ONLINE SECURITY

Citi India has a presence in several social networking sites that help us keep in touch with our customers and clients, including the following:

• Facebook - Visit us on Facebook and join the conversation at www.facebook.com/citiindia
• LinkedIn - The Citi India LinkedIn page showcases our employee network, current careers, products and services

With more and more people joining social networks, there has been increased danger of social engineering, a form of identity theft where thieves gather personal information from available sections of social networking sites.
By taking the following precautions, you can guard yourself against social networking fraud.

• Before joining a social networking site or community, research it online to make sure it's legitimate
• Do not use the same username and password to log into social networking sites that you use to access your Citi accounts
• Never share personal information such as: User IDs, PINs and account numbers on social media sites
• Create a screen name that doesn't reveal too much about you
• Be careful while clicking links. Even if the message appears to come from a friend, contact the sender directly to make sure it's authentic
• Post only information you are comfortable with others seeing, and regard information posted on social media sites as public and permanent
• Use privacy settings to limit access to your information
• Never include any information that can help thieves steal your identity, such as your address, phone number or even employment information

The reasons for doing so are obvious - if a phone is lost, stolen or simply left unattended, anyone that picks it up will have unrestricted access. This could involve data being stolen, phone calls being made or unwanted services being registered for, and could result in considerable financial cost.

Many new phones offer a "pattern lock" - a personalized shape or pattern that is drawn on the screen to grant access, and this is often faster and of lesser hassle than entering a password. Alternatively a PIN code offers a numeric alternative to a standard password and can also save time. Obviously a password that is easy to guess is less secure - so avoid "1234", "password" and other common phrases.

A screen lock is useful but won't stop someone from removing your SIM card and using it on another phone. To prevent this from happening, set up a SIM card lock in the form of a PIN number that will need to be entered when a phone is turned on in order to connect to a network.

With both of these security measures in place, you can at least be safe in the knowledge that if a phone is stolen it will be of very little use to the average thief.

Simply preventing someone from being able to turn a phone on isn't sufficient anymore, as it's far too easy to retrieve data by simply plugging it into a computer or removing a microSD card. Protecting sensitive data that may be saved to internal storage is therefore a must, and there are a number of solutions available. Most smartphone platforms offer software that can encrypt files or folders on a device with industry-standard protection, which means a code must be entered before a file can be viewed or copied. This also goes for information such as passwords, login details, account numbers and other information that may be saved for access to online banks or merchants. Ensuring that this sort of information isn't easily accessible is important, and it would be wise to install such protection and use it as common practice.

Most smartphones now have the option of connecting to wireless networks - be it a router in the office or home, or a wireless hotspot on the move.

The first thing to remember is to always switch off a wireless connection when it's not in use. Apart from helping you save on battery power, it ensures that malicious parties can't connect to a device without your knowledge. It's also worth taking a browse through a phone's network security settings as it might be configured to automatically connect to a network when in range.

Wireless hotspots and unknown networks are by far the biggest risk when it comes to utilising this connectivity - assuming of course, that any more commonly accessed wireless router in the home or office is sufficiently protected by a pass code.

A relatively common threat that pervades unknown wireless networks and hotspots is called the "evil twin" attack. Here a malicious party might be offering access to a wireless connection that looks very much like a legitimate hotspot from a large company. If a user were to inadvertently connect to this "hotspot", they may find requests for passwords, login details and other information that can then be recorded and used to access their accounts at a later stage. Any requests for information that don't seem entirely legitimate and typical should be ignored.

Unlike wireless networking, Bluetooth isn't seen as a potentially risky venture for most mobile users, and the relatively short-range (around 10m) at which it is accessible does mean that it's inherently safer. However, attacks still happen, and it's important to be aware of the pitfalls of leaving this technology switched on when not in use. Hackers have found ways to remotely access a phone (provided they are within range) and use it to make calls, access data, listen in on conversations and browse the internet.

To prevent this from happening it's a good idea to set default Bluetooth configuration to "non-discoverable" mode by default. This means that users around you who are searching for potential targets won't see your device pop up on their list.

It goes without saying that any unknown requests that come via a Bluetooth connection, such as a request to "pair" with a device or respond to a message from an unknown source should be ignored or declined.

When downloading the Citi Mobile app to your mobile device, be sure to go to a trusted source such as the App Store on the iPhone^® and iPod touch^® or Android Market. You can alternately SMS <MBANK> to 52484 and click on the download URL in the response SMS and install the application. Do not download the app from any other third party source.

Apple and the Apple logo are trademarks of Apple Inc., registered in the U.S. and other countries. iPhone^® is a trademark of Apple Inc. Android™ is a trademark of Google Inc.

• Download anti-malware protection for your mobile phone or tablet device
• Do not root or jailbreak your mobile device to get around limitations set by your carrier or device manufacturer.
  It may remove any protection built into the device to defend against mobile threats
• Beware of everything you download onto your smartphone, especially applications. Only use reputed application from the market. Look at the developer's name, check out reviews and star ratings. Always check the permissions an application requests and ensure that the requests match the features the application provides

It's also important to exercise caution with respected applications such as popular web browsers, as it's often far too easy to simply accept qualification messages that pop up when you're online. Agreeing to save user details and passwords when logging into websites for future access may be convenient, but makes it very easy for those accessing an unprotected phone to do the same. This is particularly important when it comes to online banks and merchants, as these sites often have bank account details saved automatically under your username and would make it easy for others to make unwanted purchases or transactions.

In addition users should pay attention to any potential security warnings that may be displayed when viewing websites, particularly if accessing them through unknown wireless networks, and not just dismiss these without thought. Web pages that involve the entry of sensitive data such as a username, password or account details should always use encrypted protocols to protect this information. This can be confirmed by the presence of an "s" at the end of "http" at the start of a webpage URL (https://) or a visible padlock icon on the status bar of a browser to confirm that the connection is encrypted. It's a good idea to get into the habit of looking for these when using any websites that have requested for personal details.

One increasingly popular practice among Android users is "rooting" a phone. This essentially involves modifying the file system to allow user's access to read-only files and parts of the operating system that the manufacturer or service provider don't want you to change. Some of the advantages of rooting a phone include the ability to change or remove read-only applications that you don't want to use, change the boot screen, back up the entire system, run specialised applications and install custom user interfaces and alternative versions of the OS. Rooting is usually only done by "experts", who should therefore be aware of the potential dangers, but if someone offers to root a phone for you while citing the benefits, it's important to be aware of the security risks as well.

Since rooting allows a user's access to system-level resources, it also opens up for potential infection by malware. Part of the reason why this critical data is inaccessible is to protect it from such threats, and while you may benefit from more flexibility in the short term, writers of malicious code can also benefit from full access to your device if it becomes infected.

Discovering that a phone has been lost or stolen is bad enough, but even when discounting the potential damage that could be done by sensitive data getting into the wrong hands, important documents, contacts, messages, appointments and other information could take a long time to replace. Ensuring that regular back-ups are made is therefore essential, and there are a number of ways to go about it. Most modern phones now allow users to "synchronise" information with a computer or website for productivity or backup purposes. This can include emails and contacts with Microsoft Outlook, photos uploaded to online storage or proprietary software supplied by the phone manufacturer to simply back-up key data in the event of loss.