Customer Awareness & Education Program

Farmers & Merchants Bank of S.C. is committed to protecting your personal information. Farmers & Merchants Bank will NEVER request personal information by phone, email or text messaging including account numbers, personal identification information, passwords or any other confidential customer information.

Fraud through identity theft is growing rapidly, and we’d like you to be aware of what’s happening in the current online banking environment.

The security of your money and identity is as important to us as it is to you. Let’s work together to protect it!

What is Identity Theft?

Identity theft involves the unlawful acquisition and use of someone’s identifying information such as:

• Name
• Address
• Date of Birth
• Social Security Number
• Driver’s License
• Bank or Credit Card Account Number
• Personal Identifiable Number (PIN)

Thieves then use the information to repeatedly commit fraud in an attempt to duplicate your identity which may include opening new accounts, purchasing automobiles, applying for loans, credit cards, social security benefits, renting an apartment, and establishing services with utility and telephone companies. It can have a negative effect on your credit and create a serious financial hassle for you.

Methods of Identity Theft

Phishing – Phishing is the attempt to acquire sensitive information by pretending to be a trustworthy entity in an electronic communication.

Tips to identifying a “Phishing” email

• Unsolicited email that requests personal identifying information
• Awkward greeting
• Urgent call to act – “We’re updating our records”, “We’ve identified fraudulent activity on your account,” or “valuable account and personal information was lost due to a computer malfunction.” Usually the e-mail also contains a threat to close your accounts.
• Source code points to a different website that the alleged sender – The link looks official, but when your mouse curser rolls over it the link’s source code points to a completely different website.
• Typos & Incorrect Grammar

Ransomware – Ransomware is a type of malicious software cyber criminals use to deny access to systems or data until a ransom is paid. Paying the ransom is discouraged because there is no guarantee your system or data will be released and there is an increased risk of being a future target.

Business E-mail Compromise – Business e-mail compromise is a type of scam targeting companies who conduct wire transfers or have suppliers abroad. Cyber criminals spoof the email accounts of high-level employees and request/conduct fraudulent transfers.

Account Takeover - Account takeover is a form of identity theft in which criminals steal your valid online banking credentials. The attacks are usually stealthy and quiet. Malware introduced onto your systems may go undetected for weeks or months. Account-draining transfers using stolen credentials may happen at any time and may go unnoticed depending on the frequency of your account monitoring efforts.

How Do I Protect Myself?

Internet Banking Security

• Never share or give out your Access ID, User Name, Password, or Security Challenge Questions & Answers
• Do not use personal information in your Access ID, User Name & Password such as birth date, or names of family members and pets
• Create difficult passwords that include uppercase and lowercase letters, numbers and symbols.
• Change your password frequently
• Do not use the password auto-save feature on your browser
• Avoid using public computers and public WiFi (restaurants, stores or hotels, for example) to access your Internet Banking
• Do not provide any personal information to web sites that do not use encryption or other secure methods of protection
• Ensure that your computer is equipped with up to date anti-virus software protection
• Ensure that your computer is running a supported operating system with the latest service packs and updates installed, and that all third-party software is up to date.

Commercial Banking Internet Security

In addition to the information provided regarding "Internet Banking Security," Commercial & Small Business account holders should institute additional measures in order to further protect their online banking. For example:

• Perform your own internal risk assessment & evaluation on all online accounts
• Establish internal policies regarding employee internet usage
• Ensure all company computers are equipped with up to date anti-virus protection software

Identity Theft Tips

Identity theft occurs when someone uses your personal information such as Social Security number, account number or credit card number, without your permission, to commit fraud or other crimes.

• Use different passwords on all accounts and your PC that are difficult to guess
• Do not keep passwords on you and don't write such information on debit or ATM cards
• Shred all documents that contain confidential information, receipts, credit card solicitations, expired cards, statements, bills and invoices that contain personal information, and pay stubs.
• Review your monthly statement promptly and carefully
• Secure confidential information you keep at home
• Cancel old and unwanted cards
• Don't give private information to anyone unless you are positive you know the person and they have legitimate reasons for asking
• Never lend your password to anyone
• Periodically check your credit report
• Do not allow your credit card out of your sight while paying for products and services
• Do not leave your wallet/purse/checkbook in your car
• Be skeptical of email messages, for example, from someone unlikely to send an email such as the IRS
• Do not open the suspicious emails and do not click on the links

How Does the Electronic Funds Transfer Act (also known as Regulation E) Apply to Your Accounts with Internet Access?

Regulation E is a consumer protection law for accounts established primarily for personal, family, or household purposes. It protects individual consumers engaging in electronic funds transfer (EFT). Non-Consumer (or business) accounts, such as Corporations, Partnerships, and Trusts etc. are not protected by Regulation E.

What is an EFT?

• Point of sale transfers
• Automated teller machine transfers (ATM)
• Direct deposit or withdrawals of funds
• Transfers initiated by telephone
• Transfers resulting from debit card transactions, whether or not initiated through an electronic terminal
• Transfers initiated through internet banking/bill pay

Exclusion from Regulation E Protection

• Checks
• Check guarantee or authorization
• Wires or other similar transfers through Fedwire
• Securities and commodities transfers
• Automatic transfers by account-holding institutions
• Any preauthorized transfer to or from an account if the assets of the account holding financial institution were $100 million or less on the preceding December 31 and
• Telephone - initiated transfers. Any transfer of funds that:
  • Is initiated by a telephone communication between a consumer and a financial institution making the transfer; and
  • Does not take place under a telephone bill payment or other written plan in which periodic or recurring transfers are completed

Corporate Customer Awareness

Businesses are not protected under Reg E, therefore they need to be diligent in reviewing their periodic statements. Businesses also need to have multiple controls in place to monitor their online banking accounts and users. As a non-consumer (or business) customer you should perform a periodic assessment to evaluate the security and risk controls you have in place. The risk assessment should be used to determine the risk level associated with any internet activities the non-consumer performs and any controls in place to mitigate these risks.

Tips:

1. Create an Acceptable Use Policy (AUP), if you don't already have one, and require your employees to sign at least annually
2. Require each employee who uses Internet banking to go through security awareness training at least annually
3. Run background checks on all employees prior to hire
4. Ensure all computer systems have up-to-date antivirus software
5. Implement a process to ensure software updates and patches are applied frequently
6. Implement an Intrusion Detection/Prevention System to protect your network
7. Restrict Internet traffic on the systems used for Internet activities
8. Implement an email SPAM filter to help eliminate potentially harmful or unwanted e-mail messages from making it to the end users' inboxes
9. Configure workstations to auto lock after a period of inactivity
10. Secure wireless traffic using industry approved encryption

Unsolicited Client Contact

Farmers & Merchants Bank will only contact retail/consumers on an unsolicited basis for the following reasons:

• Suspected fraudulent activity on your account
• Inactive/dormant accounts
• To notify you of a change or disruption in service; or
• To confirm changes submitted to your online banking profile

If you receive an unsolicited contact from an FMBSC employee, your identity will be confirmed through a series of questions but remember FMBSC will NEVER ask for your logon security credentials.

Farmers & Merchants Bank Contact

It is important to contact Farmers & Merchants Bank in the event you discover that you have lost your debit card or if your online login information has been compromised. Immediately report unauthorized or unexpected transactions. If you want to report suspicious activity in your account, or if you have questions about the security of your account, you can call us at: (803) 496-3430.

Security Resources

The Fair Credit Reporting Act requires each of the nationwide consumer reporting companies to provide you with a free copy of your credit report once every 12 months. AnnualCreditReport.com is a centralized service for consumers to request free annual credit reports. It was created by the three nationwide consumer credit reporting companies.

Equifax - To order your report, call 1-800-658-1111, or report fraud, call 1-800-525-6285
Experian - To order your report, call 1-888-397-3742, or to report fraud call 1-888-397-3742
TransUnion - To order your report, call 1-800-916-8800 or to report fraud 1-800-680-7289

Federal Trade Commission (FTC) - Identity theft hotline 1-877-IDTHEFT (438-4338) or http://ftc.gov
FDIC Identity Theft & Fraud Web Site - www.fdic.gov/consumers
The Internet Crime Compliant Center – www.ic3.gov
Anti-Phishing Working Group – www.antiphishing.gov