KSB Bank Smart - Cyber Security Protection Fraud Webinar

We’re aware of a situation where fraudsters are spoofing Kennebec Savings Bank’s phone number and pretending to be KSB staff. The Maine Bankers Association has confirmed that we’re not alone—other banks in Maine, and possibly beyond, are experiencing similar fraudulent activity. 

As mentioned in the “Important Takeaway” section, if you’re ever in doubt, hang up and call us directly. You can always ask to speak with your usual business contact at Kennebec Savings Bank. No one here will ever be upset that you want to verify who you're speaking with or connect with your trusted partner at KSB. 

To address the second part of your question: there are several ways criminals can determine where someone banks. For example: 

• Checks: Most checks display the bank’s logo or name. 

• Public filings: Information in Uniform Commercial Code (UCC) or other loan filings can reveal banking relationships. 

• Card data: The first six digits of a debit or credit card (known as the BIN) are tied to the issuing bank. 

• Location and market share: In some regions, it’s not difficult to guess where someone banks based on which institutions dominate the local market. 

• Third-party data breaches: If a business where you’ve used your card experiences a breach, that data could potentially expose your banking information. 

Fraudsters use all of these clues to piece together where someone banks, so it’s important to stay vigilant. 

This is such an important topic. By attending today’s session—or reviewing the recording and sharing the materials provided, such as guides and resources—you’re actively strengthening your organization’s security. We encourage you to have your teams watch the recording as well. As your financial institution, we’re always happy to assist with user reviews and are your partner in protecting your business. 

The Kennebec Valley Chamber of Commerce had a business luncheon on fraud prevention recently and there are many other events, webinars, and training sessions offered by financial institutions—often free and available online. In addition to those, insurance companies, local payments associations like NEACH (New England ACH Association), and other organizations frequently offer training opportunities, some at no cost and others for a reasonable fee.  

There are also excellent free tools available online. The Cybersecurity and Infrastructure Security Agency (CISA) offers free training toolkits and even on-site assessments. The U.S. Small Business Administration (SBA) also provides a variety of cybersecurity resources. We’ve included links to these tools at the bottom of our slides, and they’re great options to explore further. 

For those looking for more robust solutions, there are paid third-party tools like KnowBe4, a widely used cybersecurity awareness platform. 

There are many great resources online to help identify phishing emails. A quick Google search will turn up helpful PDFs and guides that you can share with your team. 

I prefer using a Two-Factor Authentication (2FA) app. These apps live on your mobile device, and the only way someone could access the code is by physically having your phone. The same applies to soft token apps—they generate a code within an app on your phone, adding a strong layer of protection. 

We also offer hard tokens, which are small physical devices you can keep on your keychain or in your desk. These generate a unique code for logging into online banking. Again, the key advantage is that someone would need to physically possess the device to gain access. 

In contrast, methods like email, text messages, or voice calls are more vulnerable. Fraudsters are becoming increasingly skilled at spoofing phone numbers and intercepting messages. For example, if a criminal has already compromised your email account, they could easily retrieve a 2FA code sent via email. 

While any form of multi-factor authentication is better than none, we strongly recommend using 2FA apps, soft tokens, or hard tokens as the most secure options. 

I recommend setting up alerts that work best for you. Everyone manages their finances differently, and the key is to choose alerts that you’ll actually pay attention to and find helpful. 

If you’re someone who appreciates frequent reassurance and doesn’t mind multiple notifications, you might benefit from enabling an online banking login alert. That way, every time you log in, you’ll receive a multi-factor authentication (MFA) code followed by a text message confirming the login. This can give you peace of mind, knowing that only you are accessing your account. 

Others may prefer fewer notifications and might opt for alerts only when a transaction fails or for a daily summary of activity. It really depends on your preferences and how you monitor your accounts. 

That said, I strongly recommend enabling alerts for critical changes, such as an ACH payee change. Since payees don’t change often, receiving an alert for this type of activity can be a vital early warning sign of fraud. 

There’s no one-size-fits-all solution. Take time to review the alert options available and select the ones that align with how you manage your business’s day-to-day finances.