Precautions to take when using digital channels

The use of digital channels to offer retail banking products and services changes the way bank customers access information. Before concluding a contract or purchasing a banking product or service, customers must:

carefully read all the information provided by the institution;
clarify any doubts with the institution;
evaluate the conditions presented by the institution in advance, carefully analysing the respective costs, remuneration and risks involved;
ensure that all pre-contractual and contractual information is provided on a durable medium for consultation at a later date.

Bank customers should pay attention and follow the institution’s security procedures. When in doubt, they should not conduct the transaction without first asking their institution for any clarifications deemed necessary.

Precautions to take when conducting banking transactions through digital channels

In addition to the usual care associated with the product or banking service, you must:

Protect the device you conduct banking transactions through (computer, tablet or smartphone)

Set passwords and a screen pattern lock to stop your device from being used by others;
Do not reuse access codes — for instance, the code used in the home banking app must be different from the code used to unlock the device;
Do not allow websites or apps dealing with confidential information to launch automatically, without logging in;
Keep your operating system and your antivirus and antispyware software up-to-date in all your devices;
Protect electronic communications, always keeping the firewall active;
Avoid public devices (shared computers and tablets) to conduct banking transactions or payments;
Avoid leaving your device unattended.

Protect your internet connections

Always keep your browser up-to-date;
Protect wireless communications (wi-fi) by adopting secure protocols and avoid using public hotspots;
Always type in the URL you want instead of using a link or accessing the web history;
Check whether the address of the entity you want to access is its official address;
Always check that the address of the entity where you are entering your personal and confidential information begins with ‘https’. The ‘s’ stands for ‘security’. Websites whose address starts with ’https’ ensure that there is a secure connection to the online services of the relevant entity. This system is part of the ‘digital certificate’ of the entity’s website, which can be consulted by clicking on the closed padlock or the key symbol that should appear in the bottom right-hand corner of the browser (or the top right-hand corner, depending on the browser);
You can test if the website is safe by using the ‘wrong password trick’. On your first attempt to access the website, instead of logging in as usual, put the wrong password in. If it is accepted, this means that the entity in question is not checking your login (in other words, it may simply be collecting the password for illicit use);
If you open an email whose content is suspicious, in particular because you do not know its origin, you should not click on the indicated links, you should not execute the requested actions (do not run suggested programs) and you should not open the attachments;
Do not download email attachments from someone you do not recognise or that looks suspicious;
Do not open suspect emails and delete them immediately. Check the sender’s address (not just their name), the wording used (less careful, dubious expressions), the language and graphic presentation of the emails received, as false messages often adopt less formal and less correct language.

Use secure mobile applications (apps)

Only install trustworthy apps through official app stores. Not all apps are safe and may contain malicious software;
Carefully analyse the apps’ reviews. Many reviews are fake and deliberately created to lure users into installing the app;
Check the data access permissions required by the apps. Do not download apps that require apparently excessive permission requirements;
Check the security and the permissions required by the apps that came with your mobile phone.

Protect your personal data and confidential information

Do not give out passwords to third parties. Passwords are personal and non-transferable;
Do not choose passwords that are too obvious (e.g. 123456, ABCDEF, QWERTY) or associated with easily obtainable personal information (such as birthdays, children’s or spouses’ names, mobile phone numbers);
Use different passwords for different accounts;
Do not write passwords or other confidential information on paper, or keep them in emails or on your phone;
Do not send your IBAN, personal data (identification number, tax number, date of birth, full name, etc.), confidential codes and other sensitive elements by email or mobile phone messages;
Do not provide personal or confidential information in unsolicited phone calls. Be wary of any messages that state that a given service has been blocked and that you must reactivate it or that requires you to pay for an order that you have not placed. Contacts made with fraudulent intent usually carry with them a tone of urgency, so that you will quickly provide personal information without having time to think how best to act;
If you get a phone call, do not assume that it is a legitimate call just because the caller knows your basic personal information. They may have found that information online (for instance, on social networks);
Do not put confidential data and other information, such as your mobile phone number, into websites whose authenticity is not ensured;
Do not share personal or confidential information on social networks.

Work with the institution

Follow the security procedures that are transmitted to you by the institution, including whenever you conduct banking transactions through digital channels;
Contact your institution immediately if you detect unauthorised or unrecognised movements, keeping frequent and careful control of your accounts;
Notify the financial institution of any suspected fraud before proceeding with the banking transaction;
Remember that the institution will never ask for your home banking or app access data over the phone, by email or SMS.

Precautions when accessing your institution’s home banking or app

Securely access your bank account online (home banking)

Always type in your home banking service’s address, instead of using a hyperlink provided in an email, going through your browser’s ‘Favorites’ or ‘History’, or through search engine results. This way, you’ll avoid accessing any software that could misappropriate confidential information or that will redirect you to a website with the same look as your institution’s, but is fake (‘mirror website’);
Check whether the address you’ve typed in is the entity’s official address;
Confirm that the website address starts with ‘https://’ and that a padlock is displayed at the end of the address or at the bottom of the window. If you see neither, the webpage is not secure;
Never use the same password to access your institution’s home banking service as the one you use for less secure connections (for instance, social networks);
Avoid using your home banking service on public devices (shared computers, smartphones or tablets);
Make sure that you type in the password to access your home banking service and other authentication elements in private locations and that you are not being watched;
After using the home baking service, close the session and leave the institution’s website, clicking on the proper icons. Confirm that a new login is requested to access again;
Periodically check your account movements and the time and date of when you last accessed your home banking service;
Activate transfer and debit alerts and any other security mechanism that your institution provides;
Inform your institution, as soon as possible, of the theft, robbery or misappropriation of your home banking access credentials.

Securely use your institution’s app

Only install apps obtained in official app stores. Not all apps are secure and may actually contain malware;
Carefully read the reviews on apps prior to downloading them. Some apps display names and images very similar to the official institutions’ apps, as they have been deliberately created to mislead users;
Check your institution’s website for information on the app you want to download and follow the configuration instructions provided;
Confirm which authentication elements are requested each time you access your institution’s app and be wary if any additional information is requested;
Make sure that you type in your institution’s app’s password and other authentication elements in private locations and that you are not being watched. If your device allows it, prefer biometric authentication elements (for instance, fingerprint or facial recognition), which cannot be misappropriated by others;
After using your institution’s app, make sure that you have closed the session and that login must be repeated to access it again;
When in doubt, immediately contact your institution via the customary channels;
Periodically check your account movements and check the time and date of when you last accessed the app;
Activate transfer and debit alerts and any other security mechanism that your institution provides;
Inform your institution, as soon as possible, of the theft, robbery or misappropriation of your app access credentials.

Securely use payments apps operated by third parties

Find out which payment apps operated by third parties is provided by your institution (for instance, MB WAY, Apple Pay, Google Pay, Garmin Pay, Fitbit Pay, Swatch Pay). You can use these apps as well as your institution’s app.

Find out the elements of the payment app that you intend to use, including the operations you can carry out and any possible fees charged to you;
Only install apps obtained in official app stores;
When you join the app, add only your mobile phone number, where applicable. Never associate a third-party phone number to your payment app, as in doing so you may be allowing a wrongdoer to access your information and/or your funds;
Make sure that you type in your payment app’s password in private locations and that you are not being watched;
When you carry out transactions with your payment app, make sure that you are using the correct functionality and carefully read the notifications you receive in the app prior to accepting them. If your payment app allows for transfers, pay particular attention if you receive a notification ‘asking for money’; by accepting, you will authorise a transfer of funds from your account to someone else’s;
Never share with others your payment app’s access information or authentication codes for transactions carried out;
If you receive the notification of a transaction you have not carried out, immediately contact your institution via the customary channels.

Precautions to take when making online purchases

Before making a purchase online or through apps, be informed

Find out about the merchant:
- Search the internet for the company name or brand;
- Be suspicious if you do not find an address or phone number you can phone and the terms and conditions of the sale;
- Read about the experiences of other customers for a given product or online store, for example in discussion forums;
Check the website or app’s security:
- Check whether the address you wish to access starts with ’https://’ and whether there is a padlock in the navigation bar or at the bottom of the window. This means that the link is secure;
- Only install trustworthy apps from official app stores.
- Run your mouse over the quality seals. If these do not have a link or do not redirect you to the official website, the web page may be fake;
Adopt habitual security procedures to protect your computer, tablet or phone:
- Keep your antivirus and antispyware software up-to-date and the firewall active;
- Don’t connect to public or unknown wi-fi networks;
- Don’t use public devices to make online payments;
Read the terms and conditions:
- Check the payment methods;
- Learn about any added costs, such as postage or customs costs, if the store is based outside the European Union;
- Check the conditions and costs applying to returns or exchanges. Normally, in the European Union you have 14 days to return any product bought over the internet.

When you buy something, choose a payment method with added security

Make sure you only provide the information needed to complete the purchase;
Preferably opt for a form of payment with added security:
- Multibanco reference. If the merchant provides this form of payment, they will send you an SMS or email with the data you need to make the payment, within a given time period, at an ATM or through home banking.
- Cards with limited balance and short validity, such as prepaid cards. They narrow the possibility of card misuse and the amount of possible losses.
- Single-use virtual cards or with limited amount and validity. A virtual card is an electronically generated card for use online. Data for the real card are not disclosed at the time of purchase, thereby making the transaction more secure. This functionality can be provided by your institution and certain payment apps.
- Payment instruments with added security. Preferably use cards with added security procedures, such as the latest version of 3D Secure. As a rule, this service is already activated for credit and debit cards that permit online purchasing. If it hasn’t been activated yet, request your institution to do so. In that case, when you make a purchase, as a rule you’ll be asked to proceed with the customer strong authentication, which means that you must provide two valid authentication elements, in addition to the card data. The most common solution for strong customer authentication in online card-based transactions is to validate the transaction in your institution’s app.

After making your purchase, keep the records and check your bank account

Keep the records of the purchase made, including the information on the merchant and their URL. Where possible, print screen the transaction information;
Regularly check your bank account to see if the debits correspond to the purchases you made;
Notify the payment service provider that issued the card, as soon as possible, of the loss, theft or misappropriation of the card, using the contacts made available by the card issuer or disclosed for that purpose on this website.

Security procedures to be adopted by institutions

Institutions should have reliable, resilient and secure systems and adopt the best national and international safety practices.

Institutions should:

implement, monitor and regularly review a security policy for products and services provided through digital channels;
inform customers in advance of the technological requirements and security measures to be adopted;
promote awareness and dissemination campaigns on the security procedures that should be adopted by customers when a specific security threat is identified;
implement robust authentication procedures that allow a more secure verification of the bank customer’s identity, such as strong customer authentication mechanisms, in the case of payments;
adopt appropriate technical or organisational measures to ensure the integrity and confidentiality of their customers’ personal data.

Strong customer authentication

Authentication procedure, at the request of the institution, in which customers use two or more elements categorised as:

Knowledge — something only the customer knows (e.g. password);
Possession — something only the customer possesses (e.g. the mobile phone to which a code is sent by SMS);
Inherence — something the customer is (e.g. fingerprint).

The two elements requested must be in different categories.

Strong customer authentication

Financial literacy Digital channels

CONSULT HERE ALL SERVICES

Precautions to take when using digital channels

Precautions to take when conducting banking transactions through digital channels

Precautions when accessing your institution’s home banking or app

Precautions to take when making online purchases

Security procedures to be adopted by institutions

Strong customer authentication