Sample Electronic Fraud Prevention Guidelines:

Document History

Version	Date	Revised By	Description
1.0	1 August 2009 <Current date>	Michael D. Peters <Owner's name>	This version replaces any prior version.

Document Certification

Description	Date Parameters
Designated document re-certification cycle in days:	30 - 90 - 180 - 365 <Select cycle>
Next document re-certification date:	1 August 2010 <Date>

Sample Electronic Fraud Prevention Guidelines

The <Your Company Name> (the "Company”) Electronic Fraud Prevention Guidelines defines objectives for establishing specific standards on the assessment and ongoing management of vulnerabilities.

The Electronic Fraud Prevention Guidelines builds on the objectives established in the Vulnerability Management Standard, and provides specific instructions and requirements for assessing and prioritizing vulnerabilities.

I. Scope

All employees, contractors, part-time and temporary workers, and those employed by others to perform work on Company premises or who have been granted access to Company information or systems, are covered by this policy and must comply with associated standards and guidelines.

Information Assets are defined in the Asset Identification and Classification Standard.

Phishing is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

Risk refers to the likelihood of loss, damage, or injury to information assets. Risk is present if a threat can exploit an actual vulnerability to adversely impact a sensitive information asset.

Sensitive Information refers to information that is classified as Restricted or Confidential. Refer to the Information Classification Standard for confidentiality classification categories.

Threats are the intentional or accidental actions, activities or events that can adversely impact Company information assets, as well as the sources, such as the individuals, groups, or organizations, of these events and activities.

Vishing is the criminal practice of using social engineering over the telephone system to gain access to private personal and financial information from the public for the purpose of financial reward.

Vulnerabilities refer the weaknesses in information system and procedures including technical, organizational, procedural, administrative, or physical weaknesses.

II. Objectives

The below guidelines are to be followed when mitigating the risk brought about by the threat of Phishing and Vishing attacks against the Company:

Phishing and Vishing Detection Procedures

Phishing and Vishing take-down initiation can come from several sources. Customers as well as non-customers are encouraged to forward phishing emails or phone based Vishing attacks to the Company email address that is monitored by Information Security Incident Response team members. This email address is: abuse@yourcompany.com.

Customer Support

• Phishing stuffers or other forms of written publications should encourage customers to be on the lookout for and report suspicious communications and obvious Phishing or Vishing activity to any Company representative who should in turn report this information to Information Security.
  

Third Party Support

• Phishtank.com

• Phonephishing.info

• GonePhishing.org

• Millersmiles.co.uk

• Garwarner.blogspot.com: Gary Warner who performs malware and phishing research also sends notification to phished entities when he finds them on the web.

Vishing Takedown Procedures

Phishing phone calls usually appear to come from a well-known organization and ask for your personal information, such as credit card number, social security number, account number or password, and so forth. Usually, phone phishing attempts pretend to come from services or companies with which you do not even have anything to do.

While phishing e-mails usually tell you to click a link to a website and submit your personal information, phone-based phishing directly ask you for such information. Legitimate organizations would never request this information of you via email or phone.

• Identification

1. Using the caller’s phone number, perform a White Pages reverse lookup of the number:
   1. Phonenumber.com/reversephone
   2. Enter the phone number in the “Reverse Phone” lookup.