Phishing is a type of internet piracy in which thieves "fish" for your personal financial information, such as account numbers, passwords, Social Security numbers and other confidential data, to steal your money or identity.

Spoofing occurs when scammers counterfeit trusted brand identities to lower your guard. Simply clicking a link or attachment can give thieves access to your computer and enable them to track your keystrokes and steal passwords.

• Email Spoofing: Scammers fake the sender's address so emails appear to come from someone you trust. Spot the signs of email spoofing:
  • Urgent or secretive language that pressures you to act immediately.
  • Strange sender addresses, including misspellings or incorrect domains (such as @arvestt.com or a “FayettevilleArvestBank” Gmail address).
  • Unusual requests for gift cards, wire transfers or sensitive information.
  • Unexpected offers of surveys or contests.
• Website Spoofing: Counterfeit websites set up by scammers that copy logos, graphics and URLs to steal sensitive information like credentials. Links in spoof emails often lead to spoofed sites that mimic real ones.
• Webform Spoofs: Fraudulent forms mimicking trusted brand forms designed to deceive users into entering sensitive information like passwords, credit card numbers or Social Security numbers.
   

SMS fraud (smishing) uses text or MMS messages to deliver malicious links, phone numbers or conversation starters. Interacting with these messages can lead to malware installation, unintentional data sharing or fraud.

How to Spot Smishing: Look for unexpected texts asking you to update passwords or unlock accounts, messages creating urgency or texts from unknown numbers posing as a "wrong number" but attempting to engage.

Mobile security best practices:

• Do not interact with unexpected links or messages. 
• Hang up on unknown callers.
• Do not trust your caller ID.
• Only install software from official app stores
• Never text sensitive financial information.
   

Vishing occurs when scammers use phone calls or voice messages to obtain sensitive information or get you to take action, such as moving money.

• Be cautious of calls claiming your accounts have experienced unusual activity and providing an unverified contact number.
• Never give out personal or financial information over an unsolicited call.
   

Quishing is a cyberattack where scammers use fake QR codes to trick victims into visiting malicious websites or downloading malware. These can appear on physical flyers, fake parking tickets, restaurant menus or other forms of communication.

QR code best practices:

• Only scan codes from trusted sources.
• Preview the destination URL on your phone camera before navigating to the site.
• Inspect physical QR codes in public spaces for stickers placed over original codes.
   

• Contact Directly: Reach companies by typing a verified web address into your browser or calling a known, verified phone number. Never call numbers or click links in suspicious messages.
• Protect Credentials: Never share User IDs, PINs, passwords or personal details via email.
• Avoid Auto-Save: Never use the "Remember Me" feature on a public or shared computer.
• Monitor Accounts: Check account balances and transactions regularly to quickly spot suspicious activity.
• Resist Pressure: Do not be intimidated by callers or emails suggesting dire consequences if you do not immediately verify financial information.
   

Identity theft can drain financial accounts, damage credit, endanger employment and be expensive to repair. Signs of identity theft include:

• Failure to receive regular bills or mail
• Unusual or unexplained charges on your bills
• New, strange accounts appearing on your credit report
• Bank withdrawals you didn't make

Learn more about Identity Theft.
 

Weak passwords are the primary way criminals gain access to personal information.

• Make Them Long: Use at least 16 characters, mixing upper/lowercase letters, numbers and special characters.
• Make Them Random: Avoid findable personal details like favorite sports teams, pet names or dates.
• Make Them Unique: Use a different password for every account so one compromise doesn't endanger all accounts.
• Use a Password Manager: Use a trusted password manager to generate and store complex passwords. You only need to remember one strong master passphrase. Never write PINs or passwords down or save them in an unencrypted file.
   

• Secure Channels: Never text, chat or email passwords, account numbers or Social Security numbers.
• Thoughtful Sharing: Be mindful of who receives your personal info through apps/websites, and think before posting personal details about yourself or others online.
• Device Hygiene: Always sign off accounts after banking tasks and lock your computer screen after each session.
• Credit Security: Review credit reports annually and freeze your credit to prevent unauthorized account openings. This does not prevent you from using your credit cards or accounts. Freezing is especially critical if your info is exposed in a data breach.

• Fraud Alerts: Receive text alerts if Arvest detects suspicious activity on your personal debit or credit cards.
• IDProtect^®: Monitoring and resolution service offering Dark Web Monitoring, Credit File Monitoring, Identity Monitoring, CyberRecover^™ and professional fraud resolution assistance.

Additional Resources:

• FTC – Consumer Information on Privacy & Identity
• FTC – Identity Theft and Online Security
• Identity Theft Resource Center – Scams & Alerts
   

• Card Not Present: Stolen card numbers used for online or phone purchases.
• Identity Theft & Application Fraud: Using personal data to open unauthorized card accounts.
• Synthetic Identity Creation: Combining real data (like SSNs) with fake details to open fraudulent accounts.
• Account Takeover: Scammers gain access to your account, lock you out and spend funds.
• Lost or Stolen Cards: Physical cards used for unauthorized purchases.
• Ghost Tap-to-Pay Fraud: Malware targeting virtual wallets, one-time passcodes and banking data.
   

• Phishing & Malware: Deceptive messages or software downloads that trick you into sharing data.
• Card Skimming: Devices installed on ATMs or gas pump card readers that capture card details.
• Data Breaches: Data becomes accessible to unauthorized individuals. A data breach can be intentional (e.g., a hacker obtains unauthorized access to company data) or unintentional (e.g., an employee accidentally emails a confidential client list to the wrong recipient).
   

• Card Management: Temporarily lock your Arvest debit or personal credit card instantly if lost or stolen. Watch our tutorial on how to use Card Management.
• Fraud Alerts: Text alerts are sent when suspicious card activity is detected.

Best practices to protect your cards:

• Report lost or stolen cards immediately.
• Turn on Multi-Factor Authentication (MFA) across financial accounts.
• Monitor account balances and transactions frequently.
• Keep your Arvest contact information up to date.
• Request and review your credit report annually for unauthorized accounts.
• Freeze your credit. This does not prevent you from using your credit cards or accounts.
• Think twice before clicking a link or opening an attachment.
• If someone claiming to be from Arvest contacts you unexpectedly or without prior contact and pressures you for personal info, do not respond. Contact Arvest directly at (866) 952-9523 or reportfraud@arvest.com.

Additional resources:

• Get Your Credit Report
• Verified by Visa
• Federal Trade Commission – Credit Cards
   

You are given a check to deposit, but told the amount is overpaid. The scammer asks you to wire back a portion of the funds to cover taxes, fees or job supplies. The criminal relies on you to send the money back before the bank discovers the check is fraudulent and deducts the full amount from your account.

Additional Resources:

• FDIC Beware of Fake Checks
• FTC How To Spot, Avoid, and Report Fake Check Scams

• Pop-Up Scams: Fake tech support alerts that claim your computer is infected, tricking you into granting remote access or paying for fake fixes.
• Imposter Scams: Scammers posing as government officials, bank representatives, tech support or family members to extract money or account access.
• Multi-factor authentication (MFA) Fatigue / MFA Bombing: Attackers flood your device with login requests until you accidentally approve one.
• Trust-Based Scams: Criminals build trust and emotional connections over time to manipulate victims into sending or investing money.
   

• Requests for sensitive personal or account information
• Urgent or threatening language
• Offers that sound too good to be true
• Suspicious sender addresses or strange attachments
• Receiving an unexpected MFA prompt when you aren't logging in
• Accidental/wrong-number contacts who push to keep talking
• Requests for money from someone you've never met in person
   

The Arvest mobile banking app offers secure features such as fingerprint and facial recognition logins, customizable alerts and secure direct messaging with Arvest.

Always download the app exclusively from official app stores, including the Apple App Store^® or Google Play^™. Learn more about mobile banking.

• End-to-End Encryption: Use encrypted messaging apps compatible with both iOS and Android.
• FIDO Authentication: Enroll in Fast Identity Online (FIDO) hardware or biometric MFA, and disable less secure forms of multi-factor identification.
• Migrate Away from SMS-based MFA: Replace SMS text codes with authenticator apps or FIDO, as SMS codes are vulnerable to interception.
• Password Managers: Use password managers that securely store passwords, generate authenticator codes and flag weak passwords.
• App Downloads & Permissions: Use trusted stores, check reviews and access permissions before installing.
• Screen Lock: Set a strong passcode or enable biometrics.
• Updates: Turn on automatic updates for necessary security patches.

• Security Software: Use up-to-date antivirus software configured to automatically scan new files.
• External Drives: Use an antivirus or security program to scan USB thumb drives and external storage before opening files.
• Avoid High-Risk Downloads: Do not download files from unfamiliar sites or peer-to-peer file sharing sites.
• Direct Communication: Type known web addresses directly into your browser; never click unexpected links.
• Avoid Pop-Ups & Search Ads: Never call numbers in tech support pop-up windows. Type trusted web addresses directly rather than clicking social media or search engine ads.

• Safe Browsing: Update your browser regularly, enable MFA on browser-linked accounts, turn off ad personalization and block third-party cookies.
• Encryption Check: Ensure connections show “https” or a padlock symbol in the browser bar before entering data.
• Public Computer Caution: Avoid accessing sensitive accounts on public computers. If you need to use a public computer, uncheck "Remember Me," explicitly log out and close all browser windows when finished.
• Use Hotspots: Prefer personal mobile hotspots over public Wi-Fi networks when accessing sensitive accounts or information.

Additional Resource: OnGuard Online – Your Safety Net

Vulnerable individuals are often targeted by scam artists due to physical, mental, or social circumstances. Could you or a loved one be susceptible? Beware of these common scams:

• Romance Scams: Fake online profiles created to build relationships to solicit money.
• Impersonation: Posing as IRS, Social Security, Medicare, financial institution or tech support agents.
• Lottery / Sweepstakes: Demanding upfront "taxes" or "fees" to release fake winnings.
• Emergency / Person-in-Need: Posing as grandchildren, attorneys or law enforcement demanding urgent money transfers.
• Tech Support Scams: Tricking victims into granting remote computer access.

• Passwords: Help set up 16+ character unique passwords stored in a trusted password manager.
• Information Sharing: Remind them to avoid posting personal data publicly or sharing details with unverified sources.
• Mobile Security: Secure mobile devices used for banking with passcodes or biometrics, and connect only to trusted Wi-Fi.
• Active Software Defenses: Install and maintain auto-updating antivirus software.
• Computer Rules: Remind them to sign off banking sessions and keep computers locked.
• Safe Browsing: Help them adjust browser privacy settings.
  • Enable multi-factor authentication (MFA)
  • Disable ad personalization and third-party cookies
• Credit Freezes: Help them review annual credit reports and freeze credit files. This does not prevent them from using credit cards or accounts.

If you fall victim to an attack, act immediately:

• To report fraud to Arvest, call (866) 952-9523 or email reportfraud@arvest.com.
• FBI Internet Crime Complaint Center (IC3): Submit a report at ic3.gov.
• FTC Report Fraud: Submit a report at reportfraud.ftc.gov.
• Local Law Enforcement: Contact your local police department.
   

• FTC – Consumer Information on Privacy & Identity
• FTC – Identity Theft and Online Security
• Identity Theft Resource Center – Scams & Alerts
• Get Your Credit Report
• Federal Trade Commission – Credit Cards
• FDIC – Beware of Fake Checks
• FTC – How To Spot, Avoid, and Report Fake Check Scams
• OnGuard Online – Your Safety Net