Exchange Bank Security: Fraud Protection and Multi-Factor Authentication

Banking security is a layered practice, not a single control. Exchange Bank implements overlapping defences at the network, application, account and customer layers so that a weakness at any one layer does not translate into customer loss. The Exchange Bank security architecture aligns with SOC 2 Type II principles and California DFPI cybersecurity expectations for state-chartered banks.

Transport and Data Encryption

All traffic between the customer's browser or mobile app and Exchange Bank servers runs over TLS 1.3 with modern cipher suites. Older TLS versions are disabled at the load balancer. Data at rest — including account numbers, transaction history, loan documents and authentication secrets — is encrypted with AES-256 inside the Exchange Bank core banking platform. Backup tapes and offsite replicas carry the same encryption. Encryption keys are managed under a hardware security module with access tiered to a small engineering cohort.

Multi-Factor Authentication (MFA)

MFA is mandatory for Exchange Bank online banking and cannot be disabled. When you sign in from an unrecognised device, reset a password or initiate a sensitive action such as a wire transfer, a second verification factor is required. Options include SMS one-time codes to your registered mobile number, voice callbacks to your registered phone, authenticator-app tokens (TOTP), and biometric prompts on the Exchange Bank mobile app using Face ID or Touch ID. Recovery codes are issued at enrolment for cases when a registered device is unavailable.

Session Management

Authenticated Exchange Bank sessions expire automatically after 15 minutes of inactivity. After 5 consecutive failed sign-in attempts, the account is temporarily locked and Exchange Bank customer care must verify identity to restore access. Concurrent-session limits apply to the web channel. Sign-in events from new geographies trigger email and push notifications so a customer can react in minutes if credentials are abused.

Fraud Detection and Response

Machine-learning models score every Exchange Bank card-not-present transaction and every ACH origination for fraud risk. The models factor merchant history, geography, velocity, device fingerprint and historical account behaviour. High-risk scores trigger a hold, a customer alert and a required verification. Analysts in the Exchange Bank fraud operations centre review flagged activity 24/7. The mobile app exposes card lock/unlock so customers can disable a card instantly if it is misplaced.

Business Controls: Positive Pay

Exchange Bank business customers gain access to Positive Pay on the treasury platform — an upload-and-match workflow where issued-cheque files are compared against presented cheques each morning and any unmatched item is held for customer decision. Positive Pay combined with ACH blocks and filters is the current baseline for cheque and ACH fraud defence on Exchange Bank operating accounts.

Consumer Dispute Rights

Regulation E grants electronic-fund-transfer consumers a 60-day dispute window from the statement date for unauthorised transactions. Provisional credit on an Exchange Bank dispute opens within 10 business days of filing while investigation continues. The Consumer Financial Protection Bureau publishes the definitive consumer guide to Reg E rights. FDIC deposit insurance covers Exchange Bank deposits to the statutory limit per depositor, per ownership category. California DFPI state-level oversight layers additional consumer protections on top of federal rules.

Technical controls at Exchange Bank are necessary but not sufficient. A meaningful share of deposit-account fraud losses nationally originate on the customer side — credentials reused from breached sites, SIM-swap attacks on SMS codes, phishing responses, or unattended devices. The following practices materially reduce customer-side risk on an Exchange Bank relationship.

Use a Password Manager

Use a reputable password manager to generate and store a unique password for the Exchange Bank online banking login. Reused passwords are the most common credential-theft vector. Combine with an authenticator-app TOTP code rather than SMS where possible — authenticator apps are not vulnerable to SIM-swap attacks. Enrol a recovery code and store it offline.

Verify Unusual Requests Out of Band

If you receive an email, text or phone call claiming to be from Exchange Bank and asking for credentials or a wire transfer, hang up and call 1-800-995-4066 from the number printed on the back of your card. Exchange Bank staff will never ask for your password, MFA code, full debit card number or Social Security number during an unsolicited contact. Business email compromise attacks frequently target wire instructions — verify every new wire beneficiary by phone.

Monitor Accounts Weekly

Enable real-time push notifications in the mobile app for debit card transactions, ACH withdrawals and sign-in events. Review statements monthly. The Reg E 60-day window begins when the statement is available, not when you open it.

Lock Cards When Not in Use

The mobile app exposes instant card lock. Lock a card between trips, lock it while it sits in a drawer, and unlock it when needed. A locked card declines all transactions instantly.

Report Phishing and Fraud

Forward suspected phishing to fraud@exchangebank.at. Report unauthorised transactions by calling 1-800-995-4066 or opening a dispute in online banking. File an identity-theft report at IdentityTheft.gov (FTC), place a fraud alert or freeze at Equifax, Experian and TransUnion, and review your credit reports.