Bank impersonation fraud is when a fraudster impersonates someone from the bank in order to trick a victim into making payments to a fraudulent account.

What a fraudster might do:

• A fraudster usually calls their victim, though may use email or another contact method. It’s likely they already know information about the victim, including their name and who they bank with.
• While impersonating the bank staff member, the fraudster might tell the victim their account is under threat and they need to make payments to a “safe account” or set up payments in order to “block the funds”.
• The fraudster might ask for details from the Digipass so they can access the account and make payments to the fraudulent account themselves.
• The fraudster might ask the victim to download screen sharing software so they can view or control the victim’s computer. This can make it easier to take control of the account.
• In any scenario, the fraudster will foster a feeling of panic in order to get the victim to comply with their requests as quickly as possible.
• Fraudsters might also impersonate other well-known, trusted companies such as Microsoft, Apple, BT or HMRC.

What Triodos Bank will never do

• We’ll never call you to tell you to log into internet banking or to make a payment to a “safe account”. If we believe your account to be under threat, we can block the account ourselves and do not need you to do anything from your end.
• We’ll never ask you for your full Digipass number or your Digipass PIN.
• We’ll never ask you to download any software onto your PC or mobile phone.

What you can do to protect yourself

• Never give out your personal details to someone who has called you unexpectedly.
• Never download any software onto your PC or mobile phone when asked by someone over the phone or by email – even if you think you are speaking to a trusted organisation.
• Never give anyone your Digipass number or your Digipass PIN. Triodos will never ask for this information.
• Do not let someone else use your Digipass – even a colleague or family member. Your Digipass is assigned to you as an individual and must only be used by yourself. If you leave your place of work, please let us know and we can arrange for your Digipass to be cancelled.
• If you are unsure about someone who has called you claiming to be from the bank or another company, hang up and call back on the company’s published telephone number.

If you are a personal customer and you only hold savings accounts with Triodos - you will have been provided with a username and password for logging into internet banking. If you came to a page which asked for a Digipass number, you were on the ‘Business Banking’ login page. When on the Internet Banking login page, if you click on the ‘Personal Banking’ tab located next to the ‘Business Banking’ tab, you will be asked for your username and password.

If you do not know your internet banking username or password you can reset your internet banking login details.

If you hold a personal current account with Triodos and you havent received a digipass or have lost your digipass please contact us on 0330 355 0355.

If you are a business customer and have requested a Digipass that hasn’t arrived or you have lost a digipass please contact us.

A security word is a word chosen by you to help us verify your identity when you phone us or at any other time when we need to validate that it is you asking us for information or to do something on your account(s) . The security word is a memorable word chosen by you and can be anything you want. You will have provided this either as part of an online or paper application, on a form you’ve sent us by post or you may have set or changed it when you were logged into your internet banking. For example it could be a memorable name or place or something that means something to you. For additional security we do not provide any guidance on what this word should be.  

To help keep your information as safe and secure as possible, if you do not enter any information for 15 minutes, we will close your session. If a message tells you that your session has timed out, simply log in again to continue.

If you lose your connection after authorising a normal payment it will still be processed as normal - use the transaction history option to check the status of your payments. If the payment is not shown on one of these pages then it is still awaiting authorisation. If you lose your connection before authorisation they try logging back in and check the status of your payments. If you are unsure then please call the helpdesk. If you lose your connection after making an international payment, faster payment or urgent payment, please contact the helpdesk (call on 0330 355 0355 or alternatively you can email: internetbanking@triodos.co.uk) who will confirm if the payment has been successfully authorised or not.

If we are unable to match the information you have entered on our password reset page with the information we hold on record you will need to call our Customer Contact Team on 0330 355 0355 or (+44) 0117 973 9339. We will be able to send a new password to you by post, this will be sent to your registered address. When calling us please have your account number and security details at hand.

If you are trying to log into internet banking for a business account you do not need a username and password but will have a Digipass and PIN. There are separate log in screens for business and personal customers so please ensure that you have clicked on the Business tab after you have clicked the Internet Banking login button.

We're available to take your call between 10:00am-5:00pm on Mondays, 9:00am-5:00pm Tuesday to Friday. At any other time you can request a call back using our automated system. We will do our best to call you back at the time requested but can’t guarantee that it will be at the exact time requested.

Yes - as well as creating ad hoc UK payments you can import a file containing a batch of payments. Normally you will create this file in your accounting software.

Under the Account Management tab in Internet Banking, the Import Payments page allows you to select a file for import by browsing any of the drives accessible to your computer. Once you have selected the file, you need to authorise the import using your Digipass.

You will need to ensure that your file conforms to one of the file formats below. These files are usually produced in your accounting software.

• Import file specification - batch payment format
  
• Import file specification - BACS format (agency transactions)
  

If you’re not sure how to create an import file in either of these formats, please contact your accounting software support provider.

You can see a history of imported files, including status, in your internet banking under the Account Information tab, on the page Imported Files History.

Fraudsters try getting money from organisations by sending fake emails and texts to gain access to their internet banking details. It can be difficult to spot a fraudulent email, but there are things you can check for clues it’s a fraudulent email.

• Check the sender email address
  Always check the sender’s email address to make sure it’s from the person you think. Fraudsters can change the ‘From’ name so it can look like it’s come from your bank, or a person’s name. If you hover over the name, the sender’s email address should be displayed. If it’s a company email address, an online search of the email address will often tell you if it’s a genuine address.
• Call the sender
  If you get an unusual request from someone you know, asking you to transfer money or download something onto your computer, and the email address looks genuine, there’s a possibility their email account was hacked. To be safe, it’s best to call them to make sure they sent the email and really made the request.
• Look for spelling mistakes
  Scam emails can often look odd, with a messy layout and spelling mistakes.

Common email and text scams to look out for:

• CEO fraud
  Fraudsters email employees pretending to be the owner or CEO of the organisation, asking them to make a payment or transfer.
• Supplier fraud
  Fraudsters pretend to be your supplier letting you know their payment details have changed.
• Invoice fraud
  Fraudsters send fake invoices claiming to be from a real business you work with. Sometimes they hack the emails of your supplier to send the invoice, so the email address is genuine, but the payment details are changed to those owned by the fraudster. It’s sensible to call your suppliers on the number on their website to verify their payment details before you pay new account details for the first time.
• Pretending to be a business
  In these messages, texts or emails, you might be asked to click a link that takes you to a fake website – for example, the website might claim to be the Triodos Bank website (See ‘How to check that a website is genuine’). On this site you could be asked to give your internet banking details. We will never send you a link to the login pages of internet banking.
• Spyware in links
  Some scam emails ask you to download something onto your computer or network – this could be a link to a website or an attachment. This tool could spy on your computer or lock you out until you pay a ransom or reveal your bank security details.
• Smishing (fraudulent text messages)
  These are text messages that appear to be from well-known businesses, claiming you need to click the link to update your details. Often the links are disguised with short links – like bitly links, e.g. https://bit.ly/2kwosxu. Tempting as it is to use the link, contact the company using the details on their website to verify that they sent the text, and that it’s safe to click on the link. Fraudsters will impersonate these companies to obtain your valuable information.
  

We’ve created this online resource to help you protect your business from fraud.

Share it with your team and regularly review it to help you protect what’s important to you.

We recommend that you:

• Review who can authorise payments and how much
  Review your internet banking payment limits and authorisation in your internet banking or by calling us. Confirm how many people have a Digipass and access to your internet banking. A Digipass should never be shared - please request a Digipass for every individual who requires access to internet banking. What levels of authorisation do payments need? Decide if you want two people to authorise a payment over a certain amount to ensure each payment is double checked. We can set this up to suit your needs.
• Create a training schedule
  Regularly educate your employees about fraud risks to help them spot and handle fraud. You can share resources like our how-to guides, and signpost them to websites like Action Fraud UK. In-house training could include regular emails about fraud, test emails to practise how to spot a fraudulent email and how to respond, and yearly refresher workshops. The training is not about scaring your employees, but helping them feel in control when they suspect fraud, and confident in how to respond.
• Introduce a payment process
  Create a process document that outlines all the steps that should be taken to authorise a payment, including checking the authenticity of the payment request and payment details.
  
• Introduce a fraud policy
  Make a policy that clearly outlines how employees can use their work devices, and ensure they understand it and follow it carefully. Your employees should never download apps, software or programmes onto their work devices or click on links in suspicious emails or messages. They should also be sensitive about what they share on social media and what they email to their personal email addresses from their work account.
  
• Install anti-fraud software
  There’s plenty of software you can use to help you assess risks and detect fraud, including alerts for risky activity on a corporate device. Having up-to-date anti-fraud software reduces the risk of cyber attack, malware, ransomware, data breaches and ultimately losing the business money.

You can also find in-house training at:

• Gov.uk
  
• National Business Crime Centre
  
• The National Cyber Security Alliance (NCSA)
  

No-one wants to imagine that one of their employees would commit fraud, but sometimes this happens. There are a few things you can do to protect your organisation:

• Never share your Digipass or PIN
  Digipasses are unique to each account operator, so if you allow someone else to use your Digipass it will be recorded as a payment authorised by you. If you have new staff or need to change an account operator, download the Business Banking change of account operator form and post it to Freepost TRIODOS BANK. We can set up each new staff member with their own Digipass and internet banking access. If you remove an account operator, please send the Digipass back to us.
  
• Employee checks
  Review your recruitment procedures and ensure you’ve got appropriate checks and references in place for candidates hoping to join your organisation, such as criminal record checks and references from previous employers. See the ACAS website for advice.
  
• Be aware of who has access to sensitive information
  Regularly check who can access important data and systems, such as customer or membership data, or financial information. When employees leave your organisation their access should be stopped. Access should only be given to employees who really need access to these systems or data.
• Create a whistleblowing policy
  This can support your employees to anonymously report suspicious activity they see in the organisation. Promote the policy so all staff feel confident and safe in reporting suspicious activity. For more advice on whistleblowing, see the gov.uk website.
  

Social media fraud can be many things. It could look like:

• An unusual message from a friend, colleague or family member on Facebook, Twitter, LinkedIn or other social media platform. Fraudsters sometimes hack social media accounts to scam people into sending them money or personal data. If you get an unusual request like this, call your friend on a number you trust to make sure the message is real.
• A request to connect with you or a message from an account you don’t know. Often these have lots of spelling mistakes or a messy layout, but not always. It’s best not to accept a request to connect with someone or give consent for them to message you unless you know who they are and trust them.
• Competitions and quizzes. If you have to give personal details to enter a competition or quiz, make sure you trust the owner of the quiz or competition and that they are a genuine company. Quizzes and competitions are often created to capture participants’ personal information, which they can later sell or use against you.
  

• Use a different, strong password for every social media account you have – ideally with special characters, numbers and lower and upper case letters.
• Don’t create passwords that contain personal information - fraudsters scan social media accounts for personal details and try to guess passwords and steal identities.
• Some fake accounts are created to capture personal information, so don’t give personal information to anyone you don’t know and trust.
• Don’t click on links if they’re not from a trusted website - some links can put a virus on your device.
• Always log off to prevent someone else accessing your account.
• Be mindful of what you share and post on company social media channels whose services you use. Social media is great for contacting companies directly to solve problems or give feedback. If you mention or message your bank, phone network or utility provider on social media, be aware that this information is public and fraudsters can use it to convince you they’re calling from these companies.
  
  

On the home page you will see a list of all the accounts that you currently manage online. Details of closed accounts are displayed in red. Clicking on one will take you directly to the transaction history for that account.

When you input the sort code and account number to make a payment, we will check that the details are valid and that the sort code will accept the type of payment you are trying to make. If we can identify that the sort code or account number are invalid you will receive an error message on the screen.

Please review the account details you have entered. You may wish to contact the payee to confirm their account details.