Don't be a victim of online fraud

Remember we are encouraging safe investing, so we repeat:

Have you recently responded to a request to update your logon details via a link supplied in an email? If so, contact your bank or other financial service provider.

Don't fall victim to fraud - always be alert. Look out for any suspicious emails, websites, account activity or phone calls that involve your financial information. If so, contact your bank or other financial service provider.

Take care! This e-mail was distributed to banking clients
_____________________________________________________

From: Absa Bank Limited [mailto:upgrade@absa.co.za]
Sent: 10 November 2008 11:39To: undisclosed-recipients
Subject: New Online Secure Server
Importance: High

Dear Absa Customer,

We are proud to inform you that we have put a stop to the increasing spam attacks and security riskon our online banking servers by introducing the New Online Secured Database GX-5.

We are automatically registering all our customers to the secured server for added security and for aconvenience online banking experience. This registration is mandatory to all customers andunregistered accounts will be deleted from our server.

Proceed with your registration below.


Sincerely,

Absa Bank Limited
_____________________________________________________

What to look out for when identifying an e-mail or phishing scam:

• Deceptive Subject Lines: These look as if they are genuinely related to the company supposedly sending the e-mail.
• Forged Sender’s Address: An easy deception method to make the e-mail appear as though it has come from the company it is claiming to be.
• Genuine Looking Content: They copy images and text styles of the real sites in order to fool the reader. Trusts and authentication marks are duplicated and they may even have genuine links to the company’s privacy policy and other pages on the legitimate website to create an illusion of authenticity.
• Disguised hyperlinks: E-mails may display a genuine website address, but when you click on it, the hyperlink will take you to a different website. Look out for a long website address as it will take you to the site after the ‘@’ symbol. Example: http://www.genuine-site.com-name@fraud-site.com. If you clicked on this hyperlink it would take you to http://fraud-site.com as it is after the @ symbol.
• E-mail Form: These forms containing your personal information are submitted to remote computers, which the fraudsters access and then use your information to commit fraud on your bank accounts.

3 things you should do if you believe that your banking details have been compromised

• Change your sign-on details immediately (PIN and Password). This can usually be done securely online within your banks Internet Banking service or at your branch.
• As an added precaution, contact contact your bank or other financial service provider and let them know that you suspect that your personal banking details may have been fraudulently obtained.
• Monitor your accounts for unusual activity and report any suspicious activity immediately to your bank or other financial service provider.

_____________________________________________________

Need more information. See our posts of December 20 and 27 and January 01

How can you trust a website?

Authentication + Encryption + Certification Authority = Trust

Conducting financial transactions over the Internet requires a safe investing environment. One of the biggest problems facing Internet business today is the issue of trust and security. Most consumers are concerned about the safety of their credit card and personal details. Many people simply don't trust the Web, fearing that their transactions might not be safe.

A critical issue for suppliers is how to win a your trust and convince you that it is perfectly safe to make online purchases or conduct safe investing on the suppliers website. The easiest and most secure way to achieve this is through authentication and encryption.

Why is authentication important?
In the age of faceless Internet commerce, authentication provides crucial online identity. People and companies need to get to know one another before conducting business. In traditional commerce, people rely on physical credentials – such as a business licence or lD document – to prove their identities and assure the other party of their ability to transact safely.

A business partner's identity must be established before it can be trusted in conducting safe investing or other trade. At the most basic level, there must be a process which verifies that an organisation or individual exists, has a name, and is entitled to use that name. This process may also establish other identification attributes. Trusted third parties or delegated authorities often play a key role in confirming the identity attributes of participants at the time identification takes place.

Once the participant's basic identity and identification attributes are established and verified in "real" world, it must be issued with a credential such as an ID document or a business licence that can be used to prove identity. In the digital world, the most robust form of credential is the digital or Server Certificate signed by a trusted Certification Authority. [note #1]

How authentication works
Authentication allows the receiver of a digital message to be confident of both the identity of the sender and the integrity of the message. When Web visitors connect to websites, they reach one of two kinds of servers. If the servers are secure, visitors will get messages indicating that fact; similarly, if they are not secure, there may be warnings to that effect. A secure website is one that has been authenticated and has a certificate. The certificate tells users that an independent third party has agreed that the website belongs to the company it claims to belong to. A valid certificate means that users can be confident that they are sending confidential information to the place they think they are sending it.

The basic premise is that the Certification Authority, CA, is vouching for the link between an individual's identity and his or her public encryption key. The CA provides a level of assurance that the public key key contained in the certificate does indeed belong to the entity named in the certificate. For an Web user to determine whether a legitimate CA issued the certificate, he must verify the issuing CA's signature on the certificate.

CA's must be absolutely certain that they are issuing certificates to the "correct" company. They must be sure that the company they are certifying owns the Internet Domain Name they have certified, that it is registered as a business, and that its registered name is the same as that on the certificate the CA is signing. Once the CA has done what is, essentially, a background check on all these elements, the CA signs off on the public key. Then the Secure Sockets Layer (SSL) will start functioning. SSL, another critical element of a secure website, ensures that the information sent by a server is identical to that received by a Web visitor - that no change has taken place.

How can you tell if a website/company is authentic?
Before submitting information or purchasing goods, you need to know that the company you are doing business with is who it claims to be. Web shops can buy Server Certificates from many different companies (CAs). But Internet applications are configured to trust only those Server Certificates that come from a few highly reputable companies. So, if someone sends you his or her Server Certificates (either via e-mail or from a website you visit) and it is from a CA that the application does not trust, you will get an alert message asking if you want to trust the new CA.

When you visit a website you can be sure that transactions with the site are secured by looking for the following easy cues:

• The URL in the browser window displays "https:" at the beginning, instead of “http:”
• In Internet Explorer, a padlock icon appears in the bar at the bottom of the IE window. IE users can find out a website’s encryption level by following these steps:
  - Go to the website you want to check.
  - Right-click on the website's page and select Properties.
  - Click the Certificates button.
  - In the Fields box, select "Encryption type". The Details box shows you the level of encryption (40-bit or 128-bit).

[1] Internet applications are configured to trust only those Server Certificates that come from a few highly reputable companies, e.g. thawte, VeriSign, Entrust

[based on the thawte document The Value of Authentication]

Things you have to know about financial markets

[Blog #1 on this subject]

It is unwise for you to invest in financial markets from a basis of ignorance, especially if you are managing your own portfolio of securities. Safe investing and avoiding fraud are facilitated when you gain an understanding of financial markets and instruments. We will help you in this regard by providing a series of blogs about investing for beginners [note 1].

In the first series of blogs we will look at the various capital (share, bond) and money markets typically faced by a trader or available to an investor. We will introduce various cash instruments, and help you understand their function, price and mark-to-market their interim values, and risk management.

Further assistance will be provided in the form of financial market book reviews

[Note 1. A sort of "investing for dummies" or"investment 101"]

But. first we will look at financial system in general.

The financial system

Basically, the financial system is a set of arrangements embracing the lending and borrowing of funds by non-financial "economic units" and the intermediation of this function by financial institutions in order to facilitate the transfer of funds, to create additional money when required, and to create markets in debt instruments so that the price and allocation of funds are determined efficiently.

There are six essential elements of a financial system:
1. Lenders and borrowers - the non-financial economic units (eg individuals and companies) that undertake the lending and borrowing process.
2. Financial intermediaries, which interpose themselves between the lenders and borrowers.
3. Financial instruments, which are created to satisfy the needs of the various participants.
4. Money creation (when required) - the unique money creating ability of banks.
5. Financial markets - the institutional arrangements and conventions that exist for the issue and trading (dealing) of financial instruments.
6. Rate of interest, or the time value of money = the price of money.

Financial markets

The participants in the financial markets are the borrowers (issuers of securities), the lenders (buyers of securities), the financial intermediaries (buyers and issuers of securities) and the brokers, fund managers, speculators, exchanges and regulators.

The terminology used can sometimes be confusing. For example, reference is made to the primary market, the secondary market, the spot market, the options and futures markets, financial exchanges, the money market, the capital markets, the debt markets, the swap market. and so forth. We will endeavour to clarify the picture, over time in further blogs.

Primary and secondary markets
A fundamental distinction has to be drawn between the primary and secondary markets in securities. The market for the issue of new securities to borrow money for consumption or investment purposes is referred to as the primary market.

The markets in non-negotiable instruments, eg mortgage loans, savings deposits and life policies, are entirely primary markets, while negotiable certificates of deposit, shares and bonds, for example, are issued in the primary market, but traded in the secondary market.

Secondary market is the term used for the markets in which previously issued securities are traded. These markets exist in many of the securities referred to in the previous section, but they differ in terms of so-called breadth and depth or liquidity, sometimes vastly.

When discussing the secondary market, it is important to distinguish between brokers and market makers. Brokers act on behalf of other financial market participants (principals) in return for a commission (although sometimes they may take speculative positions - act as principals for their own profit). Market makers are financial intermediaries, mainly banks, who are appointed by the issuers to perform, this function.

Market making means that the market makers are prepared to quote buying and selling prices/rates simultaneously for certain securities; the spreads quoted by them are small, and they are prepared to deal in reasonable volumes. Because these institutions are prepared to hold portfolios of securities for this purpose, they need to be adequately capitalised - usually the large domestic and international banks.

An active secondary market in securities is important for five reasons:

1. It assists the primary market - improves the ability of issuers to place securities, by providing investors with the assurance that they will be able to dispose of securities If they so desire.
2. It provides the basis for the determination of rates to be offered on new issues.
3. It registers changing market conditions rapidly, indicating the receptiveness of the market for new primary issues.
4. It enables investors to rapidly adjust their portfolios in terms of size, risk, return, liquidity and maturity.
5. It enables the central bank to buy and sell securities in order to influence liquidity in the financial markets (open-market operations).

_________

Our next blog will look at the share market.

Be aware of two aspects of your browser when conducting financial transactions

A further important aspect of safe investing may be the vulnerability of your Internet browser to interception The following two precautions should be implemented.

1. Web browsers

A website should be accessible via all main web browsers and browsing devices. Most Windows based PCs are preinstalled with Microsoft Internet Explorer (IE). Because of this, IE is the browser most attacked by viruses and spyware and is a threat to safe investing and doing your banking and other financial transactions via the Internet. .

We recommend that you use the most up-to-date version of your preferred browser, because they are more secure than older versions. If you use IE it is particularly important for safe investing to run a virus scanner regularly and keep it updated with the latest security patches from Microsoft.

2. Caching

Internet browsers have the ability to remember a page from a website - this is called caching. This makes Internet surfing quicker, but vulnerable to interception. Thus, for security, online banking pages are usually delivered with instructions to the browser not to cache (remember) the information. While most browsers obey these instructions IE ignores them and under certain circumstances a cached page of information may be viewed.

To prevent this make sure that IE has the following settings:
>Tools > Internet Options > Advanced > Do not save encrypted pages
>Tools > Internet Options > General > [Browsing history] Settings > Automatically
>Tools > Internet Options > Advanced > Empty Temporary Internet Files folder when browser is closed

How to keep your Internet banking session secure

We repeat that an important aspect of safe investing is fraud avoidance. My bank provided me with the following information for safe online banking. [1]:

Check the site is secure
When you visit a website (especially a transaction website) you should look for a padlock in the browser window. The padlock indicates that you are in SSL (secure socket layer) mode, which means that every request or information that you send from the browser to our secure site is encrypted (scrambled and encoded).



Secure sites use digital security, a Trusted Site Seal is a dynamic image appearing on a secure website that allows online banking customers to tell at a glance that they can trust the website, that the online site is validated and that they can transact safely and securely and share information free of worry.

Leading providers of digital security are thawte, VeriSign, Entrust

1. First National Bank (South Africa)

What you should know about money laundering

As part of your safe investing activity you should be careful to avoid inadvertantly getting involved in assisting in money laundering.

Money laundering is performed to thwart the enforcement of criminal law by creating a justification for controlling or possessing money or property derived from any form of criminal activity.

This includes all activities aimed at disguising or concealing the nature or source of, or entitlement to money or property derived from criminal activities. The process of money laundering comprises:

• the placement stage where the illegitimate proceeds are placed in the financial system;
• the layering stage where numerous transactions are carried out with the proceeds; and
• the integration stage where the recycled proceeds are placed at the disposal of the criminal.

Organised criminal groups need to launder their illegal profits to avoid detection of the underlying criminal activity that generates the profits, while enjoying these profits or reinvesting them in future criminal activities.

By combating money laundering, law enforcement authorities can disturb the cycle utilised by organised criminal groups to benefit from illegitimate profits. This can enable law enforcement authorities to disrupt the functioning of organised criminal groups through financial turmoil.

Money laundering is discussed in the free [SA] Institute for Securities Studies Monograph: Clean Money, Suspect Source, Turning Organised Crime Against Itself.

How to launder cash
Popular tactics for launderers:

• The criminal approaches an attorney, showing interest in buying property, and deposits cash or transfers money into the attorney’s trust account. Soon after, he changes his mind and asks the attorney to refund him with a cheque.
• Estate agents and sellers are offered cash on their properties, with the cash used as a “negotiating tool” to lower the selling price.
• Crooked purchasers of single-premium life insurance policies pay for the policy with cash, even foreign currency, then surrender it and are paid out with a legal cheque.
• Purchases of high-value goods, including antiques, jewellery and cars.

Tips for safe online banking

An important aspect of safe investing is fraud avoidance. My bank provided me with the following 10 tips for safe online banking [1]

1. Avoid using public terminals (such as Internet cafes) for Internet banking.
2. Be aware of the higher risk of interception during a wireless connection. Only do your banking via a wireless hotspot if you are certain of the integrity of the connection.
3. Ensure that you have an updated anti-virus and spyware programme and perform regular system scans. (See note 2).
4. Never access the site via a link. Rather type the address (URL) of your bank into the browser address bar or save the address as a "Favourite".
5. Do not open other websites while logged into Internet Banking; only have a single browser window open.
6. Choose a User ID and password that cannot be easily guessed and change these regularly.
7. Ensure your computer software is up-to-date.
8. Check for the padlock in the lower right of your browser window (it indicates a secure site for safe investing). You can click on this padlock to verify the site "owners".
   When you complete your online banking tasks, log off and close the browser window.
9. Never provide your password over the Internet (by email) or over the telephone to anyone (including persons identifying themselves as bank officials). (See my Blog on Phishing)
10. Don't trust a PDF payment proof unless verified by the bank - these documents can be manipulated by fraudsters.

1. First National Bank (South Africa)

2. Symantec Norton 360, MacAfee and Kaspersky are leading anti-virus prorammes. Try MacroVirus On-Call, especially if you have a less powerful PC and/or an old version of Windows.

Can you avoid Madoff (Ponzi) schemes?

An important aspect of safe investing is fraud avoidance. Madoff's recent investment fund was revealed as a classic Ponzi pyramid scheme scam in which the illusion of solvency is created by paying off early investors with capital raised from later entrants. As long as new investment continued to come in the door, the earlier adopters reaped fat rewards; once markets tumbled and investors withdrew, however, the whole thing collapsed.

Left in Madoff's wake are bankrupt investors and failed regulation. "Madoff's investors rave about his performance - even though they don't understand how he does it," wrote Barron's Erin Arvedlund, who quoted a "very satisfied investor" as conceding, "Even knowledgeable people can't really tell you what he's doing." But for investors pocketing windfalls, the lure of easy money outstripped suspicions raised by Madoff's shroud of secrecy.

In general, schemes offering high returns are not safe investments and should be avoided. However some say you can profit if they are played right, one such way of playing can be examined at Riding the Ponzi

Beware of being fooled by phishing

Phishing

When thinking about safe investing, even if it is only a bank account, you have to be aware of fraud. Phishing is a form of fraud where criminals attempt to access your confidential information. This is done either by an email request for information or by luring you to a fake website.

Golden rules for safe investment:
Never access the site via a link. Rather type the address into the browser address bar or save the address as a 'Favourite'.
If you suspect that your confidential information has been compromised, please do not hesitate to contact your service provider, eg your bank

Protect your email
Any email is at risk of being intercepted, and you should never send sensitive information (passwords, etc) via email.

Tips to staying safe:

• Do not provide your email address to third party websites, without understanding how your email address will be used.
• Never send sensitive information via email.
• Avoid opening unidentified email messages with attachments, even if they profess safe investing.