Security

BVCU uses encryption and firewalls as part of our cybersecurity program for protecting our members. 

A series of firewalls prevent unauthorized access to our internal systems. As data comes to us over the internet from your device, it goes through a series of safety checkpoints so that only authorized messages and transactions enter our computer systems.

We physically secure our internal servers, telecommunications systems and service centres so that your personal and financial information is protected physically as well as digitally.

The password that you use for online and mobile banking, as well as the Personal Identification Number (PIN) for your debit card, are inaccessible to us and we will never ask you to reveal them. Our online banking system uses two-factor authentication, a security feature that sends unique one-time passcodes for certain security sensitive activities. Examples would be adding bill payees, updating your contact information and resetting your password.

• Select a password that is easy for you to remember but difficult for others to guess.
• Do not use a part of your PIN (Personal Identification Number) or existing passwords you use on other sites.
• Keep your password confidential and do not share it with anyone.
• Do not write your password down or store it in a file on your computer.
• Never disclose your password in a voice message or email, and do not disclose it over the phone.
• Ensure no one observes you typing in your password.
• Change your password on a regular basis. We suggest every 90–120 days.
• Do not reuse passwords.

• Never leave your computer or device unattended while using our digital banking services.
• Always exit the site using the Logout button and close your browser if you step away from your computer or device. Your browser may retain information you entered in the login screen and elsewhere until you exit the browser.
• Secure or erase files stored on your computer or device by your browser so others cannot read them. Most browsers store information in non-protected (unencrypted) files in the browser's cache to improve performance. These files remain there until erased. They can be erased using by using your browser’s features to empty the cache. See your browser’s ‘Help’ section for more information about how to clear your browser’s cache.
• Install and use a quality anti-virus program. Be sure to update your anti-virus program often. It is recommended you configure your anti-virus program to check for and automatically install updated definitions daily. Scan all downloaded files, programs, and attachments, and only accept files and programs from a trusted source.
• Install and use a personal firewall on your computer to ensure others cannot access your computer through the Internet.
• Install new security patches as soon as your operating system and Internet browser manufacturers make them available.
• Install an anti-spyware program and check your computer or device regularly.

• Activate your phone's password feature, which locks the screen and prevents anyone but you from accessing your phone. Set up the password feature on your phone with a code that only you know, or use the fingerprint or face unlock features, if they are available for your phone.
• Don't connect to unknown networks through Wi-Fi hotspots to make financial transactions. Use a virtual private network (VPN) or your phone or device’s data plan instead.
• Beware of smishing – that's phishing on phones through text messages. Never download media or images, or click on text-message links that come from people or phone numbers you don’t recognize. Never provide personal details or account information using email, social media chat functions, or text messages, as these are not secure. If you are unsure if a message came from us, please contact us by phone, or use the secure messaging within the digital banking app or site.
• Download apps exclusively from the official source for your smartphone's platform, such as the Android, Apple or BlackBerry stores. Look at the permissions apps request before downloading them. If there is no clear reason why the app should have the access it requests, consider not downloading it. (For example, there is no reason a free game app should have access to view call logs or make and receive calls.)
• Install anti-virus software for your smartphone when available and update it frequently.
• Install location finding applications, which work with your phone's built-in GPS. These applications allow you to locate and/or remotely erase data in your phone if it is lost or stolen.
• Update your smartphone's operating system as soon as newer versions are available.
• Back up your smartphone regularly. Most mobile devices can be set to automatically back up to an online account at regular intervals.

• Protect your personal information. Be aware of current online ploys that try to get you to provide personal and/or financial information. Do not respond to unsolicited emails or phone calls that ask for confidential information.
• If you don't know the source of an email or if it looks suspicious, do not open it. Never click on a link or attachment in an email that you suspect may be fake. Even if an email looks real, we advise that you open your browser and type in the address of our site yourself instead of clicking a link in the email. That way, you can always be sure you’re going directly to our real website.
• Remember to log off. Ensure that you always properly log off and close your browser. This will prevent others from being able to view this information later.
• Safeguard your PINs and passwords. Never share your passwords with anyone, for any reason. Use passwords that are difficult to guess. Change your passwords frequently.
• Be wary of pop-up windows, especially those that request financial or identification information. Avoid clicking any "action" buttons in a suspicious pop-up window.

Phishing
A common way for Internet scammers to obtain your personal information is through a method called phishing. Phishing is when fraudsters send emails or SMS text messages which appear to be from your financial institution. You are asked to log in to your online banking to verify account information. The message instructs you to click on a link that takes you to a copy of your digital banking site – one that’s hard to tell apart from the real site – where you'll be asked to enter your credentials. The fake site will capture your credentials, which fraudsters can then use to log in to your digital banking.

Phishing scams may also seek personal details, such as your address, social security number or mother's maiden name. The details obtained can then be used for identity theft.  Phishing emails may include:

Phishing emails also often have some telling signs, including:

Never provide personal details or any account details in an email. If you receive a message that you are unsure about, please contact us by phone, in person, or through secure messaging in digital banking.

Another way for hackers to get their hands on your personals details is by pharming them. Pharming occurs when hackers compromise your computer to redirect you to fake websites. With pharming, you get sent to a fake website even when you type the correct address directly into your browser. Once there, you are asked to enter your digital banking credentials or account information, which hackers take and use for criminal activity.

We will never send you emails or communications asking you to verify or provide your online banking details. Never use a link provided in an email to access your digital banking. Do not open emails, texts, or attachments from unknown sources. Scan emails and attachments with your anti-virus software before opening them.

Always type your financial institution's website address directly into your browser and remember to look for confirmation that you are browsing securely. The letter "s" in 'https' indicates you are navigating in a secure site. Look for the 'https' when online shopping, too.

Don't feel panicked when phishing emails caution of immediate account closures if your banking details cannot be verified. Don't believe emails warning that your account has been compromised or that you'll miss out on a great deal if you fail to act immediately. If you are concerned, call or visit one of our branches.

Malware
Malicious software (malware), spyware, worms and Trojans are the same class of destructive viruses, just with different names. They can steal your personal information, take over your computer, and use it to attack other people's computers. Your computer can become infected through email attachments, downloading infected content, or visiting harmful websites.

Spyware
Spyware is exactly what it sounds like – tracking software that is downloaded to your computer without your knowledge when you visit certain Internet sites. Secretly, it gathers information about you and your browsing habits. This information can include passwords and personal data. It can also interfere with user controls and disable legitimate anti-virus programs.

The best way to protect your computer against spyware is smart browsing. Stay away from sites that look unsafe and avoid streaming or downloading content from untrustworthy sources. Many anti-virus products offer targeted spyware solutions that inspect your operating system, installed programs, downloads, and files.

Scareware
One of the most common viruses to watch out for is known as scareware. These scams pop up on your screen and display alarmist warnings, telling you a virus has invaded your computer. Scareware prompts you to download (and often pay for) fake anti-virus software to remove the non-existent viruses. Scareware is a scam that tries to trick you into paying money in exchange for nothing.

You can protect against scareware by keeping your anti-virus software up-to-date and by being judicious about what you choose to download to your computer. You should also be familiar with the look of your legitimate anti-virus program, so you won't be fooled if one of these pop-ups appears.

• Not using a shared computer to access your digital banking. We strongly recommend not using shared or public devices to access digital banking.
• Managing your digital banking only from secure networks. We recommend that you don't use unsecured public networks for anything sensitive.
• Connecting only to password-protected networks. If there are several networks available, ask employees of the organization which network they operate.
• Never leaving your computer or device unattended, especially if you are logged into your digital banking.
• Using different passwords and security questions. If someone obtains your login credentials for one site, such as a social networking site, you don't want them to be able to access your other ones.
• Ensuring you log out before you close your browsers.

• Make sure that you are shopping at a trusted retailer when you enter your credit card details online.
• Use a reputable escrow service such as PayPal where possible.
• Provide retailers with only the necessary details to complete the transaction. These include your credit card number, expiry date, the security code on the back of the credit card and the card's billing address. Never provide your social insurance number, account details or your mother's maiden name. For shopping sites that require you to register with a username and password, we recommend you do not use your digital banking password.
• Use your credit cards only on websites that use secure browsing technology on the screens where you enter your card information. Ensure the web address begins with 'https' (as opposed to 'http') and has a closed padlock icon in the address bar.
• Ensure that smaller retailers requesting credit card details have reputable contact details and a physical address, and that you feel comfortable with providing them your card information.
  

What are cookies?
Cookies are small text files containing a string of characters that can be placed on your computer or mobile device that uniquely identify your browser or device.

What are cookies used for?
Cookies allow a site or services to know if your computer or device has visited that site or service before. Cookies can then be used to help understand how the site or service is being used, help you navigate between pages efficiently, help remember your preferences, and generally improve your browsing experience. Cookies can also help ensure marketing you see online is more relevant to you and your interests.

What types of cookies does BVCU use?
There are generally four categories of cookies: “Strictly Necessary,” “Performance,” “Functionality,” and “Targeting.” BVCU routinely uses the first three categories of cookies on our website. You can find out more about each cookie category below.

How Long will Cookies Stay on My Device?
The length of time a cookie will stay on your computer or mobile device depends on whether it is a “persistent” or “session” cookie. Session cookies will only stay on your device until you close your browser. Persistent cookies stay on your computer or mobile device until they expire or are deleted. All cookies placed on your device are session cookies except for the following:

Controlling and Deleting Cookies
You can easily adjust your browser settings to notify you when you receive a cookie so you can choose whether or not to accept it; disable your browser from receiving cookies; or delete cookies through your browser. Please consult the Help Function of your browser for more information. Be aware however that some features and services on our website may not work properly because we may not be able to recognize and associate you with your account. In addition, the offers we provide when you visit us may not be as relevant to you or tailored to your interests.

Recognize it. Report it. Stop it.  BVCU does our best to safeguard your interests, but you should also take precautions to protect your identity and your money.

If you believe that you are a victim of fraud, take these steps:

• Obtain a copy of your report (victims of identity theft can receive copies of their credit reports for free) and ask that no further credit be granted without your approval.
• Make sure your account is flagged with a “fraud alert” for the maximum time allowable.
• Send these requests in writing and keep copies for yourself.
• Review the reports carefully and look for inquiries you didn’t initiate, accounts you didn’t open and unexplained debts.