Vishing is where a fraudster uses voice messages or phone calls to try to steal identities, and financial information like your PIN, card details and Digipass code.

The term comes from the combination of ‘phishing’ and ‘voice’. Phishing is where fraudsters use email, regular phone calls and fake websites to dupe people into giving them personal details and financial information.

Vishing is specifically the use of a VOIP service (Voice Over Internet Protocol, or an internet phone service), which enables fraudsters to communicate with their potential victims via automated voice messages and the phone keypad.

Vishers can create fake caller ID profiles so that their phone number seems legitimate, and vishing requests sound urgent, to panic the victim into acting without thinking.

 Examples of vishing:

• Your bank account has been compromised
  You receive call from what appears to be Triodos Bank’s phone number. When you answer, you hear a recording pretending to be from Triodos, saying that your bank account has been compromised, and you need to call a freephone number to reset your security details. Calling this number, you would hear another automated message asking for your bank account number, Digipass code or other personal details via the phone keypad.
• You’re eligible for a loan
  You are offered loan or credit terms too good to be true (they probably are), and to receive the money, you just need to pay an upfront fee or provide your security details.
• You’re due a refund
  You receive a message that says you are due a refund. This is usually someone claiming to be from a trusted organisation. If you opt in – usually by pressing a number on your telephone - you will be redirected to a call centre agent who will attempt to defraud you or steal your information.
• Don’t miss this investment opportunity
  An automated voice message tells you about an investment opportunity too good to turn down. You’ll be encouraged to transfer money to invest in a company or service that doesn’t exist.
• You’ve won a prize
  Victims hear an automated voice message about a free offer or prize, and just need to pay postage, redemption or admin fees to claim. There’s often a deadline to hurry people into handing over their card details.

What you can do

If you receive an unexpected phone call with an automated response, hang up, search for the company’s genuine contact details online and check whether the call was legitimate. If it was, the company will be able to help you, and if it was a vishing attempt, letting the company know enables them to take action, and you will have protected yourself from fraud.

If the call relates to an investment opportunity, check the FCA register to see if the investor is regulated, and confirm the company exists by checking Companies House.

How to report a vishing scam

If you think you have been a victim of a vishing attack, call us immediately on 0330 355 0355. Then report to the FCA using their reporting form.

If you have lost money to suspected investment fraud, report it to Action Fraud on 0300 123 2040.

If you receive a call from Triodos, we’ll be happy for you to question who we are and call us back on the number published on our website, just to make sure. If you can, call us back from a different phone, as an extra safety precaution. Fraudsters can clone numbers, so it may look like the number we use to call you.

We will never call you to ask you to transfer money or for your Digipass codes, and we will never ask you to download software onto your device. If someone calls pretending to be from Triodos, and they ask you to do these things, hang up immediately and report it to us on 0330 355 0355.

As you'd expect from a bank, we take security very seriously - here are some things we do to keep you safe. To help you spot fraud, we’d also like you to know the things we’d never do.

• Provide around the clock debit card transaction monitoring
• We are available 24 hours a day, seven days a week for all calls relating to debit card queries (such as lost or stolen cards)
• Give you the ability to block your card by sending us a text message
• Temporarily block accounts and debit cards if fraudulent activity is suspected
• Log you out of internet banking and the app after a period of inactivity
• Keep you up-to-date with the fraud protection advice
• Use a secure three-stage log in with a digipass for personal current account holders
• As a personal account customer you can receive alerts by text message when online or card transactions are made
• Temporarily suspend your internet banking if left dormant for a long time
• Only contact you via your registered details

We will never contact you out of the blue to ask you:

• for your digipass PIN
• for your card number or PIN
• for your mobile app passcode
• to transfer money out of your account
• to click a link in an email to our internet banking

If in doubt, call us on the number on our website, or delete the email without opening it.

Learn more about how to stay safe online or visit the action fraud website.

Fraudsters often look for data on people that they can use to impersonate or defraud them.

They may research you or your colleagues, so we advise that you educate your staff about protecting their data and ensure they are fraud aware too.

What kind of data might a fraudster steal?

• Personal details, such as your name, address, date of birth and National Insurance number.
• Contact details like your mobile phone, landline, work number and email address(es).
• Memorable information used for security and passwords, such as mother’s maiden name, schools or university attended, pet names, car makes and names of family members.
• Your bank account number, sort code and card details.
• PINs, passwords, Digipass number or other login details.

Ways fraudsters might get hold of your data:

• Social media and online forums – LinkedIn, Facebook, Twitter, Instagram, Reddit – all public platforms could hold a wealth of information about you, your employees, your business and your customers.
• Your company website – if your business has a website, consider what information you include. We advise you not to put your bank details on your website, as fraudsters can use this to impersonate you or your bank.
• Competitions and quizzes – particularly those found on social media websites.
• Calling you and pretending to be a trusted organisation.
• Companies who sell your email address or phone number - always read terms and conditions when signing up for a product or service.
• Bank statements, post and paper documents. Always lock away documents that hold sensitive information and destroy them when no longer required.
• Hacking into email accounts. Ensure your IT systems are secure and be wary of using shared internet connections outside of work. Consider that your suppliers, customers and partners can also have their emails hacked. We recommend that you do not share sensitive data via email – if you need to, encrypt the information with a password.
  

It can be very difficult to spot a fraudulent call. The best thing you can do if you get an unexpected call – especially if the person is asking you to make a payment or move funds, or rushing you to make a decision – is to call the organisation back on the number published on their website.

Fraudsters may call you or someone in your team and pretend to be a well-known business like BT, the bank, HMRC, the police, a supplier or even another person in your business.

Examples of what a fraudster might ask you to do:

• Move your money to a safe, secure holding account
  Fraudsters often call businesses pretending to be from their bank. They may ask you to move your money to a safe account because of suspected fraud or risk to your account. In reality, this ‘safe’ account is controlled by the fraudster. Hang up and report it to Action Fraud UK and your bank.
  
• Change the payment details of one of your suppliers
  Fraudsters often impersonate suppliers and ask businesses to pay into a new account – controlled by the fraudster. Check the caller is genuinely your supplier by calling back on the number on their website or, better still, by calling your direct contact at the company.
• Download something – software, a programme, app or other online tool
  Fraudsters may tell you there’s something wrong with your computer and it’s not secure. By downloading some software, they’ll be able to fix it for you. They might even offer you compensation or a refund for this inconvenience. In reality, the downloaded software could give them access to your computer. They may ask you to log in to your internet banking so they can issue your refund, when really they’re asking you to authorise payments into their own account. Triodos will never call you out of the blue and ask you to transfer money into another account, or download something onto your device.
• Tell them your Digipass codes
  Your Digipass codes give permission for money to leave your account. Never give these codes, no matter what they tell you. We will never ask you for these codes.
  

If you are a personal customer and you only hold savings accounts with Triodos - you will have been provided with a username and password for logging into internet banking. If you came to a page which asked for a Digipass number, you were on the ‘Business Banking’ login page. When on the Internet Banking login page, if you click on the ‘Personal Banking’ tab located next to the ‘Business Banking’ tab, you will be asked for your username and password.

If you do not know your internet banking username or password you can reset your internet banking login details.

If you hold a personal current account with Triodos and you havent received a digipass or have lost your digipass please contact us on 0330 355 0355.

If you are a business customer and have requested a Digipass that hasn’t arrived or you have lost a digipass please contact us.

Bank impersonation fraud is when a fraudster impersonates someone from the bank in order to trick a victim into making payments to a fraudulent account.

What a fraudster might do:

• A fraudster usually calls their victim, though may use email or another contact method. It’s likely they already know information about the victim, including their name and who they bank with.
• While impersonating the bank staff member, the fraudster might tell the victim their account is under threat and they need to make payments to a “safe account” or set up payments in order to “block the funds”.
• The fraudster might ask for details from the Digipass so they can access the account and make payments to the fraudulent account themselves.
• The fraudster might ask the victim to download screen sharing software so they can view or control the victim’s computer. This can make it easier to take control of the account.
• In any scenario, the fraudster will foster a feeling of panic in order to get the victim to comply with their requests as quickly as possible.
• Fraudsters might also impersonate other well-known, trusted companies such as Microsoft, Apple, BT or HMRC.

What Triodos Bank will never do

• We’ll never call you to tell you to log into internet banking or to make a payment to a “safe account”. If we believe your account to be under threat, we can block the account ourselves and do not need you to do anything from your end.
• We’ll never ask you for your full Digipass number or your Digipass PIN.
• We’ll never ask you to download any software onto your PC or mobile phone.

What you can do to protect yourself

• Never give out your personal details to someone who has called you unexpectedly.
• Never download any software onto your PC or mobile phone when asked by someone over the phone or by email – even if you think you are speaking to a trusted organisation.
• Never give anyone your Digipass number or your Digipass PIN. Triodos will never ask for this information.
• Do not let someone else use your Digipass – even a colleague or family member. Your Digipass is assigned to you as an individual and must only be used by yourself. If you leave your place of work, please let us know and we can arrange for your Digipass to be cancelled.
• If you are unsure about someone who has called you claiming to be from the bank or another company, hang up and call back on the company’s published telephone number.

Our primary feature regarding the digipass device is that of security. Our current providers VASCO have confirmed that the digipass can be recycled and if you wish to return your digipass to us if you no longer require it we will recycle it securely on your behalf.

If you need a new digipass because the battery is low (when it displays 5%) please let us know and we will send out a replacement. You should receive this within 5 business days.

We will replace your digipass free of charge when the battery level is 5% or less. In our experience when it proactively displays “Low Battery” it will still have quite a long battery life left. You can find out the amount of battery left on your digipass by following these instructions:

If you have the older style navy blue digipass:

• Turn it on by pressing the red power button
• Press the letter “T” button five times until the display shows “TEST BATT?”
• Press the “=” sign

The display will tell you what percent of battery you have left.

If you have the green digipass:

• Turn it on by pressing the OK button on the lower right of the digipass
• Press the “>” button four times until you see “5. Info” on the screen
• Press OK
• Press the “>” button three times until it states “4. Battery level” on the screen
• Press OK

The display will tell you what percent of battery you have left.

Identity fraud happens when someone steals and uses your personal information to buy products or services. They get hold of this information in many ways - taking post from your bin, looking for information about you online, or contacting you directly, pretending to be from a real organisation.

There are several things you can do – offline and online - to protect your personal information. Here are a few tips.

Protect yourself offline:

1. Shred your post
   Shred or cut up your post before putting it in the bin, so your name and address cannot be stolen.
2. Redirect your post
   If you move house, ask Royal Mail to redirect your post for at least a year.
3. Be tidy
   Don’t leave things like bills or personal documents lying around for others to see. Even on your work desk.
4. Know your bank
   This sounds like an odd one, but knowing how your bank will and won’t contact you can help you spot fraudulent emails, texts or calls claiming to be from your bank. If a bank statement or new bank card doesn’t arrive, tell your bank or card company immediately.

Protect yourself online:

1. Create complex passwords
   Create strong passwords and different passwords for every online account you have (email, online banking, social media, retail websites etc). Avoid using personal information in passwords, like names of family, school, pets, cars. This will reduce the likelihood that someone could guess or hack your password and access other platforms you use. You might find a password management tool useful.
2. Use anti-virus software
   Protect your internet-connected devices with up-to-date security software, and make sure you install all official software updates and security fixes on your devices.
3. Connect with those you know
   Don’t accept invitations from people you don’t know on social media sites.
4. Be wifi wise
   Public wifi connections and Hotspots can be hacked and used to see what you’re doing online. Whilst it’s fine to use public wifi for browsing, never use it for buying something, logging in, online banking, filling in forms – or anything else that requires your personal or card data.
5. Be private
   Double-check that your social media profiles are private so that you’re only sharing information with people you know.
6. Think before you post
   Before you post anything on social media, forums or online platforms, make sure you’re not revealing any personal information – even pictures of your car registration can be used to get your address from DVLA records.

Our card department provides 24 hour transaction monitoring on the Triodos Debit Card and will block a transaction or a card if required. In this event they will send a text message asking you to call them. The will ask standard identity questions around your personal details and investigate the transaction with you. They will not ask for the card PIN, three-digit CVV code on the back of the card or any information regarding your digipass.

A security word is a word chosen by you to help us verify your identity when you phone us or at any other time when we need to validate that it is you asking us for information or to do something on your account(s) . The security word is a memorable word chosen by you and can be anything you want. You will have provided this either as part of an online or paper application, on a form you’ve sent us by post or you may have set or changed it when you were logged into your internet banking. For example it could be a memorable name or place or something that means something to you. For additional security we do not provide any guidance on what this word should be.  

It’s important to keep your codes and PINs secret and your digipass safe. Here are some precautions you can take:

1. Destroy any PIN notification immediately after receiving it from us
2. Never write your PIN or security details in a way that might be understood by someone else or record them on any item or in any place that might be accessed by someone else
3. Take all reasonable care to ensure that no-one sees your PIN, password or security word when you use them.
4. Avoid a PIN that is easy to guess
5. Never share your digipass
6. Keep your digipass in a safe place

We will never contact you to ask you to reveal your internet banking PIN or password and we will never send you any emails asking for your security information.

1. Contact us immediately on 0330 355 0355 (or if abroad on +44 (0)1179 739339) if:

• You’ve lost your card or suspect it has been stolen
• You’ve lost any of your security details or think they have been stolen
• You think someone else may be able to use your card or security details

For card related queries, we're available 24/7. For other fraud related queries, we're available 8am-6pm Mon-Fri, and 10am-4pm weekends.

2. Once you've contacted us:

• We'll ask you for all information you have about the loss or theft and may require you to report it to the police
• If you find your card after reporting it as lost or stolen do not use it. Destroy your card immediately by cutting through both the magnetic stripe and chip

3. Once you’ve let us know, you can also report it to Action Fraud – the UK’s national fraud and cyber crime reporting centre:

• Call: 0300 123 2040
• Report it online: actionfraud.police.uk
  

The digipass plastic is recyclable and in line with our sustainability commitment so please send in broken, old, damaged digi passes using the freepost address - Freepost TRIODOS BANK - and we will recycle it securely for you.

Simply go to our website www.triodos.co.uk and in the top right-hand corner you'll see a link for "Login to internet banking".

All you need is your digipass, digipass PIN (which you set yourself), and details regarding the security word you set up when applying for the account.

If you authorised a card payment or any other payment from your account, you will be responsible for it. If your card or security details are used to make a payment or transfer without your permission, we will refund the full amount (minus £35 where applicable) of the payment as soon as is operationally possible. This includes repayment of any interest or charges incurred as a result of the payment. However, you must notify us as soon as possible and no later than 13 months after the debit date. After this time we will not be able to issue a refund.

You may have to pay up to £35 if:

• Your card is used after being lost or stolen
• You fail to keep your security details safe

You may be responsible for money taken from your account up until the point you report it to us, if you:

• Don’t keep your card or security details secure
• Don’t tell us as soon as possible that your card is lost or stolen
• Share your card, digipass or security details with a third party
• You were aware that your account had been compromised at the time that the payment was made and you failed to tell us.

You will not be responsible if you’re unable to notify us because our phone lines are unexpectedly unavailable or closed, as long as you call us when our lines open the next day.

To help keep your information as safe and secure as possible, if you do not enter any information for 15 minutes, we will close your session. If a message tells you that your session has timed out, simply log in again to continue.

If you lose your connection after authorising a normal payment it will still be processed as normal - use the transaction history option to check the status of your payments. If the payment is not shown on one of these pages then it is still awaiting authorisation. If you lose your connection before authorisation they try logging back in and check the status of your payments. If you are unsure then please call the helpdesk. If you lose your connection after making an international payment, faster payment or urgent payment, please contact the helpdesk (call on 0330 355 0355 or alternatively you can email: internetbanking@triodos.co.uk) who will confirm if the payment has been successfully authorised or not.

Identity theft is when someone steals your personal details. They might go through your post or rubbish to find bank and credit card statements. Or they might use social media sites, forums and other online platforms to steal your personal information.

Identity fraud is when someone uses your stolen identity to buy products or services, like credit cards, loans or mobile phone contracts.

You might not know your identity has been stolen until you get a bill, invoice or delivery for something you didn’t buy. Or until you receive a letter from debt collectors for debts that aren’t yours.

There are ways you can protect yourself, however. Read our How-to guide on how to protect yourself from identity theft and identity fraud.