News You Need to Succeed

What’s inside

A U G U S T 2 0 1 7

Cardholders can fight fraud with SHAZAM BOLT$ transaction blocks ���������������������2

Cash advance scam rears its ugly head again �������������������������������������������������������3

10 ways to ward off ransomware ����������������������������������������������������������������������������4

Core news corner ���������������������������������������������������������������������������������������������������6

5 reasons why you (and your cardholders) love debit cards ����������������������������������9

Your customers are on social media� Are you? ����������������������������������������������������10

ACH aficionados: Register for NACHA’s AAP exam �������������������������������������������������11

Pick up SHAZAM Card Block tips in free webinar Aug� 16 �������������������������������������12

SHAZAM training ��������������������������������������������������������������������������������������������������13

‘Home Sweet Home Rewards’ winners ������������������������������������������������������������������14

Spotlight on Service — August 2017 2

Your cardholders know their spending habits better than anyone else. They also enjoy having control over their cards. With the new transaction-level blocks in SHAZAM

® BOLT$™, you can leverage both of these facts and put your cardholders to work as super-efficient fraud fighters!

If your institution subscribes to the transaction control feature, your SHAZAM BOLT$ users recently gained the ability to set their own blocks for three transaction types:

• Transactions over a specific dollar amount

• Internet and phone transactions

• Transactions outside the U.S.

If a block is in place, transactions will be declined on the spot. The cardholder will receive an alert each time an attempted transaction is blocked.

What’s the benefit?Transaction control empowers your cardholders to set blocks that make sense based on their shopping preferences and their personal tolerance for risk. This convenient service won’t disrupt cardholders or their recurring payments.

In a 2014 survey by FICO®, 70 percent of respondents said they were concerned about fraudulent use of their payment cards. More than 50 percent said they want to use a mobile app to control the types of transactions for which their cards can be used.

With these new blocks, your cardholders will enjoy having more control over their cards and playing a role in stopping fraud, while you’ll enjoy the reduced fraud risk!

Examples• A cardholder who never travels

abroad may want to block all non-U.S. transactions.

• A cardholder who only shops at brick-and-mortar stores may want to block all internet and phone transactions (recurring payments won’t be affected). This block is especially valuable as EMV® adoption increases and

fraudsters shift their focus to card-not-present transactions.

• Your financial institution may have a $500 block set for a specific bank identification number (BIN). However, a cardholder knows he never performs transactions over $200. He can set his own block for transactions over $200, giving him satisfaction that he’s helping to reduce fraud risk.

Card block also availableThe transaction control feature also allows cardholders to place a temporary card block if a card goes missing. With the quick tap of a button, they can pause their account without affecting previous transactions. They can then remove the block when the card is found.

This gives your cardholders peace of mind and ultimately saves your institution money by not having to replace cards found a short time later. Reissuing a misplaced card costs $15 on average, so you can imagine the cost savings over time!

Enroll todayWe know you and your cardholders will enjoy the convenience and protection of these blocks.

If you’re not already using SHAZAM BOLT$ and transaction control, simply contact your SHAZAM client executive to sign up or learn more.

Cardholders can fight fraud with SHAZAM BOLT$ transaction blocks

Fraud and Risk Management

Spotlight on Service — August 2017 3

SHAZAM has been made aware of the re-emergence of a cash advance scam occurring in Iowa recently. Other areas of the U.S. could also be at risk, as fraudsters tend to migrate and communicate success with this scam. Please see below for details on the scam and best practices for protecting your financial institution.

Scam detailsFraudsters come into a financial institution branch presenting a not-on-us credit card and requesting a cash advance. The suspects are typically not discreet in their behavior. Often they are loud and have a dramatic story to explain their need for a large cash advance. Many claim to be travelers in distress with broken automobiles or other unexpected expenses.

The first attempt to authorize a card is denied when the teller swipes the card using the correct procedure. The fraudster may warn the teller that the card’s magnetic stripe is damaged. Upon denial of the card, the fraudster gives the teller a toll-free telephone number to call to force

an authorization. Sometimes the teller is directed to call the telephone number printed on the card, which has been counterfeited or altered.

When the teller calls, he or she immediately speaks with the fraudster’s accomplice, who pretends to be from the merchant authorization center. This scam is usually perpetrated by groups of four or fewer people. Often the accomplice answers the teller’s call from the parking lot while the fraudster is inside the financial institution carrying out the first part of the scam.

Best practices • Instruct all branch personnel to strictly adhere to cash

advance practices. Stress that any deviance from standard operating practices may result in a large financial loss for your institution.

• Notify police immediately while the fraudster is on your premises or as soon as you can comfortably do so.

• Take your time processing the cash advance request to give law enforcement time to arrive.

• Arrests will be greatly aided by observations from your staff. Solid physical descriptions, automobile makes and models, and license plate information are critical.

• Photocopy both the credit card and the identification presented by the fraudster, even if the suspect leaves without a successful cash advance.

• Try to capture all images of the fraudster and provide copies to law enforcement as soon as possible.

• Provide suspect photos and scam details to SHAZAM fraud operations so we can further assist our financial institutions.

For more informationIf you have any questions, please call SHAZAM fraud operations at 800-537-5427, ext. 2899.

Cash advance scam rears its ugly head again

Fraud and Risk Management

Spotlight on Service — August 2017 4

Ransomware is a computer virus that kidnaps your system and holds your data hostage until you pay a ransom to the cybercriminals. The malware encrypts data on workstations, networks, mobile devices and even files stored in the cloud.

Ransomware was recently in the news with the May 2017 WannaCry attacks, which targeted computers that used Microsoft® Windows® and demanded ransom payments using bitcoins.

Do you know how to defend your financial institution in the case of such an attack?

Profitable for perpetratorsCompared to typical data breaches, ransomware scams have a quicker, less complicated payoff and are more difficult to detect. Recently, the malware has been bundled with password-stealing technology to take advantage of weak website security.

Ransomware attacks are becoming increasingly profitable for perpetrators. Ransom demands can run from $500 to thousands of dollars.

Many victims decide to pay the cybercriminals to avoid the costly downtime and recovery, as well as possible legal ramifications and

customer complaints. However, information technology (IT) experts recommend against victims paying the ransom. Payment encourages scammers to attack again and find new victims. Also, there’s no guarantee the data will be released or the attackers haven’t kept a foothold in the systems they’ve compromised.

Even when institutions don’t pay a ransom, they have to pay in other ways. Often they’ll work with an IT vendor to complete a costly and time-consuming network restoration, and the financial institutions still lose a full day’s worth of network data.

Prevention: 10 tipsFollow these tips to help thwart ransomware attacks at your institution:

1. Back up your data regularly and have a solid business continuity plan in place.

2. Always apply the latest security patches to remove known vulnerabilities.

3. Keep firewalls on and properly configured. Block known malicious internet protocol (IP) addresses.

4. Run real-time anti-malware and anti-virus software.

Ransomware is on the rise, and small businesses are the prime target.

10 ways to ward off ransomware

– Continued on next page

Fraud and Risk Management

Spotlight on Service — August 2017 5

5. Disable any system functionalitythat isn’t needed, such asmacros or other features thatexecute code.

6. Use advanced email securitysystems to thwart maliciousemails.

7. Educate employees aboutmalicious emails, socialengineering and other security

gaps where ransomware can enter your system.

8. Limit administrator access anduse only normal user accountsfor daily tasks.

9. Switch off unused connectionsand the affected system from theinternet immediately if an attackis suspected.

10. Report attacks to the authorities.

For more informationTo find out how to ensure your systems are secure against ransomware, please call Tom Quist, SHAZAM Secure account executive, at 800-537-5427, ext. 4370.

Ransomware – Continued from previous page

Fraud and Risk Management

Spotlight on Service — August 2017 6

Core news cornerImportant industry and compliance news for financial institutions

FinCEN to update the Currency Transaction ReportIn August, the Currency Transaction Report (CTR), available on the Bank Secrecy Act (BSA) e-filing system, will be updated to adhere to the changes defined in the Federal Register’s February 20, 2016, notice. New or updated data fields will be added to the online discrete CTR, as well as the CTR batch files.

New or updated data fields:• Part I — Person Involved in

Transaction

• Renaming Item 2d from“Courier Service (private)” to“Common carrier.”

• Part II — Amount and Type ofTransaction

• Adding a checkbox to Item24, Shared Branching.

• Part III — Transaction Location

• Adding an Unknown optionto Item 29, Primary FederalRegulator.

• Adding an Unknowncheckbox to Item 32, EIN.

• Adding Item 37, Country.

• Adding Item 41, Cash inamount for transactionlocation.

• Adding Item 42, Cash outamount for transactionlocation.

• Part IV — Filing InstitutionContact Information

• Adding this section to collectdata about the institutionthat filed the CTR.

• Batch filers will be requiredto submit the updated CTRdata in an XML-based filevs. the current ASCII-based,fixed-length delimited file.The XML User Guide can bedownloaded here.

• The batch CTR XSD file canbe downloaded here.

• Batch CTR Deadlines

• The BSA e-filing system willcontinue to accept ASCII-based batch files until May2018. Batch filers will havenine months from the livedate in August to adhere tothe new XML specification.

• To view the new or updateddata fields on the actualCTR, read FinCEN’s May 24announcement.

FDIC report outlines mobile strategies for banking the underserved As part of its broader effort to identify ways mobile banking can help meet the needs of the unbanked and underbanked, the Federal Deposit Insurance Corporation (FDIC) released a report identifying possible strategies for financial providers. The FDIC report is based on focus groups conducted with unbanked or underbanked people, as well as

interviews with industry executives and consumer advocacy groups.

The study identifies seven core financial services needs for underserved consumers:

• Control over finances —Consumers want to knowexactly when and why money isdeposited and withdrawn from

accounts, and they want to be certain about the terms and conditions of the product.

• Access to money — Consumersexpect financial providers tomake their funds availablequickly because they often needto use funds as soon as they arereceived to pay bills and makepurchases.

Core

– Continued on next page

Spotlight on Service — August 2017 7

• Convenience — Consumers value features of a financial product or relationship that saves time or effort when conducting transactions.

• Affordability — Consumers are sensitive to the predictability and level of fees for account maintenance and everyday transactions, such as accessing cash.

• Security — Consumers want protection from physical and electronic theft of funds or personal information.

• Customer service — Consumers expect to have the ability to access live help through their preferred banking channel.

• Long-term financial management — Consumers seek advice on money management or the availability of tools to meet

financial goals, such as spending reports and savings trackers.

Mobile is an especially promising channel for reaching the underbanked, the FDIC said, noting that underbanked households are 4 percentage points more likely to have a smartphone than fully banked households. More than 90 percent of underbanked millennials — those between ages 18 and 34 — have smartphone access.

Advisory on the availability of appraisersThe Federal Deposit Insurance Corp. (FDIC), the Federal Reserve Board, the Office of the Comptroller of the Currency (OCC) and the National Credit Union Administration (NCUA) issued an advisory that discusses two existing methods that may address any appraiser shortages: temporary practice permits and temporary waivers.

The advisory addresses concerns regarding the timeliness of appraisals, due largely to what financial industry commenters believe to be problems with the availability of certified and licensed appraisers, particularly in rural areas.

Highlights:• Title XI of the Financial

Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA) requires that appraisals

for federally related transactions be performed by individuals who meet certain certification or licensing requirements.

• The advisory discusses two existing options that may help insured depository institutions and bank holding companies address any appraiser shortages: temporary practice permits and temporary waivers.

• Temporary practice permits may be granted by state appraiser regulatory agencies to allow credentialed appraisers to provide their services in states experiencing a shortage of appraisers subject to state law. In addition, reciprocity is a widely used practice in which one state recognizes

the appraiser certification and licensing of another state, permitting certified and licensed appraisers to perform appraisals across state lines.

• Temporary waivers set aside requirements relating to the certification or licensing of individuals to perform appraisals under Title XI of the FIRREA in states or geographic political subdivisions when certain conditions are met. Authority to grant temporary waiver requests rests with the Appraisal Subcommittee, with the approval of the Federal Financial Institutions Examination Council (FFIEC).

Core news – Continued from previous page

– Continued on next page

Spotlight on Service — August 2017 8

Agencies update Cybersecurity Assessment ToolFederal regulators recently released an update to the Cybersecurity Assessment Tool. The FFIEC also revised its IT Examination Handbook with updated Information Security and Management booklets. The updated tools provide additional response options, allowing financial institutions to include supplementary or complementary

behaviors, practices and processes to support their cybersecurity activity assessment.

The FFIEC developed the assessment to help financial institution management determine the institution’s risk profile, inherent risks and cybersecurity preparedness. The assessment provides a repeatable

and measurable process that financial institution management can use to measure cybersecurity preparedness over time.

For help with the Cybersecurity Assessment Tool or if you have any questions, please call Tom Quist, SHAZAM secure account executive, at 800-537-5427, ext. 4370.

FBI offers tips on email protectionThe FBI released an article on building a digital defense with an email fortress. The article provides strategies for preventing email compromises, such as avoiding

free web-based email accounts; using multifactor authentication; and updating firewalls, anti-virus programs and spam filters.

The U.S. Computer Emergency Readiness Team separately offers tips on using caution with email attachments and avoiding social engineering and phishing attacks.

Regulation CC update The Federal Reserve Board announced the long-awaited changes to certain sections of Regulation CC, which implements the Expedited Funds Availability Act.

The changes will update the check collection framework to reflect a system that’s now largely electronic-based. Take note that the amendments don’t address the sections of Reg. CC regarding funds availability schedules or related customer notices.

Check return requirementsThe final rule:

• Modifies the current check return requirements by requiring that all returned checks, both paper and electronic, be returned by 2 p.m. on the second business day and eliminating the “forward collection” option.

• Adds a condition that the depository bank must have arrangements to accept returned checks electronically in order to make a claim for damages due to a late return. The final rule also applies the return requirements

to electronic images of checks, including images that aren’t derived from a paper check (for example: electronically created items).

• Creates new indemnities for losses caused by unauthorized or duplicate electronically created items.

• Indemnifies a depository bank that received a deposit of an original paper check if the item is returned unpaid after being deposited using a remote deposit capture service.

Core news – Continued from previous page

Spotlight on Service — August 2017 9

Very few financial tools are as versatile and convenient to use as debit cards. When you encourage the use of debit cards, your cardholders win and you win. Feel free to use all of these tips on your website, customer newsletters, statement messages, drive-thru handouts or wherever you communicate.

The power of the card is in your hands.

1. Debit cards are accepted nearly everywhere you’d normally use cash or write a check. These versatile little cards can pay for your groceries, buy your gas, shop online and pay for veggies at the farmer’s market — wherever your life takes you.

2. If life takes you out into the big wide world, your debit card will follow. Debit cards can travel internationally. Using your debit card will help you get favorable exchange rates at an ATM in your favorite country. Your card will also help you access the right amount of local currency when you need it, rather than toting too much cash around with you. This greatly lowers your risk of loss or theft. (It’s always a good idea to take additional forms of payment when traveling, though, just to be safe.)

3. We love ATMs, but when you’re paying for your groceries, use your card to pay AND to get extra cash at the same time. Save yourself the separate ATM transaction and be on your way, prepared with cash for your next adventure.

4. Sidestep the temptation to “pay later” that comes with using credit cards to pay for your purchases. Instead, pay now with your debit card, and the money comes right out of your account. Sure, you have to have the funds available to pay for your stuff, but doesn’t that sound like a better long-term financial strategy anyway? You’ll never pay interest or incur late fees when you use your trusty debit card.

5. Worried about fraudsters? You should be. If everyone were cautious, fraudsters would have a much harder time doing their dirty work. But, using your debit card with your PIN makes for a more secure transaction, rather than opting for a signature. Just be sure to shield your PIN from prying eyes and don’t share it with others.

6. Bonus! Speaking of protecting your debit card, enrolling in SHAZAM

® BOLT$™ will put the power of early warning to work, reducing your card fraud risk and saving you money! Give your cardholders more control and peace of mind by encouraging them to set their own card and transaction blocks with the transaction control feature.

Increase your accountholders’ debit card use with ready-made marketing materials at www.shazampowermarketing .net. Select Card Usage, then “Your Debit Card. Your Life.,” “Gifting Made Simple” or “Ask for Cashback” to order the campaign that’s right for you.

5 reasons why you (and your cardholders) love debit cards

Cards

Spotlight on Service — August 2017 1 0

Why should you be on social media?

• Three out of four American adults use some form of social media.

• Social media makes your institution visible.

• Your customers and potential customers are having a conversation about you; be there to respond.

• Connect with local media about the positive things you’re a part of every day.

With SHAZAM’s Purposeful Social Media course, you can learn how to connect with your customers on social media.

In this half-day class, we identify the key differences between social media channels so you can make informed decisions and expand your brand.

Send the right message, at the right time, to the right audience. Learn how to create posts that get viewed, get shared and generate engagement. Discover why images attached to a post can make a difference and how long is too long for a post.

The details make a difference.

Sign up todayContact Patrick Dix, SHAZAM’s vice president of public relations, to reach your customers and enhance your brand.

SHAZAM Media Relations Training also offers the following courses:

• Media Fundamentals

• Advanced Interview Techniques

• Media Relations During a Critical Incident

• Media Training for Leaders

These courses are designed to suit all your needs and advance your relationship with local media.

Your customers are on social media. Are you?

Facebook®

• 1.71 billion users.

• Facebook adds 500,000 users every day; six profiles every second.

• There are 40 million active small-business pages.

YouTube™

• Over 1 billion users.

• There are 3.25 billion hours of video watched each month.

• The average mobile viewing session lasts more than 40 minutes.

LinkedIn®

• 450 million users.

• 100 million of those users access the site on a monthly basis.

• Over 3 million companies have created LinkedIn accounts.

Instagram®

• 400 million users.

• 90 percent of Instagram users are younger than 35.

• There are 3.5 billion Instagram “likes” per day.

Twitter®

• 320 million users.

• 500 million people visit Twitter each month without logging in.

• 208 is the average number of followers.

S o c i a l m e d i a u s a g e

Training

Spotlight on Service — August 2017 1 1

Training

Regular registration ends Sept. 15 for NACHA — The Electronic Payment Association’s® 2017 Accredited ACH Professional (AAP) exam. Late registration is available at an additional cost from Sept. 16 to Oct. 2.

This year’s exam window is Oct. 9 – 28 at a PSI testing center near you. Be sure to register soon to confirm your chosen test date and time.

Visit the NACHA website to find:

• The benefits of accreditation

• Fee and registration information

• How to prepare for the exam

What’s an AAP? According to NACHA, AAPs have:

• A comprehensive knowledge of all areas of ACH

• A deep understanding of and experience in one or more specific ACH subjects

• A broad knowledge of concepts that relate to the payments system as a whole

ACH aficionados: Register for NACHA’s AAP exam

Spotlight on Service — August 2017 1 2

Mark your calendar for Wednesday, Aug. 16, from 10 to 11 a.m. CT, when the SHAZAM fraud operations department will host its biannual onFraud webinar, “Effective Use of SHAZAM Card Block.”

If you’ve ever asked yourself the following questions, this session is for you:

• How do I add a bank identification number (BIN) block?

• How do I know if my blocks are effective?

• How long should I keep my blocks in place?

• What do I do if my cardholder is getting declined due to a BIN block?

Sign up today!Sign up for the webinar to learn how to effectively use the SHAZAM Card Block tool. We’ll address:

• Best practices

• How to make sure your blocks are doing what you want

• Questions you may have about the product

We sent an email invitation with the signup link in late July, but registration is still open for the webinar. We hope you can attend!

Questions?If you have any fraud-related questions, please don’t hesitate to call SHAZAM fraud operations at 800-537-5427, ext. 2899.

Pick up SHAZAM Card Block tips in free webinar Aug. 16

Training

Training

Spotlight on Service — August 2017 1 3

SHAZAM training

September 2017

Sun Mon Tue Wed Thu Fri Sat

1 2

3 4 5 6 7 8 9

10 11 12 13 14 15 16

17 18 19 20 21 22 23

24 25 26 27 28 29 30

August 2017

Sun Mon Tue Wed Thu Fri Sat

1 2 3 4 5

6 7 8 9 10 11 12

13 14 15 16 17 18 19

20 21 22 23 24 25 26

27 28 29 30 31

SHAZAM Debit Card Fraud and Chargebacks regional seminarSept. 13: Memphis, Tennessee

Sept. 27: St. Charles, Missouri

Description: Learn everything you need to know about debit card fraud, disputes and chargebacks. Topics include:

• Fraud trends

• Risk management tools

• Fraud reporting

• The complete chargeback cycle, including:

• Retrieval requests

• Chargeback reasons

• Financial institution and merchant responsibilities

• Documentation

Effective Use of SHAZAM Card Block webinarAug. 16: 10 – 11 a.m. CT

See our article on Page 12 for more details!

SHAZAM Settlement Process and Reporting webinarSept. 7: 9:30 – 11:30 a.m. CT

Sept. 19: 1:30 – 3:30 p.m. CT

Description: The settlement process is an important part of your ATM or debit card program. This two-hour webinar will explore how the SHAZAM settlement process works and will give you insights on how to effectively manage the settlement process. You’ll also learn how settlement affects your institution and why your institution receives daily reports from SHAZAM.

For more details on training events, visit our Training Services page.

Spotlight on Service — August 2017 1 4

‘Home Sweet Home Rewards’ winners

• Johnny H. of Swifton, Arkansas (Merchants & Planters Bank; Newport, Arkansas)

• Kameron S. of Manchester, Iowa (GNB Bank; Grundy Center, Iowa)

• Amanda B. of Cherokee, Iowa (State Savings Bank; Bedford, Iowa)

• Cassidy E. of Carroll, Iowa (Iowa Savings Bank; Carroll, Iowa)

• S. Goodwin of Warrensburg, Missouri (Equity Bank; Wichita, Kansas)

• Jaquelyn C. of Davenport, Iowa (Northwest Bank & Trust Co.; Davenport, Iowa)

• Tammy K. of Greeley, Iowa (Community Savings Bank; Edgewood, Iowa)

• Christopher F. of La Vista, Nebraska (Labette Bank; Parsons, Kansas)

J u n e w i n n e r s

Spotlight on Service, winner of 15 awards of publication excellence, provides you with information on the financial services industry. It’s not a definitive analysis of the subjects discussed and is not an alternative to the requirements of any regulatory agency.

To join the Spotlight on Service subscription list, send us your name, account number and email address. We also welcome your questions or comments about the newsletter.

SHAZAM, Inc. 6700 Pioneer ParkwayJohnston, IA 50131 shazam.net | @SHAZAMNetwork

Contacts

Fax numbers Chargebacks 515-558-7614Client support 515-558-7610EFT implementations 800-267-0549Fraud operations 515-558-7616

Client support Call 800-537-5427 or submit a service request in SHAZAM® Web Rep.

About the newsletter

Debit Rewards Winners

Congratulations to our grand prize winner, Charles B. of Pocahontas, Arkansas.

Charles won a $500 Target® gift card in the “Home Sweet Home Rewards” Debit Rewards campaign, which ran April – June 2017. Charles is a customer of First National Bank of Lawrence County in Walnut Ridge, Arkansas.

We’d also like to congratulate our June monthly winners listed at right, who each received a $50 Target gift card.