Fraud and Cyber Security

The background.

At Naples Global Advisors (NGA), we have what is called the Sundown Rule. We never let the sun go down without returning a client call. At 4:00 p.m. on a Friday afternoon, that rule was top-of-mind when our representative returned to his office from a meeting and discovered a voicemail from a client, Ray.

Putting aside the weekend plans ahead, he promptly returned Ray's phone call. After addressing business matters, Ray began to share an unrelated story from earlier in the week.

"On Tuesday I got a call from someone with the Charles Schwab Cyber Security Team. He told me they had noted several unauthorized attempts to access my accounts. They went on to explain that they were investigating where those attacks originated from and had narrowed it down to one of three cities. He asked if I had any history in those locations, and of course I did — I used to live in one of them! So, it all made sense. He assured me they would continue monitoring things. I'm just glad they caught it before anything happened."

It was a phone call that typically would not have raised eyebrows. But as the NGA advisor listened, he became unsettled, wondering why Charles Schwab would contact the client directly regarding the fraud and not the advisor (NGA) as is customary. He was also suspicious of the reference made to the client's former city of residence and continued probing. What he discovered about the chain of events that had transpired earlier in the week would confirm his suspicions: Ray was the target of an elaborate scam.

Knowing the right questions to ask changed everything.

Ray shared that on Thursday, two days after the initial call, a second member of the so-called Cyber Security Team phoned. This time, the tone was more urgent. Ray was told that his accounts had been illegally accessed and he was advised to log into his account and change his password. Once that was taken care of, he was told that the Cyber Security Team would check back on Saturday to ensure his accounts were safe.

This may have been the end of the story had the NGA representative not asked one key question: "Did you share your screen with them?"

"Yes," Ray explained. "They told me it was complicated but if I allowed them to access my computer, they would help me."

Drawing upon the in-depth training on fraud detection that NGA provides to its team members, our representative knew it was very likely that during the time when his computer was accessed remotely, a form of malware was installed to record Ray's keystrokes while he changed his password.

Going the extra mile.

Realizing that a potential disaster was awaiting Ray when financial institutions reopened on Monday, our quick-thinking NGA team member devoted his Friday evening to removing this risk. Together with Ray, he immediately called Charles Schwab to report the incident and to unmask the fake Cyber Security Team.

The (real) Charles Schwab representative confirmed that no one from the company had called Ray. Web access to his accounts was then locked to prevent anyone, including Ray, from logging in. Although shaken, Ray avoided any financial harm and was grateful for NGA's proactive efforts to protect him.

Still, our NGA team member knew the threat wasn't over. There remained a high risk of identity theft and subsequent future attacks that needed to be addressed. As a safeguard, Charles Schwab recommended that Ray leave his computer turned off until a professional technician could properly clean any trace of malware. The NGA representative continued working with Ray to prevent any further risks. Actions taken included:

• Recommending Ray continue to check for any suspicious or fraudulent transactions.
• Connecting Ray with a trusted IT consultant to assess his personal computer and wipe it clean.
• Providing documentation that walked Ray through the steps for freezing credit.
• Joining Ray in a follow-up phone call with Charles Schwab, confirming the computer had been cleaned and that he was ready to unlock web access and establish a new username and password.
• Working with Charles Schwab's Financial Crimes and Risk Management division to provide key information and incident details.