When news of the security breaches at Target and Neiman Marcus broke, many people, myself included, immediately thought, “Did I do any holiday shopping at either of those stores?!” followed by “What do I do now and how do I protect myself in the future?”

At Sand Hill, we have always been diligent about safeguarding client information. We have redoubled our efforts in the past several months as the number of fraudulent email requests have dramatically increased. To further ensure the safety of client assets and personal information, procedures such as voice verification of transfer requests, have also been adopted.  Additionally, the custodians used by Sand Hill have heightened their scrutiny and levels of approval while dedicating significant resources to combat the rise in attempted fraud.

While it used to be easy to spot an e-mail hoax — who hasn’t gotten an email from Nigerian royalty asking for help in transferring money out of the country?!  — the newest generation of criminals, thought mostly to be from Eastern Europe, has adopted significantly more sophisticated methods to commit fraud.  For most criminals this has meant hacking client e-mail accounts and requesting the transfer of money, often in a conversational writing style that closely mimics the voice of the client.  A typical fraudulent e-mail will also reference specific client circumstances, for example a concentrated stock holding, to gain credibility, underscoring the reality that hackers are not only sending messages from a client e-mail account, but also reading all of their personal e-mail as well.  With e-mail being the easiest method of communication for busy clients, it is quite common for us at Sand Hill to receive transfer requests in this manner, including those that are fraudulent.  In recent months, we have seen e-mail fraud attempted on client accounts.    In those instances, no action was taken and the client was alerted that their email account was compromised. As mentioned above, we want to be absolutely certain, through additional means of approval, that a request is genuine before taking any action on new transfer instructions.

In addition to confirming all requests for money transfers, we do not use email as a means for transmitting sensitive client data like Social Security numbers and we caution clients to take the same precautions.  If sensitive information must be sent via email, we encourage the use of password protected files. To further protect yourself from fraud, there are a number of measures you can undertake.  First and foremost, you must be vigilant in protecting yourself online, especially with respect to your e-mail account.  Passwords for e-mail accounts, as well as financial sites, should be complex and changed often, and care must be taken when using wi-fi in public places to access those sites.  Digital signatures, where a handwritten signature is committed to a computer image or file that can later be stolen, should be abandoned.  Preventing fraud also requires patience for additional security measures to be effective; in fact, imposing a short time limit or high pressure demand is a typical tactic employed by client imposters attempting to circumvent protective procedures.

Even with new and innovative fraud tactics, there are still a number of traditional mechanisms that are relatively simple to employ.  To make sure you have not been a victim of fraud, it is important to regularly review your bank, brokerage and credit card account statements to confirm the activity is authorized.  Regularly reviewing your credit report through the use of a monitoring service offered by your bank or credit card company to ensure you have not been a victim of identity theft is also a best practice to adopt.  Though digital theft gets the headlines, personal information is still stolen in the world of paper as well.  At a Sand Hill hosted event several years ago, one simple recommendation was to keep all personal information —name, address, bank/brokerage account numbers, Social Security number, and signature — out of the trash. It is just too easy for criminals to steal this information when it is sitting in a trash can right outside your door.  It is important for clients to cross-cut shred (or burn as one of my clients does!) all of this sensitive data.

Sand Hill and our custodian partners remain committed to vigorously defending client assets and personal information from would-be thieves.  However, the reality is that as we rely more and more on the internet and email to conduct regular business activities, our clients will also have a key role to play in their own security.