ADDRESS AND PHONE NUMBER FROM?

  Most of the time this information is collected from public sources (e.g., ad sites), but also from databases made public by security breaches of various online services where you provided that contact information. This information is frequently exchanged or re-sold by attackers for use in phishing attacks.

   

  HOW DO THEY KNOW WITH WHICH BANK I WORK?

  Attackers do not know this, but if they send out many unsuspecting messages they definitely reach people working with the bank in the phishing message, if people are not careful they provide the attackers with the information they are looking for.

   

  WHAT TO DO IF I RECEIVE A SUSPICIOUS EMAIL OR SMS?

  It is best to delete it directly, especially if it has links or attachments. Also, whenever you have suspicions about the origin of a message (email or sms), it is a good idea to contact the bank using the contact details presented on the "Contact" page on the bank's website.

   

  WHAT VISHING MEANS?

  Vishing is a term derived from voice and phishing and is a form of fraud by which the user is tricked to provide sensitive information, access credentials, card numbers, or access codes in order to impersonate the user or to use information in other social engineering attacks.

  An example of vishing: You get a phone from a person who claims to be a bank employee who wants to verify the card number, PIN or security code of the card because a security alert has been initiated.

   

  WHAT “CEO FRAUD” MEANS?

  Another type of attack under the Social Engineering category is "CEO Fraud" or "Business Email Compromise (BEC)" (Fraudulent emails about changing payment instructions). The attacker manages to compromise a company's email server or create an email box similar to the official company's target. Eventually changing a letter: zero (0) instead of O letter.

  The attack is initiated by well-trained computer personnel who have the means and knowledge to access unauthorized emails of an entity (individual or legal) and manipulate them as they wish. Particularly exposed are people who do not have security software (e.g. anti-virus) or who access emails from strangers that contain suspicious links or attachments.

  The consequence that the attacker manages to penetrate / have all the electronic correspondence of the data subjects is that any commercial / personal information carried through this medium becomes accessible and can be used for fraudulent purposes.

  The attacker uses this false identity to inform by email the business partners of the company about the change of billing accounts. Usually the person who is impersonated is the company's director or financial director. In the sent email, the Chief Financial Officer informs that from now on, payments to the company will be made to a new account, which is at the disposal of the attacker. The business partner, without suspecting the fraud and without performing any additional checks, makes the payment to the indicated account, thus making the money available to the attacker.

   

  To prevent such situations, we recommend that you:

   

  • Avoid, as far as possible, using unprotected electronic mail for commercially sensitive or confidential business information (IBANs, passwords, payment details, etc.);
  • Always use antivirus software to protect your computers;
  • Do not make payments to new accounts you have not previously used based on instructions received by email and without first checking the validity of these accounts with your partners through other communication channels that are not related to electronic mail. , The criminals are betting on the absence of this verification, so if you do it, you will successfully counter the fraud attempt. Checking is by no means done by e-mail or by means of e-mail suggestions - we advise you to contact your partners directly via secure and known means (telephone / fax numbers that you have used in the past);
  • If you made a payment to a wrong account, please contact your bank urgently to find out if it is still possible to block / refund the amounts involved.

  We also encourage you to notify the local police as soon as possible if you think you have been the victim of such a fraud attempt.

   

  FRAUD ON ONLINE SALES

  There may be situations where people wanting to sell certain goods or products turn to different on-line platforms owned by companies dealing with the intermediation of internet exchanges (online sales / purchase websites, online markets, etc.). After a transaction concluded on such a platform, the seller receives an email from the buyer. In this message, the buyer asks the seller to send the item sold by mail, usually to destinations in the African continent (but not only).

  In order to determine the seller to ship the product before receiving the purchase price, the potential buyer includes a false payment confirmation in the e-mail. Erroneously it follows that the bank transfer payment was done and that the seller ca take possession of the money only after he proves that he has shipped the product to the address indicated by the false buyer. Such fraudulent transaction confirmation messages may include the bank's logo or name, or even the names of employees of the bank.

  Another version of this type of fraud is when the potential buyer tries to convince the seller to send along with the sold product a sum of money representing the equivalent of a fictive fee he would have had to pay for the transaction and would recover the money at the end of the transaction that would take place after proof of the shipment and the amount of money requested. In reality, the seller is deceived and no amount of money reaches him.

   

  To prevent such situations, we recommend that you:

  • Make transactions only on the known online mediation platforms
  • Carefully check the buyer's reputation and what transactions he has made in the past (when possible)
  • Communicate with your business partner and other channels not just by email (e.g., phone, video call)
  • Carefully check the terms and conditions of the platform that mediates the sale
  • Inform you of the risks that may appear from such a transaction

   

  We inform you that this type of message is an attempt of fraud / deception, and Credit Europe Bank does not provide such payment services.

  Credit Europe Bank and / or its employees have not been and are not involved in any way in confirming such transactions and we recommend that all those who receive such emails immediately interrupt communication with the sender.

  Credit Europe Bank and / or its employees did not send such messages, and the use of the logo and names of Credit Europe Bank employees in these situations is unauthorized and therefore fraudulent.

  We also encourage you to notify the local police as soon as possible if you think you have been the victim of such fraud attempt.

• Threats at communications terminals

  The terminals (computers, laptops, tablets, mobile phones, etc.) used by you to perform electronic transactions represent important elements that need to be properly secured. Often, the attackers target these terminals in the hope that they are not sufficiently protected and by compromising them they manage to perform fraudulent transactions and to obtain material gains (to your detriment / damage).

  Therefore, we recommend you a series of steps to consider in securing different terminals:

   

  1. Computer/ Laptop

  Install on your computer/ laptop only valid license applications (commercial or free) and from safe sources (e.g. manufacturer's website, CDs / DVDs purchased with your computer / laptop). Most of the time a pirated software downloaded from a non-trusted source also hides a malware!

  Try as far as possible using computers / laptops and modern operating systems (latest versions of Windows, Linux, etc.). Modern operating systems have their completely new security controls, and they are turned on by default (they do not have to be activated by the user after installation). Many of these security controls can prevent or limit the impact of many of the informatics attacks.

   

  The providers of operating systems or applications periodically publish updates to address security issues or improve security controls. That’s why it’s indicated:

  • Ensure that the automatic update mechanism for the operating system is enabled. Generally, this is the default option in the installation process.

  • Ensure that the automatic updating mechanism for applications that have this functionality is enabled (e.g., Office applications - Microsoft Office, web browsers - Internet Explorer, Safari, Google Chrome, security - antivirus, antimalware , etc.).

  Install a security solution that offers at least anti-virus, anti-malware and anti-phishing protection. The complex security solutions also provide firewall and IPS (Intrusion Prevention System) prevention of computer attacks as well as secure web browsing. It is important that the security solution is periodically updated with the latest anti-virus signatures. Also, check that computer scans are performed automatically (e.g. every week).

   

  Avoid using accounts with administrator privileges at the operating system level. Create a low-privileged account for common activities (web browsing, document editing, email reading, etc.). Accounts with administrative privileges should only be used for tasks such as installing / uninstalling applications or configuring security parameters. Using Administrator Privilege accounts in common tasks (e.g. web browsing) allows attackers to take full control of the computer in case of a successful computer attack. This can happen without the user observing.

  Don’t connect unknown devices to your computer (e.g. USB sticks found in public places). These devices may be left or "forgotten" by the attackers intentionally. These may contain viruses (or other malicious code), and when connected to your computer they can automatically infect these devices, and the attacker will take over the entire control of the station.

  You should block the workstation when you leave it by pressing WIN and L (Windows + Lock) at the same time.

  Use the automatic screen saver operating system options when your computer or laptop is not used for a while. You can enable Screen Saver to 10 minutes of inactivity, and when prompted, ask the user to enter the password.

  Disable network connections that are not used, for example if you have a wired connection, disable wireless options - WiFi, Bluetooth. This eliminates possible intrusion channels that a potential attacker could use to gain access to your computer.

  Make regular updates to applications on your computer, especially Flash Player, Java, and applications used to view PDF files. All of these elements are potential attack vectors that can be used to compromise your PC.

  Don’t forget to back up your data on an external support periodically (once a week or once a month). This practice can help you to recover your files (pictures or documents) as a result of a hard disk hardware problem or if you have been the victim of a "ransomware" attack (restricting access to files by encrypting them).

  It is also important that the external data storage medium used for saving dates (e.g. a USB stick or portable hard disk) is not permanently connected to the computer but only when you backup. Otherwise, it could be infected with malware and the data saved on it may be altered or encrypted, thus losing its ability to help restore compromised files!

  Statistically, people start backing up data only after they lose important files. Don’t wait until it's too late and make a backup as soon as possible.

  Don’t use other computers that don’t belong to you (Internet Café, hotel, airport or "friends") when you make bank transactions because they can already contain malicious programs (intentionally or unintentionally installed) that can capture your login data and / or bank details.

   

  2. Smartphone/ Tablet

  Protect your smartphone or tablet using one of the available security options (PIN, password, or "graphic sign"). If the equipment is lost or stolen, the information on it is protected against unauthorized access.

  When possible, update your operating system on your smartphone or tablet (Android, iOS, Windows). Generally, equipment manufacturers using the Android operating system offer customized versions of it (Samsung, LG, HTC, etc.). If Google (the Android manufacturer) publishes a security update that fixes a security issue, the update will not automatically install on devices that use customized versions of the operating system. That's why it's important to keep track of new updates and install them manually. These vulnerabilities can be resolved only when the manufacturer of the device (Samsung, LG, HTC, etc.) publishes a new custom version of the Android operating system.

  Install applications only from official app stores (Google Play, Apple App Store, and Microsoft Store). Applications from unknown stores may also contain malicious code (malware) that can infect you and compromise the security of your device. For example, along with the downloaded application, you can install a Trojan malware that can steal the credentials of the mobile banking application, as well as OTP (One Time Passcode) received via SMS required to authorize 3D Secure payments.

  To prevent as much as possible malware infection, it is recommended that you protect your phone or tablet with an antivirus application. It is also recommended to check the "permissions" that applications require when installing. Malicious applications can ask for additional permissions that may affect the security of your device.

  Disable the connectivity options (Wi-Fi, Bluetooth, NFC, etc.) that you are not currently using. Eliminate the possible intrusion channels that a potential attacker could use, furthermore save battery life and extend the life of your device.

  Avoid "jailbreak" (iOS) or "root" (Android). As a result, the operating system may no longer work properly (may be blocked more often), the battery will be consumed faster, malware will be installed more easily, and the security updates and manufacturer support will no longer work or available for this terminal.

  Avoid leaving portable equipment (telephones, tablets, laptops) unsupervised in the public spaces (cafes, restaurants, airports) or in the car (dashboard or chairs).

  Whenever possible, secure the data stored on mobile devices by applying an encryption mechanism. Carefully keep the encryption keys, because without them you cannot recover the information you have stored in them.

• Threats on card payment

  Keep your bank card with the same care you keep your ID. Save your Personal Identification Number (PIN) - never write it down. Don‘t keep this number next to the card, written on the phone or elsewhere where it can be read by another person. Don’t communicate this number to anyone, not even family members.

  If you choose to keep the document from the bank, through which you have been told your PIN, you shouldn’t keep this document in the same place as the card - it isn’t recommended to keep the document.

  If you choose to create a new PIN or change the one you have been given, avoid obvious choices such as your birthday or your family’s members.

  It is recommended you use a different PIN for each card you own. It is also recommended that you immediately sign on the signature strip on the back of the card after receiving it from the bank.

  It is recommended you keep a secure list of your card numbers, along with the contact numbers you need to notify if they have been lost or stolen. A card number can be stored secured under the following form 4256 03XX XXXX 1234.

  When you are starting an internet transaction, the following data is required:

  • Card type: Visa, MasterCard, etc.
  • Name (as it appears on the card)
  • The card number (the 4 groups of 4 digits on the card)
  • Card expiration date (found under the card number and is of the form ll / aa)
  • CVV2 (Card Verification Value) or CVC2 (Card Verification Code), this is a 3-digit security code and it is printed on the back of the card. It can also be found on the Internet under names such as the Card Security Code / Verification Code, etc.
  • OTP password or OTP code for "3D Secure" transactions (Verified by Visa, or MasterCard Secure code), if the card is enrolled in such a system.

  All this information, except the 3D Secure Password, is on the card, so you must keep the card safe it and don’t give the opportunity to get this information from others.

  The 3D-Secure password or the One Time Password (OTP) unique code is safety features, anti-fraud, developed by VISA and MasterCard. Using this system increases the security of online transactions because the OTP password or unique code (or both) is required for each online order via the 3D Secure system.

   

  The issued cards by Credit Europe Bank (Romania) S.A are enrolled in the 3D Secure system.

  The advantages of 3D Secure are:

  • Reducing the risk of fraud due to the fact that only the person who knows the 3D Secure password or who knows the OTP code created unique for that 3D Secure transaction (and received via SMS, token or other channels) can trade online on the sites that use this antifraud system;
  •  If your 3D Secure card data is fraudulently used by a third party to order on a merchant's site that does not use this protection system, you will win the disputed amount of the transaction.

  Do not respond to the emails that appear to be sent by the bank, where sensitive card details (card number, expiration date, CVV2 / CVC2 code, 3D Secure Password or PIN code) are required under the pretext of checks, modifications, prizes, collecting information to observe legislative changes etc.

  When you shop online, try buying from well-known merchants who enjoy good reputation.

   

  The cards issued by Credit Europe Bank (Romania) SA aren’t enabled by default for Internet payments. Enable this option only if you plan to make payments on the Internet with that card, by using CreditEuropeNet or CEBLine. After making the payments, we recommend you to disable this option using the two above options.

• Threats about using wireless networks (WiFi)

  Avoid connecting your laptop or smartphone to an unsecured wireless network. Free Wi-Fi networks (restaurants, cafes, airports) are the most vulnerable if they are not properly secured. When you connect to an insecure network, any person in the reach of the network may intercept your traffic and "see" certain information that has been transmitted unsecured. If you still need to connect to such a network, avoid entering passwords or using online financial services.

  Do not leave the home router unsecured and do not use the WEP security protocol. This protocol is not safe, and an attacker can get it to the wireless network and intercept traffic on this network.

  It is recommended you use the WPA2 protocol, set a password as long as possible, and change the wireless network's default name (SSID).

  Change the factory preconfigured password for the router's administration and configuration interface using another powerful password because the initial passwords are easy to find on the internet and can be used by malevolent people who have access to your network to modify maliciously certain settings such as DNS (which may be threatened by a "DNS Pharming" attack - where even if you manually and correctly enter your bank or financial institution's web address directly into your browser or access it through the latest bookmark - you will actually open a malicious clone site without realizing that you are not on the bank's real site - this type of attack is even more dangerous than the Phishing attack because there are no ways to identify the malicious site).

• Threats about using social media

  Avoid the online disclosure of sensitive information (personal information, financial information (card series, card expiration date, CVV, access to internet banking credentials), location information etc.) on social media sites (Facebook, Twiter, Instagram, etc.).

  Use privacy options (these options are specific to every site) and limit the exposure of personal information to the online environment. In general, be mindful of any information you publish on social networking sites. This information can be used by attackers; for example, there are known cases of homes broken by criminals, because the owners had posted pictures, comments, vacation locations on social sites, basically informing them that they are not home for a while.

  Pay attention to the people you contact online. Anyone can create an account on social sites (Facebook, Twiter, Instagram, etc.), assuming another identity.

  Be suspicious when contacted by friends or known people in the online environment (emails, messaging on instant messaging apps) when their behavior is unusual. For example: You receive messages that contain just a URL or one with links or attachments, but without any other explanation or in an unusual language for your friend / acquaintance. Think of the person in question might be having a compromised account and the attacker is trying to get in touch with you (for example, to infect your computer).

  Avoid as much as possible short links (hxxp: //goo.gl/dBICml). Without a prior check, you cannot know which site redirects you to that link. You can be redirected to a compromised site that hosts malware.

   

  Warning!

   

  CreditEuropeNet will never ask you all the digits of your debit card.

  Credit Europe Bank employees will never ask you to disclose your password and user code. In such a case please contact immediately CreditEuropeNet support service (telephone numbers: 0801 004 444 or 0750 202 000 or e-mail address: net@crediteurope.ro)!
  Credit Europe Bank will never send you email or SMS on which you are asked to access URLs or links in order to connect to the CreditEuropeNet service!

   

• Frauds with debit/credit cards

  Debit / credit cards are flexible and fast payment instruments, but the benefits can be easily undone when malevolent people manage to take possession of the data stored on the magnetic tape of the card and of the PIN. Worldwide, most fraud cases are due to the skimming phenomenon.

   

  What is skimming?

  Copying data stored on the magnetic tape of the card, using special electronic devices. This operation can be performed either at the ATM or POS.

   

  ATM skimming

  How do we know?

  • • ATM skimming is done by attaching a copying device at the card insertion slot in order to copy the information from the magnetic tape and a fake keyboard or a tiny video camera to record the PIN;
    • The ATM is installed in withdrawn places. As much as possible is recommended to be used those ATMs with which you are familiar or which are mounted in banking agencies where video cameras are installed;
    • Check if the ATM presents unusual issues (scratches, traces of duct tape), especially the keyboard and the right side of the device containing the card insertion slot. (You can easily drag them to see if they are removable).
    • Check around the ATM in order to see if various accessories exist (supports, shelf boxes, flyers, forms) or tiny video cameras are installed.
    • In case of suspicion, please inform the Bank which holds the ATM.

   

   

  POS skimming

  How do we know?

  • For POS skimming, the card is first passed through the POS where you make the payment and then on a similar device that is meant to copy the information on the magnetic tape.
  • Pay close attention when using the card for these types of traders: restaurants, gas stations, hotels or casinos.
  • When you make a payment at POS, do not leave your cards unattended and always s keep it in your visual range.
  • Ask the dealer's receipt for each transaction.
  • Cover the keypad when you enter the PIN.

   

   

  What we should do to protect ourselves?

  • The PIN code must be saved. It will not be marked or kept with the card;
  • The PIN code is confidential. Once it was introduced, the customer consents to such transaction;
  • The PIN code must not be disclosed to any other person, including family members, police and employees of the Bank;
  • Do not set the PIN code based on personal data: birthdays, age, etc.;
  • Do not accept "help" from other people when you make a transaction at the ATM;
  • Check the card statement for identification of any unauthorized transactions and report them immediately to your bank by phone at CebLine: 0801.000.000, 0750.000.000;
  • If you make transactions over the Internet you should check the terms and conditions before making payment to the trader and print a copy of the order. Also, you should make credit card transactions only on secure websites that contain the format “https://";
  • If you suspect that the identification data of your card: the card number, expiration date, security code CVV2, CVC2 (three-digit code, located on the back of the card that can be used to make transactions via the Internet or by mail order, phone, fax) came into the possession of unauthorized persons we recommend to request the replacement of the card.
  • To ensure the security of transactions via the Internet we advise you to use the 3D Secure service. Enrollment in this service offers increased security in Internet transactions
  • Immediately report lost / stolen card or any other unauthorized transactions by phone at CebLine 0801.000.000, 0750.000.000.

   

  What is CEB doing to protect your credit cards?

  As a result of continuous efforts to improve our products, CEB (Romania) SA has begun issuing cards that include an EMV-based chip technology (these cards have a chip containing all the information previously stored on magnetic tape).

  This technology provides added security and comfort in using the card, both at ATMs and for payments to merchants.

• Scams based on cryptocurrency trading platforms

  There may be situations where attackers contact users of payment services such as Internet Banking or Mobile Banking, claiming to be representatives of a crypto-asset platform (Binance, for example) and causing them to:

  • to provide confidential payment data (card data, passwords to Internet / Mobile Banking applications, 3D Secure, unique payment codes received via SMS (OTP codes - One Time Password) etc).

  • to install on the computer or mobile phone applications that allow third parties remote access to that device (for example, TeamViewer, AnyDesk, etc.).

  The attackers propose to the users of payment services such as Internet Banking or Mobile Banking to become "customers" / "users" of the trading platform or, if they are already customers, to communicate to them the profit recorded as a result of the trading activity on the respective platform. 

  The attackers offer so-called advice to get big profits with small investments and manage to convince their victims to invest in crypto-assets by guiding them during the phone call:

  • to install a cryptocurrency trading application on the device;

  • to install a "remote control" type application on the device (for example, TeamViewer or AnyDesk);

  • to open an account on the trading platform and initiate operations to purchase crypto assets (this way a link will be made in the trading platform with the victim's payment instrument allowing the initiation of subsequent payments within the platform with that payment instrument, without additional authorization being required);

  • to transmit information regarding OTP codes or other authentication elements.

  The clients of the trading platforms targeted by the attackers will receive, from the latter, proposals to provide support in the withdrawal of the profit recorded as a result of the trading activity on the crypto assets platform. Thus, victims are manipulated into providing sensitive payment data, such as: card data, access passwords to Internet Banking or Mobile Banking applications, 3D Secure, unique payment codes received via SMS (OTP codes), etc. The data can be requested during the phone call with the attacker, through a link sent to the customer via e-mail or text message on the mobile phone.

  In this way, the attackers gain access to the victims' payment accounts and can subsequently act on their behalf, i.e. perform payment operations from their accounts.

  To prevent such situations, we recommend:

  • do not share card data (name, first name, card number, CVV2 / CVC2 code, PIN, etc.), access passwords to Internet Banking or Mobile Banking and 3D Secure applications, unique payment codes received via SMS, any other personally identifiable information or security information, all of which is confidential.

  • do not install applications from unknown sources and uncertified programs;

  • do not enter links received from unknown persons through unsolicited messages or e-mails;

  • install a good and up-to-date antivirus program;

  • keep your operating system up to date.