As you'd expect from a bank, we take security very seriously - here are some things we do to keep you safe. To help you spot fraud, we’d also like you to know the things we’d never do.

What we do

• Provide around the clock debit card transaction monitoring.
• Provide 24/7 phone support to answer your questions about your debit card.
• Give you the ability to block your card in the Triodos App or Internet Banking.
• Temporarily block accounts and debit cards if fraudulent activity is suspected.
• Automatically log you out of Internet Banking and the app after a period of inactivity.
• Keep you up to date with fraud protection advice.
• Send text alerts when online or card transactions are made.
• Temporarily suspend your Internet Banking if left dormant for a long time.
• Monitor payments to assess whether the payment you are making is likely to have been made as part of a scam.

What we’ll never do

We will never contact you out of the blue to ask you:

• For your mobile app passcode.
• For your digipass PIN.
• For your card number or PIN.
• To transfer money out of your account.
• To click a link in an email to our Internet Banking.
• To download any software onto your PC or mobile phone.
• To authorise or cancel card payments through the app, or approve “refunds”.

If in doubt, call us on the number on our website, or delete the email without opening it.

Learn more about how to stay safe online or visit the action fraud website.

Screen scraping happens when you allow a third party to log into your computer while you are using it, so they see what you are doing and can copy the data on the screens you are viewing. This is a way for third parties to be able to get access to your payment data or account overview.

Triodos Bank is not in favour of this practice, as it potentially compromises the integrity of your own computer and your passwords.

If the text is from a sender you know, or from a shortcode (five to eight digits long):

• Reply ‘STOP’. You shouldn’t be charged for this, and it will let the sender know you don’t want to receive their text messages.
• If you’re unhappy about receiving the text or continue to receive them after asking the sender to stop, you can complain to the Information Commissioners Office (ICO) on 0303 123 1113 or online.

If the spoof text message (sometimes known as smishing) is from an unknown sender, or from an organisation you’re not familiar with:

• Do not reply or click on a link in the text. Responding confirms your number is active and could result in you receiving more messages or calls.
• Report the spam text to your network operator. Simply forward the text to 7726. An easy way to remember ‘7726’ is that they’re the numbers on your phone keypad that spell out the word ‘SPAM’. You may get an automated response thanking you for the report and giving you further instructions if needed, like forwarding on the number the spam text message was sent from. You won’t be charged for forwarding spam texts to 7726.
  

If you receive a call from Triodos, we’ll be happy for you to question who we are and call us back on the number published on our website, just to make sure. If you can, call us back from a different phone, as an extra safety precaution. Fraudsters can clone numbers, so it may look like the number we use to call you.

We will never call you to ask you to transfer money or for your Digipass codes, and we will never ask you to download software onto your device. If someone calls pretending to be from Triodos, and they ask you to do these things, hang up immediately and report it to us on 0330 355 0355.

Fraudsters often look for data on people that they can use to impersonate or defraud them.

They may research you or your colleagues, so we advise that you educate your staff about protecting their data and ensure they are fraud aware too.

What kind of data might a fraudster steal?

• Personal details, such as your name, address, date of birth and National Insurance number.
• Contact details like your mobile phone, landline, work number and email address(es).
• Memorable information used for security and passwords, such as mother’s maiden name, schools or university attended, pet names, car makes and names of family members.
• Your bank account number, sort code and card details.
• PINs, passwords, Digipass number or other login details.

Ways fraudsters might get hold of your data:

• Social media and online forums – LinkedIn, Facebook, Twitter, Instagram, Reddit – all public platforms could hold a wealth of information about you, your employees, your business and your customers.
• Your company website – if your business has a website, consider what information you include. We advise you not to put your bank details on your website, as fraudsters can use this to impersonate you or your bank.
• Competitions and quizzes – particularly those found on social media websites.
• Calling you and pretending to be a trusted organisation.
• Companies who sell your email address or phone number - always read terms and conditions when signing up for a product or service.
• Bank statements, post and paper documents. Always lock away documents that hold sensitive information and destroy them when no longer required.
• Hacking into email accounts. Ensure your IT systems are secure and be wary of using shared internet connections outside of work. Consider that your suppliers, customers and partners can also have their emails hacked. We recommend that you do not share sensitive data via email – if you need to, encrypt the information with a password.
  

We recommend you check that you have the necessary secure (SSL) connection with Triodos Bank.

How to check your secure connection with Microsoft Internet Explorer:

1. In the address line, HTTPS should appear instead of HTTP. The "S" stands for secure
2. Select "Properties" from the "File" menu
3. Next to "Connection" it says SSL x.y, where x.y = version number
4. Select "Certificates" for information about the certificate assigned to Triodos Bank (or double-click on the padlock in the browser status bar).

To prevent unauthorised access and viruses being downloaded onto your computer, you should use a firewall and anti-virus software.

A personal firewall is software that protects your computer against abuse from hackers and warns you if someone tries to gain access to your computer.

This type of protection is very important for computers that have a permanent internet connection, e.g. with an (A)DSL (broadband) or cable connection.

Here are some tips for using your firewall and anti-virus software effectively:

1. Make sure you always install the most recent updates
2. Make sure the anti-virus software is always activated, even when you are not connected to the internet
3. Make sure you set up the anti-virus software to scan your entire computer regularly
4. If an active anti-virus programme or firewall causes problems with Triodos internet banking, please check the settings of the anti-virus software and the firewall Internet banking security
5. Only install software of known origin and integrity

Do not save encrypted pages on your hard drive. It is standard practice not to save encrypted pages in your browser. This ensures that other users of the same computer cannot access these pages when you are finished with them. You can check and if necessary change the security setting for your browser. With Microsoft Explorer proceed as follows: 

1. select "Internet Options" in the "Tools" menu 
2. go to the "Advanced" tab 
3. under "Security", activate the "Do not save encrypted pages to disk" option.

• Use a different, strong password for every social media account you have – ideally with special characters, numbers and lower and upper case letters.
• Don’t create passwords that contain personal information - fraudsters scan social media accounts for personal details and try to guess passwords and steal identities.
• Some fake accounts are created to capture personal information, so don’t give personal information to anyone you don’t know and trust.
• Don’t click on links if they’re not from a trusted website - some links can put a virus on your device.
• Always log off to prevent someone else accessing your account.
• Be mindful of what you share and post on company social media channels whose services you use. Social media is great for contacting companies directly to solve problems or give feedback. If you mention or message your bank, phone network or utility provider on social media, be aware that this information is public and fraudsters can use it to convince you they’re calling from these companies.
  
  

For card related fraud, block your card in the Triodos Mobile Banking App or in Internet Banking. Then, please call us on 0330 355 0355 (or +44 (0)1179 739339 if calling from abroad) to speak to our 24/7 card services department.

For other fraud issues and queries, we're available 8am-6pm Mon-Fri (9am-6pm Thu), and 10am-4pm weekends.

We’ll ask you for all relevant information related to the scam, loss or theft and in some cases may ask you to report this to the police.

We’ll advise you on any next steps, and we may provide you with advice to help keep your account secure whilst we investigate.

Where Fraud is confirmed you should also report it to Action Fraud – the UK’s national fraud and cyber crime reporting centre:

• Call: 0300 123 2040
• Report it online: actionfraud.police.uk

Identity fraud happens when someone steals and uses your personal information to buy products or services. They get hold of this information in many ways - taking post from your bin, looking for information about you online, or contacting you directly, pretending to be from a real organisation.

There are several things you can do – offline and online - to protect your personal information. Here are a few tips.

Protect yourself offline:

1. Shred your post
   Shred or cut up your post before putting it in the bin, so your name and address cannot be stolen.
2. Redirect your post
   If you move house, ask Royal Mail to redirect your post for at least a year.
3. Be tidy
   Don’t leave things like bills or personal documents lying around for others to see. Even on your work desk.
4. Know your bank
   This sounds like an odd one, but knowing how your bank will and won’t contact you can help you spot fraudulent emails, texts or calls claiming to be from your bank. If a bank statement or new bank card doesn’t arrive, tell your bank or card company immediately.

Protect yourself online:

1. Create complex passwords
   Create strong passwords and different passwords for every online account you have (email, online banking, social media, retail websites etc). Avoid using personal information in passwords, like names of family, school, pets, cars. This will reduce the likelihood that someone could guess or hack your password and access other platforms you use. You might find a password management tool useful.
2. Use anti-virus software
   Protect your internet-connected devices with up-to-date security software, and make sure you install all official software updates and security fixes on your devices.
3. Connect with those you know
   Don’t accept invitations from people you don’t know on social media sites.
4. Be wifi wise
   Public wifi connections and Hotspots can be hacked and used to see what you’re doing online. Whilst it’s fine to use public wifi for browsing, never use it for buying something, logging in, online banking, filling in forms – or anything else that requires your personal or card data.
5. Be private
   Double-check that your social media profiles are private so that you’re only sharing information with people you know.
6. Think before you post
   Before you post anything on social media, forums or online platforms, make sure you’re not revealing any personal information – even pictures of your car registration can be used to get your address from DVLA records.

If your card or security details are used to make a payment or transfer without your permission, we will refund the full amount (minus £35 where applicable) of the payment as soon as is operationally possible. This includes repayment of any interest or charges incurred as a result of the payment. However, you must notify us as soon as possible and no later than 13 months after the debit date. After this time we will not be able to issue a refund.

You may have to pay up to £35 if:

• Your card is used after being lost or stolen
• You fail to keep your security details safe

You may be responsible for money taken from your account up until the point you report it to us, if you:

• Don’t keep your card or security details secure
• Don’t tell us as soon as possible that your card is lost or stolen
• Share your card, digipass or security details with a third party
• You were aware that your account had been compromised at the time that the payment was made and you failed to tell us.

You will not be responsible if you’re unable to notify us because our phone lines are unexpectedly unavailable or closed, as long as you call us when our lines open the next day.

You can place a block on your card and order a replacement in the Triodos Mobile Banking App by going to More > Cards, or in Internet Banking by going to Self-Service > Cards. 

If you need more support, please call us on 0330 355 0355 (or +44 (0)1179 739339 if calling from abroad) to speak to our 24/7 card services department. We do not have a facility to offer emergency cash in the instance where your card has been lost or stolen. A new debit card should arrive at your home address within five working days.

Investment fraud comes in many forms, but is typically when someone poses as an investment service provider, Financial Advisor or fund manager to convince you to transfer large sums of money into a company or service that doesn’t actually exist.

They can create convincing-looking websites and adverts, and send you emails, texts and automated voice messages offering investments that sound too good to be true. They often are.

Before you transfer any money:

• Always check the FCA's ScamSmart webpage for advice on being a ScamSmart investor
• Always check the FCA register to see if the investor is regulated and what they are regulated to do
• Always confirm the company exists by checking Companies House
• Always call the company on the number on their FCA register listing to confirm the correct payment details.

Genuine financial services will never:

• Cold call you
• Put pressure on you to invest
• Ask you to transfer immediately to lock in a deal or take advantage of a time-limited offer or special discount

As a general rule, if it sounds to good to be true, it probably is. Beware of promises of high returns and guaranteed returns with no risk.

>More fraud advice

Useful resources

• Money Advice Service - advice for choosing a financial advisor
• Age UK – Investment Scams

If someone accesses your business account without your authorisation, we’ll refund the full amount of money taken from your account, as long as you:

• have not given someone else your security details (including your digipass PIN)
• have used reasonable care when using internet banking (e.g. logging out at the end of each internet banking session and not leaving your computer unattended while logged in)
• inform us as soon as possible of any security breach or potential breach
• have not acted fraudulently
• have taken all reasonable precautions to safeguard your personal and financial details. Read our terms and conditions below for more

Contact us immediately on 0330 355 0355 (or +44 (0)1179 739339 if calling from abroad) if you think you've lost any of your security details or if you think they have been stolen or may be known by someone else.

You can request a password reset letter on our website at any time. This will cancel the old password to prevent access to your account by internet banking using the old password.

This is when fraudsters send fake invoices claiming to be from a real business you work with. Sometimes they hack the emails of your supplier to send the invoice, so the email address is genuine, but the payment details are changed to those owned by the fraudster. It’s sensible to call your suppliers on the number on their website to verify their payment details before you pay new account details for the first time.

Steps you can take to protect against invoice fraud:

• Check invoices carefully
  All staff who process supplier invoices and have the authority to change bank details should check supplier names, addresses, invoice amount and bank details to ensure they’re correct.
• Verify payment changes
  If a supplier asks to update their payment details, always verify it with them by calling the number on their website.
• Follow up invoice payments
  When you pay a supplier invoice, let the supplier know the payment has been made, confirming the amount and bank details paid into.
• Check bank statements carefully
  Report all suspicious debits to your bank immediately.
• Call suppliers back
  If you are suspicious about a phone request, say you’ll call the supplier back. Use the number published on their website or saved to your phone so you know it’s the genuine number you’re calling.
• Review public information about your suppliers
  Fraudsters often thoroughly research suppliers of organisations so that they can convincingly impersonate them. It may be a good idea to remove any information about your suppliers from your website and other public materials.

It can be very difficult to spot a fraudulent call. The best thing you can do if you get an unexpected call – especially if the person is asking you to make a payment or move funds, or rushing you to make a decision – is to call the organisation back on the number published on their website.

Fraudsters may call you or someone in your team and pretend to be a well-known business like BT, the bank, HMRC, the police, a supplier or even another person in your business.

Examples of what a fraudster might ask you to do:

• Move your money to a safe, secure holding account
  Fraudsters often call businesses pretending to be from their bank. They may ask you to move your money to a safe account because of suspected fraud or risk to your account. In reality, this ‘safe’ account is controlled by the fraudster. Hang up and report it to Action Fraud UK and your bank.
  
• Change the payment details of one of your suppliers
  Fraudsters often impersonate suppliers and ask businesses to pay into a new account – controlled by the fraudster. Check the caller is genuinely your supplier by calling back on the number on their website or, better still, by calling your direct contact at the company.
• Download something – software, a programme, app or other online tool
  Fraudsters may tell you there’s something wrong with your computer and it’s not secure. By downloading some software, they’ll be able to fix it for you. They might even offer you compensation or a refund for this inconvenience. In reality, the downloaded software could give them access to your computer. They may ask you to log in to your internet banking so they can issue your refund, when really they’re asking you to authorise payments into their own account. Triodos will never call you out of the blue and ask you to transfer money into another account, or download something onto your device.
• Tell them your Digipass codes
  Your Digipass codes give permission for money to leave your account. Never give these codes, no matter what they tell you. We will never ask you for these codes.
  

In order to safeguard your personal information and money we require a three stage login process for internet banking, one of which involves the use of a digipass. This is similar to the card reader facility at some other banks and is used along with other systems to ensure your finances are kept safe. We constantly review our security measures and publish guidance on steps that can be taken to prevent fraud such as the Take 5 campaign through FFA UK.