FRAUD FEUD

RED FLAGS

100

Physical ID

Form of identification appears altered.

    Use the Fraud Fighter pen to check the form of ID for any signs of alteration, forgery, etc.

An out-of-state (i.e., issued in a state outside of current location) photo ID is presented.

    Use the Fraud Fighter pen to verify the applicable security features in the ID Checking Guide.

Physical description on ID does not match photo or physical appearance of person (e.g., ID says height is 5"5', but member is much taller).

Identification Requirement Resources - NFCU eNet

200

Behavior Red Flags

• Individual's body language conveys nervousness, uncertainty, or being in an extreme hurry.
• Individual avoids making eye contact.
• Individual is unusually talkative or avoids conversation.
• Prospective member is being coached or directed on their request.
  • Examples:
    • Looking to someone else in the branch for signals on what to ask for or how to respond to questions.
    • Receiving prompts/coaching from a third party either in person or via phone or text.
• During the field of membership discussion, the prospective member changes the sponsor relationship (e.g., originally referred to as friend or co-worker, changes to sibling).
• Needs to search for basic information about a "family member" sponsor (e.g., name, date of birth).                                            

300

Questions Before Conducting Transactions

• To ensure we have current and correct demographic information on file, member addresses should be verified each time a member's account is accessed to perform a transaction.
  • Use open-ended questions to verify the member's contact information, such as:
    • What is your address?
    • What is your phone number?
    • What is your email?
  • It is important not to prompt the individual making the request with any information in the event they are a fraudster posing as the member.

Member Profile - NFCU eNet

400

List Non-Critical Scenarios

Abusive Behavior
Be On the Lookout (BOLO)
Disruptive/Disoriented Individuals
Environmental Threats (AC Outages, floods)
Homeless Activity/Panhandlers
In-Branch/Parking-Area Disturbances
Suspected Fraud

Law enforcement should not be called for fraudulent transactions (e.g., fraudulent check presented for deposit) conducted at the branch by any individual unless directed by Security. Team members must do the following for suspected fraud:

• Complete the procedures in the "Suspected Fraud" section for notifying Security of fraud or scams.
• Allow individuals suspected of attempting to conduct fraudulent transactions the opportunity to leave; they should not be held at the branch.
  • Team members must not unnaturally stall members or prevent them from leaving (e.g., stating system issues or retaining ID) while contacting Security or waiting for law enforcement, when applicable, to arrive.

 

 

500

List Critical Scenarios

Active Assailant
Bomb Threat
Gas Leak, Fire, Chemical Spill
Escalated Abusive Member
Robbery
War/Terrorist Attack
Other/Undefined Critical Scenario

TYPES OF INCIDENTS REPORTED

100

Compromised Personally Identifiable Information

A members' or employees' personally identifiable information (PII) was compromised through unauthorized access (e.g., documents containing PII sent to the wrong recipient).

• Compromised PII may or may not be related to any fraud, dispute, forgery, or phishing/smishing/vishing incidents.
  
  

200

Fraud

A transaction was completed without the member's knowledge or consent, or the member provided their account information or credit/debit card number due to fraud or robbery.

300

Dispute

A transaction was completed by a member but is incorrect, duplicated, or the purchased item was not received, returned without refund, or of a lower quality than expected.

400

Forgery

An item (e.g., check, account opening) was completed or altered without the member's knowledge or consent.

500

Phishing/Vishing/Smishing

An electronic (e.g., text, email) solicitation was received for personal information.

• These are considered fraud and a report needs to be filed.
• Team members must determine if account compromise procedures should be implemented.
• In addition to filing a report, if the fraudster impersonated Navy Federal during the phishing/vishing/smishing attempt via iCloud/iMessage/FaceTime/CashApp, team members must send an email with impersonator details to [e-mail].

Level 3 Alerts

100

Address Unknown Alert

This level 3 alert indicates that Navy Federal does not have the current address on file for the member. This alert is placed for the first 30 days that Navy Federal has not had a current address for the member.

• This alert is usually placed when mail has been returned to Navy Federal.
• Members with an email address on file will receive a notification on the day the alert is placed, after 15 days, and after 30 days.
• After the alert is present for 30 days, it changes to a Level 7 Address Unknown alert.

200

Change of Address Alert

Whenever an address is changed, a Level 3 Change of Address alert appears on the account for 30 days. If the address changed on NFOAA, the system places a member level note and the alert may not appear until the next business day.

You must review a second form of identification while this alert is present before processing the following requests:

• Change of address
• New or replacement debit card
• New or replacement credit card

Add a member-level note with a 1-year expiration date and include the following information:

• Type of ID
• ID Issuer
• ID #
  • Example: Member/non-member presented driver's license and Military ID; issued by the state of FL/DoD; #T11-22-3333/4567891011-012

300

Compromised Online/Mobile Banking Alert

This level 3 alert is placed when the member's online or mobile banking credentials are believed to have been compromised. 

• Branch team members can only  delete this alert after determining that no fraud has occurred on the member's account.
  • Team members must verify 2 forms of CIP identification prior to conducting transactions or deleting this alert. 
• This alert does not require an Encore override.

400

ID Theft Risk Alert

This level 3 alert indicates the member has advised Navy Federal that they have:

• Experienced identity theft at another financial institution.
• Reported a lost or stolen physical ID.
• When performing transactions:
  • Request two acceptable forms of identification when this alert is present, regardless of transaction amount or type (e.g., wire transfers, Encore transactions) until proper steps have been taken to remove the alert.
    • The forms of identification must be from the list of CIP acceptable documents due to the ID Theft concern.
    • If documents are from the Address list, the address on the provided documentation must match the address listed in the member record.
    • Bank statements presented for Address verification must be from another NCUA/FDIC insured financial institution. 
      • Bank statements can not be Navy Federal issued. 
  • The Fraud Fighter pen must be used to verify the applicable security features on the IDs presented.
  • Refer to Performing Transactions section for guidance.
  • Refer to Non-Member Transactions, if applicable.

500

Suspicious Person Alert

• Branch team members can add,  modify, and delete this alert.
• Request two ID for Transactions when this alert is present, regardless of transaction amount or type (e.g., wire transfers, Encore transactions).
  • The Fraud Fighter pen must be used to verify the applicable security features on the IDs presented.
  • Both IDs must be recorded in UAD, if applicable.
• This alert requires a Level 1 Encore override.

Level 5/7 Alerts

100

Account Takeover (ATO) Alert

This level 5 alert identifies members suspected of being an account takeover victim with money movement or the member calls/visits a branch claiming they are the victim of account takeover with money movement. 

• Request two acceptable forms of CIP identification when this alert is present, regardless of transaction amount or type (e.g., wire transfers, Encore transactions).
  • The Fraud Fighter pen must be used to verify the applicable security features on the IDs presented.
  • One form of ID must be a photo ID.
  • If an ID presented is from the "Proof of Address" column, the address must match the ID the member presented or the address listed on the member's record.
    • Bank statements presented for Address verification must be from another NCUA/FDIC insured financial institution. 
      • Bank statements can not be Navy Federal issued. 
  • Team members must follow the guidance for recording ID in UAD, if applicable.
• For all (monetary, non-monetary) interactions, team members must add a System Note (member level) with 1 year expiration describing the details of the interaction to include:
  • The actions taken
  • Documentation reviewed to include:
    • ID type
    • ID passed Fraud Fighter.
    • Issuing authority
    • ID number
    • Expiration date (if applicable)

200

All Debit Cards Restricted Alert

This level 5 alert is placed on an account when all debit card products need to be restricted as a result of multiple fraud and/or dispute claims or not safeguarding the card. 

• Team members cannot add, update, or delete this alert.
• Only one abuse alert can be on an account.
• The default expiration period is 36 months but may vary.
  • There is no appeal process if the alert is placed for excessive Fraud claims. 
  • For excessive Dispute claims, review the Appeal process below. 

300

Account Charge-Off Settled Alerts

The level 5 alerts below are placed when a member has one or more accounts that have been charged off causing Navy Federal a financial loss and the member has settled the account for less than the full amount owed.

• This alert does not affect a member's access to their existing open accounts.

Team members should contact LCR and/or Charged Off Checking via Internal Chat for guidance, if necessary. Please keep the following in mind prior to opening a new accounts:

• Any charge-off makes an applicant ineligible to re-establish new accounts unless the charged-off debt is paid-in-full. 
• In cases where a former member made a settlement with Navy Federal and we incurred a loss, the former member is not eligible for membership, unless the charged-off debt is paid-in-full/being paid. 
• UAD (member-level) notes will be placed by the appropriate department indicating what actions (e.g., paid-in-full, payment arrangements) have been taken by the member.

400

Suspected First Party Alert

This level 7 alert is placed when a member is suspected of committing a financial crime against Navy Federal.

• There are different types of Suspected First Party alerts, depending on the account activity.
• Branch team members cannot add or modify this alert. 
  • Branch team members can only  delete this alert after all Fraud Operations instructions in member-level notes are completed.
  • CIP documents must be reviewed prior to deleting the alert. 
    • One form of ID is required unless otherwise stated in the Notes. 
    • Bank statements presented for Address verification must be from another NCUA/FDIC insured financial institution. 
      • Bank statements can not be Navy Federal issued. 

500

Address Unknown - Restricted Alert

This level 7 alert indicates that Navy Federal does not have the current address on file for the member.

• This alert is automatically applied 30 days after the Level 3 Address Unknown alert was applied.
• Team members can delete this alert after verifying the address is correct or updating it as necessary.
  • Team members must add a non-expiring member level note in USD once the alert is removed. 
  • A verbal verification is acceptable. 
• Team members cannot add this alert.
  • If mail is returned to the branch as undeliverable for a member, follow the procedures for the  Level 3 Address Unknown alert.
• Encore Override: This alert requires a  Level 1 override.
  • Ensure all applicable actions are completed before providing the override.

Recording IDs

100

Major Credit or Debit Card useds as secondary ID

• Record the card payment network and last four digits of the card need to be documented (e.g., VISA5678).

200

NFCU Debit Card (VCC) as primary ID

• It must be PIN verified.
  • If the last four numbers do not auto-populate, the team member should add them manually.
  • The last four digits of the card needs to be documented (e.g., 5678).

300

State Issued ID

• Only the identification number is needed (e.g., 241786327)

400

Vehicle registration as secondary ID

• Only the last four digits of the vehicle registration must be documented (e.g., 5678).

500

CIP Identification

Primary Government I.D. W/photo
Unexpired U.S. Driver’s License
Unexpired State Issued Identification Card (for non-drivers)
Unexpired Government Issued Passport or Passport Card
Unexpired Permanent Resident Alien Card
Unexpired Military and CAC ID front and back (for Branch only)
Unexpired Native American Tribal Identification Card

Proof of Address
Voter’s Registration Card
Paystub (within past 2 months)
Unexpired Vehicle Registration
Insurance Documents (All types)
Bank Statement (within past 2 months)
Local/State/Federal Tax Documents
Utility Bill (within past 2 months)
W2 from Most Recent TaxYear