Your security is our priority

Phishing

Signs of a scam

• Messages that threaten to terminate or suspend your account if you don’t respond
• Unsolicited emails asking for personal or financial informationIf it’s asking for personal information or it sounds too good to be true, steer clear.
• Attachments or links to unfamiliar sites
• Get-rich-quick investment opportunities
• A check or request for wire transfer
  from an unknown person
• If it’s asking for personal information or it sounds too good to be true, steer clear.

What you can do

• Never email your personal or financial information from an unsolicited email
• Never reply to or click on links within an email that asks for personal or financial information
• Do not click on links or open attachments from unknown or unexpected senders
• Use and update anti-virus software on all of your personal devices
• Never wire money to someone you haven’t met in person
• Scrutinize your monthly statements for suspicious and unauthorized activity

Identity theft

Signs of identity theft

• Unexpected entries on your credit reports, including new accounts or inaccurate personal information like your Social Security number or address linked to your credit report
• Calls or letters from debt collectors about something you didn’t buy or accounts you didn’t open
• Not receiving regular bills and statements
• Being denied credit or being offered a high interest rate for no apparent reason
   

What you can do to fight identity theft

• Never email or mail your personal or financial information to someone (or some company) you don’t know
• Don’t write down passwords or use passwords that are easy to guess like birthdays and names of family members
• Memorize your Social Security number rather than carry it on a card in your purse or wallet
• Shred ATM and credit card receipts and documents with personal information
• Follow up with creditors if bills or statements don’t arrive on time or contain unknown charges
• Regularly obtain copies of your credit reports (you can annually get these for free) and review them for accuracy
• Consider using your voice as your password with voice biometrics

Fraudulent mobile apps

Signs of suspicious apps

• Unknown, unreliable authors
• Small number of very short and generic reviews
• Poor grammar, misspellings, logo and other graphics with "mistakes" in app descriptions
• Excessive amount of required access to your device

How to avoid fraudulent apps

• Install the free and official TIAA mobile app
• Never install untrusted mobile applications
• Always check user ratings and reviews in the official app store
• Immediately uninstall malfunctioning and malicious apps

Fraudulent phone calls

Signs of a fraudulent phone call

• Hidden caller ID
• An unknown caller who knows your personal or account information
• A caller who addresses you as "account holder" or "customer" and not by your name
• Being directed to call another number or proceed to a website to update, verify, activate or reactivate your account

How to respond 

• If you suspect a fraudulent TIAA phone call, you can always call 800-842-2252 to verify that TIAA is in fact calling you
• Never provide account or personal information over the phone unless you initiated the contact or have verified the company or caller
• Don't hesitate to ask questions
• Consider returning the caller’s request using the company’s number on their official website or paper statement

Risks of oversharing and exposing personal information

• Social network profiles are often public. Criminals use search engines to research their victims, leveraging publicly available data.
• With enough personal information, criminals can establish trust with a victim and convince them that they are legitimate contacts.
• Hackers attempt to guess account passwords by using publicly identifiable information like your birthdate or the names of children and pets.
• Location information may be inadvertently shared publicly, leaving your home at risk.
   

How to secure your digital footprint

• Create strong and unique passwords for every account. Do not use your birthdate, anniversary, Social Security number or any other easily identifiable personal information in your password.
• Do not share the answers to common security questions on social media.
• Limit audiences wherever possible. Change your privacy settings to ensure only trusted contacts can access personal information like photographs, posts and identifiable data.
• Turn off “Location Services” for apps that do not need it. Turn off “Geo-tagging” for camera apps so they do not embed GPS locations and date/time stamps on photographs.
• Read Terms & Conditions to apps and do not install apps with pervasive and unnecessary permissions access.