SECURITY GUIDE

If you suspect that there has been any unauthorized access of your account(s) online, or that any online transactions has taken place which is not initiated by you, please call our Customer Service at +84 28 7300 8100.

 

12 TIPS FOR SAFER BANKING EXPERIENCE

Be Precise

Always type in the correct internet banking website address directly into the address bar of your internet browser

Shred or Securely Store

your printed statements.

 

Sharing Is Not Always Caring

never share information such as your username, password, MyKad number and etc. via emails or pop-up windows and phone calls.

 

Don't Click

links in emails, SMSs, or pop-ups. Always type the web address yourself.

 

Make It Complicated

your password that is. Create one using a combination of alphabets and numbers, which makes it harder to guess. Make sure you never write your password down and that it's changed regularly.

Check & Monitor

your transaction records as often as you can! This way you will notice if there is anything suspicious.

Keep It Private

never use a public computer or an unsecured wireless network (WiFi) when performing online transactions.

Disable the Auto-complete & Auto-save Function

for usernames and passwords.

Don't Keep Your Cache

after every online session, clear your internet cache. Usually this button is under the Internet Options section of your internet browser.

Look Out For the Padlock on Your Browser

when visiting websites that require you to share your security information. Make sure it's there as the icon indicates that the website uses a secure connection.

If You Doubt It, Junk It

no matter how legitimate it may seem, never respond to unsolicited emails.

Invest A Little

on computer security such as a personal firewall, anti-spy, and anti-virus software. Make sure, it's updated regularly!

HOW TO IDENTIFY A SCAM?

  • You receive an email, SMS or phone call claiming to be from Hong Leong Bank, asking you to provide personal financial / security information or TAC
  • You receive emails or SMS containing a URL internet link which will lead you to a fraudulent unsecured login site
  • You receive emails requesting you to open attachments or free software that may contain malicious software like viruses, spyware and trojans that are designed to steal your personal data
  • Pop-up advertisements asking for personal or financial information are likely fraudulent, so it's better to just close them

 

 

HONG LEONG BANK SECURITY

Hong Leong Bank has incorporated the following security features:

  • 8 – 12 characters of alphabets and numbers User ID for all Connect BIZ customers.
  • 8 – 30 characters of alphabets and numbers and is optional to add special characters Password for all Connect BIZ customers
  • Connect BIZ will automatically log off if there is no activity performed after a while.
  • Connect BIZ will be deactivated (dormant) if you do not login for 30 days
  • Upon 3 times unsuccessful attempts to log in, the ID will be automatically blocked
  • Up to 256-bit encryption with 128-bit minimum enabled by EV SSL certificate to secure online transactions.

 

Security token:

  • 2 factor authentication which is based on knowledge factor and possession factor
  • Customizable authorization matrix to allow single or multiple authorization.
  • Token PIN will be used as an additional method to identify that it is you who is using the token and authorizing the session/transaction in Connect BIZ. Challenge Code will be auto-triggered to the token to authenticate certain online transactions, several settings, registration and reset.

 

Precaution tips to safeguard the Security Token, Security Codes and to prevent unauthorized and fraudulent use of Connect BIZ:

  • Do not disclose the Security Codes or cause the Security Codes to be disclosed to anyone;
  • Install the necessary anti-spyware and firewalls so that the equipment from which you are accessing to Connect BIZ will not allow recording of the your transaction activities;
  • Do not utilise Connect BIZ through Internet cafes , public computer or an unsecured wireless network (WiFi);
  • Change the Password(s) when requested to on a periodical basis;
  • To memorize the Security Codes and not recording them;
  • To inform our Call Center at +84 28 7300 8100 or email us at ask@hlbvn.hongleong.com immediately if there is any suspicion that any Security Codes has been disclosed to a third party and/or if the Security Token is lost or misplaced by the Customer, to enable HLBVN to prevent fraudulent or unauthorized use of Connect BIZ;
  • To ensure that a sign out of Connect BIZ and Website must be done whilst the computer terminal is unattended;
  • The Security Token and Security Codes are issued solely for your usage and shall not be transferred, pledged or otherwise used as security in any form;
  • Any changes of the Security Token user shall be informed to the Bank with immediate written notice.

 

IDENTIFYING FRAUD

PHISHING
  

Protecting You from Phishing Scam

Online fraud such as phishing scams has been rampant around the world causing undue financial losses and distress that can be avoided with proper education and care. At Hong Leong Bank, we are making it a priority to protect you, our valued customers from such threats. With your online security in mind, we hope to equip you below with practical tips on how you can prevent yourself from being a victim.
 

What is Phishing?

Phishing is an automated form of social engineering used by fraudsters to deceive one to give away sensitive information. The initial phishing email is designed to entice the recipient to open the email and click on the link provided. The fraudsters use multiple methods to do this including enticing subject lines, forging the address of the sender, using genuine looking images and text and disguising the links within the email.

MALWARE ALERT

1.0 What is Malware?

Malware is short for Malicious Software.

The commonly known malwares are like viruses, worms and trojan horses. Malware is any kind of hazardous software that is installed in your electronic device without your knowledge or consent.

 

2.0 How does the “Zeus” malware work on infected computer or mobile/tablet devices?

Once the device is infected with malware, the fraudster is able to inject modified fake contents or pages while you are accessing a legitimate online banking website via your Internet browser.

IMPORTANT NOTE:

The bank will never communicate to you with urgent appeals that your account may be suspended or closed if you fail to confirm, verify or authenticate your company’s banking information on the website.

2.0 Sau khi nhiễm vào máy tính hay điện thoại/ máy tính bảng của bạn thì phần mềm độc hại "Zeus" hoạt động như thế nào?

Một khi thiết bị nhiễm phần mềm độc hại, kẻ lừa đảo có thể giả mạo nội dung hoặc những trang web khi bạn truy cập vào trang web trực tuyến hợp pháp bằng trình duyệt web.

 

3.0 How does malware infect your computer, smartphones or tablet device?

3.1 From email with Website URL hyperlinks or attachments: Opening an email attachment or clicking on a hyperlink may contain and allow the malware to be installed into your PC, smartphone or tablet devices

When receiving an email with a hyperlinks or an attachment, if the email was not expected or from someone you don't know, delete it. If the email is from an organization or someone you know and you’re not expecting it or requested for it, be cautious too; do not click on the given hyperlink or open the attachment as instructed, contact the sender to verify beforehand

3.2 From mobile SMS or MMS with website URL or attachments: Same as above emails with hyperlinks or attachments

3.3 From instant mobile or web messaging with website URL or attachments: Same as above emails with hyperlinks or attachments. Examples of instant messaging are WhatsApp, Twitter and Line.

3.4 Accepting without reading: A user accepts what is prompted on the screen without reading the prompt or understand what it's asking. For example: while browsing a webpage, an Internet advertisement or window appears that says your computer is infected with a virus or malware; you have won a prize; asking to complete a survey or that a unique plug-in is required. Without fully understanding what it is you're getting, you accept the prompt that will install a malware.

3.5 Downloading applications (apps) from a website: Only download programs only from reputable websites and with a valid digital signature. If you are unsure, leave the site and research the website and the software you are being asked to install. If it is OK, you can always come back to site and install it.

Files that don’t have a digital signature or were downloaded from an unknown source should always be treated as dangerous.

3.6 Not running the latest operating system, web browser or application updates: Running a web browser, applications or operating system that is not up-to-date with the latest updates can be a big security risk and can be a way your computer becomes infected.

Some of the updates from your computer, smartphone/mobile, tablet device manufacturer, web-browser or application provider (e.g. Microsoft, Apple, Blackberry, Samsung, LG, Adobe, Google, Mozilla etc), are security updates. Make sure you perform and have the latest updates to minimize the risk of malware infections.

3.7 No antivirus scanner: It's highly that recommended you have some form of antivirus on your computer, smartphone/mobile or tablet devices to help clean it from any infections currently on the computer and to help prevent any future infections

 

4.0 Take note of any unusual signs on the daily handling of your mobile devices:

4.1 High frequency of apps crash unexpectedly

4.2 Device battery drains out quickly

4.3 Pop-up notification or advertisement to install other apps

4.4 Overall device performance becomes sluggish without apparent reason

4.5 Outgoing and incoming SMS/calls being disrupted

 

5.0 IMPORTANT REMINDER when you’re assessing Connect BIZ:

5.1 Do not respond to any form of pop-up screen or window or additional web pages asking for your personal info and smartphone platform (Android, Windows, etc)

5.2 Do not simply download and install/update any app on your computer or mobile/tablet devices without verification

5.3 Do not root or otherwise 'Jailbreak' your computer or mobile/tablet devices and avoid side loading (installing from non-official sources)

5.4 Notify HLBVNimmediately when you came across anything suspicious or unusual web pages asking for personal information when you are about to login to your Connect BIZ

5.5 You are advised not to proceed with your online banking transactions until your computer or device has been checked and disinfected

 

OTHER COMMON INTERNET SCAMS

Password Cracking

Password cracking is a common way to retrieve a password by repeatedly trying to guess for the password. The most common method of password cracking is guessing and dictionary attack.

Keystroke Logging

Keystroke logging or more commonly known as keylogging is a way of obtaining passwords or info by capturing what user's type. It is a diagnostic tool that comes in the form of software or hardware (i.e. inserted in the keyboard).

 

 

Login Spoofing

Login spoofing is a way of obtaining a user's username and password. The user is presented with the bank's Login page to prompt for the username and password. When the username and password are entered, the information is then passed to the attacker.

 

Shoulder Surfing

Shoulder surfing as it suggests, is a way of obtaining a user's username and password by peeping.

 

Spyware

Spyware is computer software that is often installed into the PC without user's knowledge and usually takes place during user's download of free software, games or subscribing to free online services from the Internet. Once installed, it does not only monitor user's surfing activity but also capable of retrieving any personal and sensitive information that is being transmitted on the Internet before it is sent in the background to interested parties.

 

Trojan Horse

Trojan horse is a type of malware (malicious software) which allows unauthorized access by attacker to user's computer and more often for the purpose of data theft (e.g. personal information, bank account numbers and password). It can be spread through opening email attachment from unknown person or visit to unknown websites.

 

Mule Scam

As the result of responding to spam email or job recruitment that offers opportunities to make easy money, a person could fall for a mule scam. This person is known as "money transfer agent" or "money mule" whereby a mule's bank account is used to receive stolen money from phishing victims and such account also act as a transit prior to the funds being sent abroad and later to be withdrawn by the fraudsters.