BankTennessee will never ask you by email, text message or phone for any personal information such as your Social Security number, personal identification numbers, credit card numbers, or online banking password. We do not use any of these methods to confirm, verify, activate or authenticate your personal information.

At BankTennessee, we take your financial security seriously. While we have tested, proven security measures in place, we also encourage you to protect your personal financial information.

NEW SCAM ALERTS!


AUGUST 29, 2022  - Threat Advisory    
This new twist on an old attack is an advanced social engineering attack, targeting customers that are connected to their financial institution via social media. Attackers leverage social media and Open-Source Intelligence (OSINT) to gather reconnaissance information on a customer, then contact the customer while posing as the financial institution. 

The attacker's objective is to convince the customer that their online banking account has been compromised and the customer needs to change their online banking password to a "temporary" password and provide the Multi-Factor Authentication code. Once successful, this attack will give the attacker full access to the customer's online banking account, which has and will lead to a significant loss of customer funds.

The attacker starts by:
  1. Using recon from a financial institution’s Facebook page. Individuals who “like” the financial institution’s posts appear to be the attackers' primary targets, giving the attacker a probable customer target list.
  2. The attacker then performs OSINT on these customers, gathering details about the potential customer and creating their own social profile. OSINT allows anyone to be profiled for their public information, such as their street address, phone number(s), email addresses, other social media accounts, date of birth, etc.
  3. The attacker utilizes the dark web and internet search resources for potentially compromised personally identifiable information (PII) for the customer, including Social Security Number (SSN) and any other account numbers from previous compromises.
Once the attacker has a complete OSINT profile of the potential customer:
  1. The attacker may make some innocuous calls to the financial institution to verify that the person is indeed a customer at the financial institution.
  2. Once verified, the attacker plans an advanced social engineering attack on the customer.
  3. The attacker pulls up the financial institution’s online banking webpage and calls the customer.
  4. The attacker spoofs the financial institution’s phone number to appear official.
  5. The attacker convinces the customer that their online banking account has been compromised, asking the customer to then browse to the financial institution’s online banking portal.
  6. The attacker may use the customer’s previously obtained information to convince them that they are official.
  7. The customer is directed to the financial institution’s website and asked by the attacker to reset their password to something simple, like “password1234”. The customer might tell them that they do not want their password set to that. The attacker states they understand that, and this password reset is only temporary. Victims stated that the social engineers are very convincing and have even been able to convince the victims to provide the attackers with the resulting MFA authorization code, where needed.
  8. Once the password is reset, the attacker has access to the customer’s account and can drain customer funds in various ways.
 
MAY 2022 - Threat Advisory

  • First, a text is sent by a fraudster that tries to trick you by asking for verification on a transaction that of course you did not make.
  • Next, another text message is sent telling you that someone from the "BankTennessee" fraud department will call you. BEWARE! The fraudster has spoofed our name in the caller ID.
  • Then, the “fraud expert” reads a list of additional made up transactions, which you know you did not make.
  • At this point, the fraudsters go one of two routes:
    1. They will tell you that your online banking has been compromised, send a password reset request, and provide you a new password. They will then also request multi-factor information and  tell you that you cannot use online banking for the next 24-48 hours. During this time, the fraudster will siphon money from the account.
    2. Ask you to verify the last 8 to 10 digits of your debit card number, then proceed to make fraudulent transactions using your account.
PLEASE BE SAFE! If you have any doubt about a phone call, text, or email, do not provide any personal information and please give us a call.

For more information on how to keep your account safe, check out our Security Center.

Padlock icon
Protect Your BankTennessee Cards.