03.22.10

Twitter users are reporting a new attempt to extract their usernames and passwords — a Direct Message attack that asks “You’re on here?” with a link.

Others report Direct Messages linking to a site called “mhansenhome” with the message “someone posted on their blog about you.”

If you get such a message on Twitter, DO NOT click the link or enter your login details on the landing page. If you find you’re sending out these Direct Messages to friends, follow the steps provided under “How Do I Protect My Twitter Account.” The key thing to do if your account has been hacked is to to change your Twitter account password.

The good news is that Twitter is taking steps to combat phishing by rolling out its Twt.tl URL shortener — links sent via DM will soon appear as “twt.tl” links in your e-mail notifications, allowing Twitter to re-route malicious links to a warning page.

The best way to keep yourself free of phishing attacks is to avoid clicking on any link sent to you via Direct Message in Twitter. Also, before clicking on any shortened URL in your Twitter stream, make sure it is legit by running it through a service like LongURL.org.

03.18.10

Facebook users are currently reporting that they’ve been receiving an email that states “Facebook Password Reset Confirmation” but, this email is a scam that  contains a virus.

The fake e-mail appears to be from Facebook saying the company reset your password and urges you to open an attachment. The text of the message is as follows:

Dear user of facebook,

Because of the measures taken to provide safety to our clients, your password has been changed. You can find your new password in the attached document.

Thanks,
Your Facebook

The message shows up as coming from “Facebook Support” at help@facebook.com, although that’s really not the source. Downloading the attachment to your computer could do serious damage and it could also result in a compromised Facebook account. If you have downloaded the application you should install a virus scanner and also change your Facebook password.

If your account still ends up getting hacked, you should reclaim your account by following the directions on this help page.

03-11-09

There is a new Facebook attack that is tricking people into clicking on a link via chat. Here’s how it works: You get a random chat from a friend with a link to “vote-me” that includes a message with repeated text and misspellings.

If you click on that link, it takes you to a bogus Facebook login site:

Note the copyright date shows 2008 rather than the correct year.

Users who enter their login credentials are then redirected to a real Facebook login page where they are prompted to type in their information again. Users think they may have made an error during their first login attempt, so they try again. On the second attempt, they login, but now their security has been compromised. Now the phishers can spread the threat through this users online identity by tricking his / her friends.

The best way to protect your online accounts is to avoid clicking on links that come through your Facebook email and chat. Should you want to click on a link that has been posted on your Page, or you want to investigate an article that a fan has posted, only do so if you are confident the link is legitimate.

Many users will post shortened links rather than the full URL that look like this: http://j.mp/bf8LEV

Use a free service like LongURL to investigate the link before you click on it.

A strong password includes a combination of letters, numbers and characters. Sometimes characters are not allowed, but use them if you can.

The problem with strong passwords is that they are hard to remember. Here’s a helpful tip: Think phrases.

Example

Here is a quote from Marilyn Monroe,

“I am not interested in money. I just want to be wonderful.”

Now let’s turn that into a strong password. Take the 1st letter from each word:

I A N I I M I J W T B W

Now let’s replace some of the letters with numbers and characters:

I A N I I $ I J W 2 B W

Now let’s mix up some of the capital letters with small letters:

I a n i i $ I j w 2 b w

A different phrase for every account

While it may be tempting to use the same strong password across your accounts, this is not recommended. Come up with different passwords for each account. Here are some ideas for safe storage:

• Type your passwords on a document and then use the “Encrypt Document” option for additional security.

• Use a service like 1Password (costs about $40.00). Be sure to secure it using a strong password.

• Take advantage of the safety features included in your bank’s Internet Security Software (i.e. login manager). Be sure to secure it using a strong password.

Look to this spot to be notified of any changes that may affect your social media strategy (i.e Facebook changes Privacy Settings, LinkedIn adds a new feature for Companies, etc).

We’ll also notify  you as soon as we can when we learn about phishing schemes (bad links being posted on social media sites to avoid clicking on) to help you keep your accounts safe. To learn a technique that will help you better secure your online presence, read “Keep Your Accounts Protected with Strong Passwords“.

Recent Alerts

03.18.10 – Facebook Reset Password Confirmation is Fake

03.11.10 – Chat Phishing Attack on Facebook

03.11.10 – (Update) Twitter Accounts Hacked by Diet Sites

03.07.10 – Twitter Accounts Hacked by Diet Sites

03.11.10 – Update

It appears the “Diet Sites” attack is affecting Twitter users with weak passwords. Make sure your account has a strong password. To learn a technique that will help you better secure your online presence, read Keep Your Accounts Protected with Strong Passwords.

03.07.10

Hundreds of Twitter users have begun tweeting weight loss product spam. Users who click on the link become part of the phishing scam.

Here’s what the phished tweets look like:

Or like this:

Do not click on these links. The source of this hack has not been discovered yet. We will keep you posted. As a precautionary measure, consider changing your password.

If you think your account has been compromised, check out our article “How Do I Protect My Twitter Account” and follow the steps provided.

If you are still having problems, report it to Twitter Support.

Also, be on the lookout for these corrupt links on Facebook and LinkedIn too, since many users send their Twitter updates to these services.

First, a social media policy is not a substitute for a social media strategy. You establish boundaries with policies. You direct your efforts with strategies.

Second, setting policy is important. Training your people on how to use these new tools is just as important. Help them understand both the policy and the reason behind it.

We should also mention three important caveats about setting policy:

• Social media is constantly evolving.
  
  

  So don’t set policy for a specific platform (e.g. Facebook). Instead guide your people on how to behave across the spectrum of social media spaces.
  

• Don’t create policies in a vacuum.
  
  

  Develop an understanding of the breadth of social media including how it creates value for your bank. This is the only way to arrive at policies that protect you without impeding productivity.
  

• There is no “one size fits all” policy manual.
  
  

Your policy should reflect the culture of your organization.

With these points in mind, let’s discuss how to develop policies for your bank:

Review existing policies

When was the last time you updated your policies? For example, many organizations have a policy that restricts internet usage.

Your people can’t participate in social media on your behalf if they can’t get on the web. Instead of a blanket policy, consider setting boundaries on internet use by position.

Some positions require more interaction with the online world than others. Take this into account and set your policy accordingly.

Review existing documents

Your Non-Disclosure Agreement may have been written for the real world. Are they sufficient for the virtual world as well?

You may allow certain members of your staff to access social networking sites during work hours. They build relationships with customers and prospects. In some cases, this may be done through their personal account.

What happens if they leave your bank? Make sure you include language in your Non-Compete Agreement about soliciting your customers, including those with whom a staff member is connected online, after leaving your firm.

Select your spokespersons

You probably have designated people who speak for your bank if the media calls. We recommend that you treat social media the same way in the beginning.

While your spokespersons become familiar with the tools themselves, the rest of your people get to see first-hand examples on how you’re using social media.

Then you can gain leverage by methodically expanding to more people in your organization. Just don’t forget to train them!

Define improper conduct

While this will be specific to your bank, there are a few obvious things to spell out to your people:

• Publicly posting private information about any customer must be expressly forbidden.
  

• Likewise, sharing sensitive information about your bank should be considered a flagrant violation.
  

• Be careful about posting too much personal information. This is not just a work policy; it is for your people’s protection. Criminals can use information posted online to impersonate someone. They also may use information posted in real-time to know a person’s whereabouts (e.g. a burglar may learn that they are away from home).
  

• Make your people aware that their private lives can now be very public. There is a blurring of our personal and professional lives. They may be “off-duty” but still be seen as a representative of your bank. Technology makes it easy to capture the moment (e.g. someone uses a cell phone to take a picture that they post online). Embarrassing occasions can create ripples.
  

• Touting specific products or services without including the required disclosures must be prohibited. Hint: If a conversation gets this far, move it to a private forum.
  

• Speaking on behalf of your bank without being authorized to do so should be unacceptable.
  

• Making disparaging remarks about customers, colleagues or even the competition must be discouraged.
  

• During work hours, internet usage should be limited to activities that either promote your bank or enhance its operations.
  

• Discourage your people from clicking on links or opening attachments unless the message comes from a trusted source. This policy protects you and your people. Criminals send messages that appear to come from friends, connections or even the site itself. This is called “phishing”. Your people should be especially wary if a link takes you to a site that asks for their name and password. Hint: If this happens, the password should be changed immediately.
  

• Unsafe privileges must not be allowed if your people access their personal profiles at work (and for their own protection at home). If they allow others to embed code (e.g. HTML comments, links, attachments) on their personal profile, malicious software can be installed on their computer.
  

• Security warnings should never be ignored. Tell your people what you want them to do if this happens.
  

• Authorized spokespersons should be careful about sharing links. While links are a wonderful tool, they can be construed as an endorsement. Make sure you’re familiar with the site and its content before you link to it.
  

Encourage productive activities

Your list may be more exhaustive than this, but here are a few basic guidelines for your people:

• Participation should be promoted. Show your people what you’re doing online. Encourage them to provide their input, to promote your efforts on their personal profiles, to share content (e.g. photos) that you may post.
  

• Timely responses are a must. This isn’t just about social media. When someone reaches out to your organization by any means, it is important that your people reply relatively quickly. It may be a message from a given platform (e.g. Facebook). It could be a recommendation or even a complaint on a local directory (e.g. Yelp). No matter where the message comes from or what the message, you want to foster a culture of responsiveness. It sells well online and off.
  

• Authenticity is prized online. Encourage your people to be themselves. If they are not a spokesperson for your bank but still feel compelled to comment on something that involves your bank in some way, include a disclaimer that states that the opinions expressed are their own and they may not necessarily reflect those of your bank.
  

• Remind your people to maintain their professionalism. If someone posts an unfavorable comment, be respectful and work to solve the problem. Don’t respond “in the heat of the moment”. Keep attempting to move the conversation toward a resolution.
  

• Some public conversations should be moved to a private venue. Rather than continuing to go back and forth in public to resolve a complaint, tactfully suggest a private conversation. If a customer starts asking about a specific product or service, encourage him or her to e-mail, call or visit your bank.

Wouldn’t it be nice if your bank came up on the first page of those search results? Making sure your bank is listed in local directories will help you achieve that.

Most listings are free and some offer enhanced listings for nominal monthly fees. Below is a listing of the most beneficial directories for your bank.

Search Engine Directories

• Google Local Business Listings
  

You can get your business listed on Google’s map and show up directly on the search results by registering at the Google Local Business Center: http://www.google.com/local/add

Describe your business with location info, services, hours of operation and business website link. After you have a listing, your goal is get good, real reviews.

When consumers search for a local business or a local service on Google, a small map and some business results appear at the top of the search results. Additionally, you get a business details page that contains your website link, your phone number, email address, hours,service or product categories, etc.

Start by claiming your business at Google’s Local Business Center. Once you’ve verified your ownership, you can add details and even create coupons that will appear on your business details page.

A very useful feature on your Google local business dashboard is that you’ll see what search phrases people are typing in to find your bank and where those searchers are located on a map (abstracted to a zip code level to protect searchers’ privacy).

Enhanced listing option:

AdWords is the program where advertisers bid on search keywords and have their links appear next to or on top of search results. While the AdWords program is not specifically geared towards a local market, as an advertiser, you can limit where your ad appears based on the searcher’s location.

You buy AdWords ads by bidding on how much you’re willing to pay for clicks on your ad. Your ads appear on search results for your targeted keywords (ie., phrases people type into the search box). The more popular keywords (eg.”bank”) will cost more per click than more obscure keywords (eg.”local banks”).

Balancing the cost per click versus the popularity (reach) of keywords is what makes AdWords advertising a bit tricky. It does take quite a bit of management to maximize your ROI. Fortunately, Google allows you to set spending limits, and offers plenty of tools and resources to help you manage your AdWords campaigns.

Managing an AdWords campaign is beyond the scope of this article, but here are some resources to get you started:

AdWords homepage – http://adwords.google.com/

AdWords official blog – http://adwords.blogspot.com/

• Yahoo Local Listing
  

Just like Google Local, you can claim your Yahoo Local business listing for free. Claiming or creating the listing will allow you to enter additional information and keep your business details up-to-date.

The first step is to create a Yahoo login. If you already have a Yahoo email address, you can use that login account to manage your local business listing. If you already have a Yahoo account, login to your account. If you don’t already have one, you can sign up for a free Yahoo account here: https://edit.yahoo.com/registration

Start by doing a search for your business at Yahoo Local: http://listings.local.yahoo.com/

If your business already has a listing, click on the “edit info” link on the details page. Your business will then be linked to your Yahoo account, and when you go to listings.local.yahoo.com, you can click on the “Local Listings Account Center” link in the upper right hand corner to see all your business listings.

If your business is not yet listed, go to listings.local.yahoo.com and click on the “Sign Up” button. You will be presented with a form to fill out your business details like address, phone number, service description, and hours of operation.

For more information about Yahoo Local Listings:

Help page for Yahoo Local Listings: http://help.yahoo.com/l/us/yahoo/ysm/ll/index.html

Start page for Yahoo Local Listings: http://listings.local.yahoo.com/

Enhanced listing option:

Yahoo offers premium listings that you can purchase to give your bank more prominence. Yahoo Local offers two levels of premium listings: Enhanced or Featured.

An Enhanced Listing costs $9.95 per month. You get to add up to 10 photos, a longer description of your business, and stats on how often people see and click on your listing.

A Featured Listing puts your business in the sponsored results section of Yahoo search results. Pricing ranges from $15-$300 per month depending on the size of your city and demand for your service.

You’ll find a comparison of features for the Basic, Enhanced, and Featured Listings here: http://listings.local.yahoo.com/comp.php

• Bing Local Listing
  

You can add, edit, or delete the information about your bank that is displayed in search results on Bing Maps by using Bing Local Listing Center. Help customers find your bank by adding details such as hours of operation, services offered, website, and phone number.

Follow this link to get listed:

https://ssl.bing.com/listings/BusinessSearch.aspx

Social Directories

Social directories are those in which people can leave reviews about your bank. These directories are becoming an increasingly popular place where people search for services and products.

• Yelp!
  

Yelp is the premier review site for local businesses, almost tripling in traffic from 10 to 25 million unique visitors over the last year. Consumers can easily share their thoughts on local service providers and retail outlets, and in return, get honest reviews of local businesses from their peers. Businesses that receive positive reviews see dramatic increases in referral customers.

Yelp provides business owners that have “unlocked” (claimed) their pages with lots of value-added features including messaging options (eg., post offers and announcements, reply to reviewers) and stats on how many people have viewed your bank page. To claim your page, go here: http://www.yelp.com/

The biggest benefit of taking control of your Yelp page is being able to highlight positive reviews of your business and/or responding to reviewers privately.

• Citysearch
  

This business review site has been around for many years. The most important aspect of this site is that they show up well in search for Google and even better in Yahoo!. To get your bank listed visit: http://www.citysearch.com/

• MerchantCircle
  

Somewhat new on the scene, this company started in 2005 and has been infiltrating search listings and growing ever since. In June 2008, MerchantCircle announced over 5 million monthly users, 500,000 registered merchant users, and over 5,000 paying clients, with 4.3 million visitors a month according to Quantcast in 2007. To get your bank listed visit: http://www.merchantcircle.com/corporate/

• Insider Pages
  

Insider Pages is an online “local search” service where people share reviews of local businesses and find services. Insider Pages allows business owners to customize their business listings for free. Business owners can add photos, coupons and a ‘message from the owner’ to improve page performance. To customize your business page, go to your business listing and click the ‘Are you the owner?’ link. Follow the instructions and begin adding content to improve your business’ Internet performance. Join Insider Pages to add your bank: http://www.insiderpages.com/

Reach out to people you know – Promote My Business Page: Strategy

Engage your fans. Enable them to Comment on your Page – Creating Your Facebook Page: Editing

Post helpful and interesting Notes, Links, Events, Photos, Videos – Creating Your Facebook Page: Applications

Add local Business Pages to your Favorites – Tips for Facebook Admins

Add a Fan Box on your banks website – Promote My Business Page: Website

Leverage the viral nature of Facebook – the News Feed. The added benefit of creating an engaging page is that every time a person interacts with your Page – from “liking” your bank, to posting a comment to attending an event to tagging a photo – that activity is published to their News Feed which is seen by all of their friends on Facebook. When a user first logs into Facebook, they see a feed of their friend’s recent activity, so each and every activity of your fans on your Page gets shared with a greater network, giving your bank more visibility.