We all have a stake in data protection.

    Protecting the data of our members is one of our highest priorities. We are most effective when partnered with our members to detect fraud. Please report anything out of the ordinary concerning your PenFed accounts immediately to cybersecurity@penfed.org.

    Steps you can take to protect yourself

    Online Security

    Change your Password regularly. PenFed recommends this be done every 60-90 days.

    Never give your passwords to anyone. PenFed will NEVER ask for your password in an email, over the phone, in a text or any other communication method.

    Do not reuse passwords. Do not use the same password you have set for PenFed Online for any other account.

    Use a password manager. If you use a password manager, you do not have to remember all your passwords; only the one to the password manager. This allows you to use long, complex and unique passwords for all your accounts. Be sure to make the password to your password manager a strong one. Macs have a password manager built in (Keychain) and there are many available for Windows.

    Use a “two factor” method for authenticating to sites if available. This is especially important for email since email is often used to reset passwords, confirm actions and as additional method for identity verification.

    Install protection software on your home computers such as anti-virus, anti-spyware and anti-fraud protection software and keep them up to date.

    Use a personal firewall. Firewalls are built into virtually all computer operating systems. Click here for more information: Windows, Mac

    Use a physical home router/firewall between your computer and your cable or DSL modem.

    Turn on automatic updates for your operating system (Windows, Mac) and applications that you have installed, especially your web browser, Adobe Reader, Adobe Flash, Adobe Shockwave and Oracle Java.

    Create a second, non-privileged operating system account, for normal, everyday use and use your privileged (administrator) account only when needed, like when installing software. (Windows, Mac)

    Use a pop-up blocker. Set your browser preferences to block pop–ups as pop-ups can contain malicious code.

    Use a browser add-on that blocks advertisements (an ad blocker)

    Use a browser add-on that blocks scripts such as No-Script, uBlock or use a sandboxing technology like Sandboxie.

    Conduct online banking and make financial transactions only with a trusted computer (one owned by you or someone you trust) on a trusted network—wired or wireless.

    Never use a public computer for online banking. If you must bank while away from a trusted computer, use the PenFed Mobile App.

    Turn off your computer when not in use.

    Review your account and transaction information regularly—least once a week. If you notice any changes to your account that you didn't make, contact us immediately at 1-800-247-5626.

    Set up account alerts to receive alerts on your cell phone or in e-mail so you can stay updated on your account activity. Set up account alerts

    Freeze your credit report. A security freeze prevents potential creditors from being able to pull your credit file. When your credit file is frozen, ID thieves can apply for credit in your name, but not be able to establish new lines of credit. Few creditors will extend credit without determining the risk of doing so (i.e., view your credit file). You can unfreeze your credit file any time.

    If you do not freeze your credit report, check it regularly. Ensure you recognize all the accounts listed. Contact one of the three major credit-reporting agencies for a copy of your credit report.

    Do not send sensitive information via e-mail. Never e–mail passwords, account numbers, social security numbers or other sensitive information to anyone.

    Sign out of accounts and websites. When you have finished using an Internet service that you have logged into, sign out and do not just close the browser. It is possible that some sites may not close your session (log you out) when the browser window is closed.

    Check certificates. When visiting secure sites that have a padlock, green address bar or begin with “https” view the site certificate and verify that it is for the site you believe you are visiting. This can be done by clicking on the padlock and then “view certificate” or “more information”. This will display the details about the certificate including the owner and issuer.

    Mobile Security

    Do not root or jailbreak your mobile device to get around limitations set by your carrier or device manufacturer. It removes protections built into the device to defend against mobile threats.

    Only download Apps from official stores such as iTunes or Google Play.

    Avoid connecting your smart phone to an untrusted wireless network.


    The first thought that generally comes to mind when someone mentions hacking is the common media image of a dark room, a glowing computer monitor, and stacks of soda cans leaning precariously over a keyboard. Would it surprise you to find out that far more hacks are accomplished with words than technical knowledge? This is called Social Engineering, and the goal is to convince you to help the attacker do all the work for them!

    How does the attacker trick you into doing this? They rely on four general strategies… appealing to greed, appealing to fear, appealing to authority or relying on human kindness.

    • Appeal to greed: an attacker will offer you some method to make some easy money.
    • Appeal to fear: the hacker will tell you, your bank account has been hacked, or tell you your computer has been filled with malware and must be cleaned immediately.
    • Appeal to authority: a hacker will attempt to mimic someone in charge and ask you to do something because of their position.
    • Appeal to human kindness: they may send an email stating they really need your help to do “X”. It may even appear to be from someone you know.

    Every one of these scenarios can occur over email, chat, text, the phone or even in person.

    In all of these situations, you can avoid being caught out with a few strategies.

    • Take your time. Don’t let them force you to make a decision. Spend a few minutes asking yourself if this is a good idea.
    • Verify their identity. Verify they are who they say they are through an outside channel.
    • Be very careful with email attachments. If you were not expecting it, verify that the sender intended to send it to you.
    • Do not click on a link in an email until you’ve hovered your mouse over it to reveal where it truly leads and it is where you expected it to go.

    Credit Card Security

    Memorize PINs and do not write them down. If you do write them down, keep them in a password manager or on paper nowhere near your credit or debit cards.

    Protect your credit card information, so do not provide it online unless you are making a purchase from a website you trust. Secure sites typically will direct you to a secure page with a URL starting with “https://” whenever you make purchases or are asked to provide confidential information.

    Don’t store credit card numbers and other financial data on your cell phone or PDA.

    If you have a card with RFID, use an RFID blocking (Faraday) wallet, purse or other container to protect your card from unauthorized reading.

    Beware of skimmers. Skimmers are small devices that are designed to fit over card slots and keypads to collect card data and card PINs. Common places for these are ATMs and gas pumps. Some are virtually impossible to identify. If the card reader is loose or you see exposed wires, do not use it.


    How to spot identity theft

    Identity theft can happen even if you've been very careful with your personal information. Below are some potential indicators of identity theft.

    • Failing to receive bills or other mail.
    • Receiving cards or billing statements on accounts for which you did not apply.
    • Receiving calls from debt collectors or companies about merchandise or services you didn't buy.
    • You see withdrawals from your bank account that you can’t explain.
    • Merchants refuse your checks.
    • You find unfamiliar accounts on your credit report.
    • The IRS notifies you that more than one tax return was filed in your name, or that you have income from an employer you don’t work for.
    • You get notice that your information was compromised by a data breach at a company where you do business or have an account.