Secure banking

How to protect your money from fraudsters?

Never give your User ID, PIN-codes or card info to anyone (even if they claim to be bank employees)
Don’t confirm transactions or login attempts in internet bank or app, which are not initiated by you
Avoid transferring money if you have any doubts

Types of bank fraud

Fraudsters use various methods and channels to try to trick you out of your money. Take a look at how the most common scams work and how you can protect your money.

1. Internet banking fraud

How it works?

It looks like you are contacted by Swedbank via phone call, e-mail, or SMS.
The reason for contacting is usually something urgent related to your account, for example to block some wrong transfer.
Through an e-mail or SMS you are directed to a site that looks like the Internet Banking login screen. In case of a call, you are asked for your Internet Banking user ID, PIN codes or card numbers.
After you have provided the information or entered your login details, your account is taken over by fraudsters, and all your money is transferred to the fraudster’s account.

How to avoid?

Never share your banking details (user ID, card information or PIN codes) anywhere. The bank will never ask you for those!
Do not download any e-mails attachments. Make sure that e-mails from the bank end with @swedbank.lv.

2. False invoices

How it works?

Fraudsters would send you a fake invoice. These types of invoices are most likely to be disguised as payments for advertising, membership fees, or software subscriptions.
Sometimes fraudsters mimic the existing suppliers with familiar sounding names.
In the aforementioned examples, they usually ask to pay amounts of money that would not attract attention because they don’t seem to be substantial.
Bear in mind that after the payment is executed it is nearly impossible to trace back the fraudsters and get the funds back.

How to avoid?

Check every single invoice with the counterparties at your organization responsible for the budget line.
Background checks probably won’t help because fraudsters mimic real companies.

3. BEC fraud

How it works?

A bookkeeper receives an email from an employee or partner informing that their bank account number has changed and from now on salary or payments for financial obligations should be transferred to the new account.
The new bank account is under fraudsters’ control and usually banks where the correspondence between the beneficiary's name and account number is not checked upon receipt of money are used.
The fraudsters may have gained the access to the mail server and taken over the email accounts of the persons in question.

How to avoid?

If you are asked to change the bank account number, try to contact the person who made the request over the phone (not the phone number you see in the email) and ask to confirm the genuineness of the request. If you still have doubts, do not proceed with the change.
Report the money transfer request to your bank as this will help to protect other organizations.

4. CEO fraud

How it works?

The member of a senior management send you a email asking to make a money transfer to some account urgently.
You are asked to transfer money to a bank account in another country. Often to a person, not a company.

How to avoid it?

If you are asked to make a money transfer by your manager while he or she is on vacation, and supplier is not one of your regulars, try to reach out to the person who made such request over the phone (not the one you see in an email) and ask for the legitimacy of the request. If you still have doubts, do not proceed with the transfer.
Report the money transfer request to your bank as this will help to protect other organizations.

5. Phishing emails

How it works?

You receive an e-mail claiming that your bank account has been compromised or that your company is being audited and inviting you to click on a link to find out more.
Clicking on the link in the email takes you to a website that is often an exact copy of the genuine site.
When you enter your credentials to the false website, the scammer enters the details on the genuine one and gains access to your bank account.

How to avoid?

Make sure your firewalls and anti-virus software are up to date, and you operate only using a secure connection (your VPN must be turned on when you are working from home).
Check the genuineness of the sender’s email address. Fraudsters tend to mimic real email addresses. An example of such email would be: alerts@sweedbank.lt
Fraudsters tend to trigger some emotion and a sense of urgency. Never click on links provided in emails. You can always check your bank statement by visiting your bank’s internet website directly, or at least hover with your cursor over the link to see the actual URL behind it.
Report the phishing attempt to your bank or the institution that the fraudster pretended to be. Inform your IT and your colleagues about the attempt.
Fraudsters may initiate transactions as a result. Never approve an operation if you are not 100% sure you initiated it.

6. Email attachments

What are they?

You get an email from your colleague or supplier. The email contains an attachment.
You open the attachment, or a link leading to one, and malicious code gets executed on your device in the background.

Now the fraudster can collect the information you enter on your browser or encrypt files on your device and/or server and ask for a ransom in exchange for the encryption key.

How to avoid?

Check the genuineness of the sender’s email address. Fraudsters tend to mimic real email addresses. If you get an email from a colleague whom you barely know, do not open the attachment.
Make sure your firewalls and anti-virus software are up to date, and you operate only using a safe connection (your VPN must be on when you are working from home).
If you have opened the file anyway and you are asked you to enable macros, deny the request and close the file.
Report the phishing attempt to your IT and your colleagues.
Fraudsters may initiate transactions as a result. Never approve an operation if you are not 100% sure you initiated it.

7. Delivery frauds

What are they?

These scams have become very popular during the pandemic. You get an email or a text message claiming that there was a shipment/letter meant for your company but the courier cannot find anyone at the office, and asking you to submit a new address in a link provided in the email or text message.
When you open the website, it asks you for a new address and identity confirmation by logging into your corporate bank account or providing corporate credit card credentials.
When you enter your credentials on the false website, scammer enters the details on the real one and gains access to your bank account.

How to avoid?

Never click on any links provided in an email or text message.
Do not reveal your internet banking login information or credit card credentials to any third parties.
Genuine shipping companies always provide the shipment tracking number in their communication. Instead of clicking on the link provided, check the status of the shipment on the official webpage.
Inform your bank, your colleagues and IT department about the attempt.
If you’ve fallen for the scam, log in to your internet banking site and block your cards, and set transaction limits.
Fraudsters may initiate transactions as a result. Never approve an operation if you are not 100% sure you initiated it.

you have noticed any suspicious actions in your account;
you suspect that third persons have received access to your Internet Bank;
you have faced fraudulent actions aimed at obtaining your login data or misappropriate your funds.

We will block your card or access to your Internet Bank account immediately and no one else will be able to access money in your bank accounts.

See warnings by the Bank of Latvia about:

unlicensed service providers here.
suspicious financial transactions here.

Block your card - you can block your cards in our app or internet bank. In internet bank log in, go under Cards > My cards > choose a card you wish to block and use slider “Block card”. Via the Swedbank mobile app, under “Cards” by switching the setting from “Active” to “Blocked”.
Specify additional security settings for Internet Banking. To avoid the risks of fraud, use double authorization of payments, set a fixed IP address for Internet Banking, or limit logins to Internet Banking to specific countries. All or any of these settings can be adjusted on the User rights and limits section of the Internet Banking site.
Report a security flaw – if you notice anything suspicious that may potentially be a security flaw, report it! How to notify us.

You shouldn’t confirm transactions or login attempts to internet bank or app, which are not initiated by you under no circumstances.
You shouldn’t ever disclose your personal data or internet bank and app login data to other persons, including family members, friends or bank employees, unless you are calling to the bank.
Do not write down, send by e-mail, SMS, etc. or otherwise save any confidential codes and passwords to unlock the screen of your computer or mobile phone. Create complex passwords, that are difficult to guess, memorise them and change them regularly. When creating PIN codes, be sure to make PIN codes in random number combination. Do not use combinations, such as 1111, 1234, dates of birth other personal details etc.
Remember that your User ID number is as important as your personal code, thus pay a great deal of attention to its security.
Keep in mind that after login you will have access to many services including external ones which do not require additional authentication.

We will automatically block access to Internet Bank if incorrect login data (User ID or code from the PIN code generator) is entered 5 times in a row. You can unblock it by calling us at (+371 67444444). In case of a repeated block, you will have to visit the bank’s branch. You should book a visit in advance. Have you discovered any unauthorised transactions on your account performed prior to the blocking of Internet Bank access? Review your account statement and submit the information to us.

The login session is terminated when there is no activity for 5 minutes. You will be asked to re-enter your login details. Time limits are used for security reasons, to prevent Internet Bank access if a user forgets to log off from his/her account after finishing using the Internet Bank.
Once you finish an Internet Bank session, log off (by clicking 'Logoff') and close the browser.

On the computer:

By clicking on the lock sign you should see the correct Swedbank certificate:

On the smart device:

Before entering your login data, make sure that the website domain is “swedbank.lv”.

When accessing internet bank via a laptop or stationary computer, follow these safety measures:

Install antivirus software and configure it to automatic update of the virus definitions database (at least one auto-update per day).
Install the local firewall. It should be configured so that it prevents connections from the Internet to your computer.
Use the latest browser and operating system available.
Turn on automatic updates for all software. If it cannot be updated automatically, regularly check on its latest software.
Set your browser to block pop-ups.

Check computer safety.

More information on the ways to secure your device and to safely use other Internet services is available on the following websites:

https://cert.lv/lv

Do not forget to follow safety measures when accessing internet bank via mobile devices:

Download applications only from trusted sources such as the App Store, Google Play or Windows Phone Apps – Microsoft Store.
Do not jailbreak your mobile device to get around limitations set by your mobile network operator or device manufacturer. It will remove protections built into the device to defend against mobile threats.
Always screen lock your smart phone or any of your computers. If several levels of screen lock security are offered, always use the highest security level.
Do not allow other persons to use your phone or tablet where the Swedbank mobile app is installed.
Do not reveal the screen lock codes to other persons and do not allow to unlock your phone with other persons’ biometric data.
Use antivirus software.
Always adhere to the requirements or security alerts of the manufacturer of your phone device.

When shopping online, be cautious with your personal and financial data. Properly assess the threats, which you may encounter on the internet. We recommend ensuring protection of personal devices and always following these safety tips:

Only shop in reliable shops. It is always safe to buy goods and services in well-known Lithuanian and foreign e-shops with a good reputation. Take a critical approach to unknown sellers and try to find out more information about their activity. Study public internet feedback about a specific online shop. Find out whether the website presents detailed contact data of its administrator (address, phone, email, etc.), and make sure it does not contain various errors in their links (additional words or letters, strange symbols), popup windows, advertisements, a great number of links instead of informative content.
Be cautious about discounts. You have found a high-quality product offered at a particularly low price? Before making a payment, be sure that the company that offers the product really exists and is trustworthy. Be careful about advertisements in social networks. They may lead you to a fake online shop.
Safe shopping by card. When shopping in foreign e-shops, the most common way of payment is by card. In this case you will have to indicate the details of your payment card. If an online shop participates in international security programmes, special logos such as “Mastercard Identity Check”, and “Visa Secure” for Visa cards are used in this shop. You may be redirected to internet bank to confirm payment transaction by logging in. Learn more about “Safe online shopping” programme here. Before making a payment in an online shop, please evaluate safety of the online shop and study public internet feedback about its activity.
Safe payment via electronic banking system. When shopping in Lithuanian online shops, usually you will be redirected to Swedbank internet bank account. You will recognise it from the Swedbank logo and internet bank address: https://www.swedbank.lv/banklink It confirms that payment is made directly through the bank system. After you enter your login details, the website will automatically display the generated payment form.
Third party providers. As of 14/09/2019, when you shop online, you might be offered to use payment initiation service, offered by payment institution (PISP), other than the bank, to pay for goods or services. If you choose to initiate payment from your account, kept with the bank, you might be asked to fill in the payment order form in the PISP’s environment, and give your consent to transfer data, necessary for performance of payment transaction, and later to confirm payment order with the Swedbank internet bank authentication mean. If you have noticed any transaction in the account statement, not authorised by you, inform us immediately by calling +371 67444444 (for private clients) or +371 67444444 (for business clients).

Have you encountered anything suspicious that may be a potential security flaw? Notify us!

It is important for us at Swedbank that our customers feel safe and secure when managing their monetary affairs with our digital channels. Therefore, we seek to ensure the highest security level in IT systems. Despite this, an error may slip by. If you have found a potential security flaw, we would like to hear more about it to be able to correct the problem as soon as possible.

How do you report?

Send an email to us in your local language at responsible-disclosure@swedbank.com. Optionally, you can use our public PGP key to protect the information you send over. Make sure to have included the following information:

Detailed description of the vulnerability containing such info as URL and type of vulnerability.
The necessary information that we need to resolve the problem.
If applicable, a screenshot of the vulnerability you have found.
Contact information, name and surname, email, phone number, and your public PGP key (if you have one).

This personal data submitted by you will be processed by Swedbank in order to inform you about the analysis of IT security flaws noticed by you and their correction, and, if necessary, to contact you regarding the revision of the information submitted by you. More information about Swedbank’s data processing procedure is available in the Swedbank Principles of Processing Personal Data.

What can you report?

You can report security flaws that you have found in any of our services. Examples of security flaws are cross-site scripting, flaws in encryption or flaws with security implications in logic controls. The reporting service is not designated for other logical errors, errors in texts, questions about our services, questions about the security of our services or similar.

What can you expect from Swedbank?

We will confirm that we have received your description, continuously keep you updated while we process the issue, and inform you when the issue is fixed. Claims for compensation as a condition for sending in a vulnerability are not accepted.

What is required from you?

It is important for both us and our clients that you follow good practice, i.e. that:

You do not use the vulnerability to access or attempt to access information that does not belong to you.
You do not use the vulnerability to remove or modify information.
You do not affect the availability of our services.
You give us an opportunity to fix the reported vulnerability before going public with it.

Can you file a report anonymously?

Yes, but we won’t be able to respond and keep you updated on the status.

PGP key

Use this PGP key if you want to send us an encrypted e-mail. But using it is not required.

Key ID: 0x0AD6CCAF

Control code: 2D14 4030 6D4B 68C3 F286 3AC6 333B E8E4 0AD6 CCAF

We encourage you to update your browser and operating system version as soon as an update is released. These updates can be set up automatically for better security and experience in our digital channels. We officially support these browser versions:

Google Chrome 85 and later;
Microsoft Edge 85 and later;
Mozilla Firefox 80 and later;
Safari 14 and later.

Secure banking

How to protect your money from fraudsters?

Types of bank fraud

1. Internet banking fraud

2. False invoices

3. BEC fraud

4. CEO fraud

5. Phishing emails

6. Email attachments

7. Delivery frauds

1. Internet banking fraud

2. False invoices

3. BEC fraud

4. CEO fraud

5. Phishing emails

6. Email attachments

7. Delivery frauds

See warnings by the Bank of Latvia about:

Jūsu Internet Explorer pārlūkprogramma netiek atbalstīta.

Lūdzu izmantot Google Chrome, Mozilla Firefox vai Microsoft Edge pārlūkprogrammu.

You have been logged out from Internet bank

Money Request now also for companies!

Contacts

Useful links

Legal information

Not a customer yet?

Secure banking

How to protect your money from fraudsters?

Types of bank fraud

1. Internet banking fraud

2. False invoices

3. BEC fraud

4. CEO fraud

5. Phishing emails

6. Email attachments

7. Delivery frauds

1. Internet banking fraud

2. False invoices

3. BEC fraud

4. CEO fraud

5. Phishing emails

6. Email attachments

7. Delivery frauds

See warnings by the Bank of Latvia about:

Jūsu Internet Explorer pārlūkprogramma netiek atbalstīta.

Lūdzu izmantot Google Chrome, Mozilla Firefox vai Microsoft Edge pārlūkprogrammu.

You have been logged out from Internet bank

Money Request now also for companies!

Contacts

Useful links

Legal information