Security & Fraud Prevention

Protecting Your Money Starts With a Conversation

Scams are getting smarter, but the habits that stop them haven’t changed much. Here is what Harpeth does to protect you, what we will never ask you to do, and the simple steps that keep your accounts safe. If anything ever feels off, call us. A banker will pick up.

Report a lost card Report fraud Freeze my card

Need Help Right Now?

Lost or Stolen Debit Card

(800) 500-1044

24 hours a day, 7 days a week. Or freeze your card instantly in the Harpeth mobile app.

Download on the App Store Get it on Google Play

Suspicious Activity or a Suspected Scam

(615) 803-9100

During lobby hours, Monday–Thursday 8:30–4:00 and Friday 8:30–5:00.

Think You Shared Your Login?

Change your online banking password immediately, then call us so we can review your account.

Bank Impersonation

Harpeth Will Never Ask You to…

Scammers impersonate banks because it works. They copy our name, spoof our phone number, and create a sense of emergency. The fastest way to spot one is to know what a real bank never does. Harpeth Bank & Trust will never call, text, or email you and ask you to:

  • Share your password, PIN, or a one-time passcode.

    A security code sent to your phone is for you to enter, never to read back to anyone. Not even a Harpeth employee.

  • Move money to “protect” it.

    We will never ask you to transfer funds to a “safe account,” to another bank, or to yourself through payment apps, a wire, or cryptocurrency. Your money is already safe where it is.

  • Buy gift cards or send cash.

    No legitimate bank, government agency, or business is paid in gift cards, prepaid cards, or crypto ATMs.

  • Install software or give remote access to your device.

    We do not use remote-control tools to “fix” your account.

  • Click a link to verify your account.

    If we need something from you, we will ask you to log in the way you normally do or to call the number on the back of your card.

  • Keep a conversation secret.

    Anyone who tells you not to talk to your spouse, your family, or your banker is trying to isolate you.

If You Get a Call Like This

Hang up. Then call us back at (615) 803-9100 or the number on the back of your card. Caller ID can be faked, so never trust an incoming number as proof. A real banker will not mind that you double-checked; a scammer will pressure you not to.

Warning Signs

Six Red Flags of Almost Every Scam

Scams change their costume constantly — a package delivery, a toll violation, a grandchild in jail, a job offer, an investment tip. The tactics underneath rarely do. The American Bankers Association’s #BanksNeverAskThat campaign boils it down to these warning signs:

  1. Contact You Didn’t Expect

    An unexpected call, text, email, or social media message about a problem you didn’t know you had.

  2. Pressure to Act Right Now

    “Your account will be closed in one hour.” Urgency is designed to keep you from thinking or asking someone else.

  3. A Request for Secrecy

    “Don’t tell the bank teller what this is for.” Legitimate requests survive a second opinion.

  4. Pressure to Move Money

    Any instruction to wire, use a payment app, buy gift cards, deposit cash in a crypto kiosk, or send money to “protect” it.

  5. A Request for Sensitive Details

    Passwords, PINs, one-time codes, full card numbers, Social Security numbers, or Medicare numbers.

  6. Something That Is Too Good to Be True

    Guaranteed investment returns, a prize you didn’t enter for, a refund you didn’t request.

The one habit that beats all of them: pause and verify through a channel you already trust. Look up the phone number yourself. Log in by typing the web address or opening the app. Call the family member directly. Scammers count on you not doing this.

Online Banking

Passwords and Logins

Your online banking password is the key to everything. Treat it that way.

  • Never share it. Not with family, not with a “bank representative,” not with tech support. Harpeth staff cannot see your password and will never ask for it.
  • Make it long and unique. The Cybersecurity and Infrastructure Security Agency (CISA) now recommends at least 16 characters, random, and different for every account. A passphrase of unrelated words works well. Do not reuse your banking password anywhere else — when another website is breached, criminals try those passwords at banks first.
  • Use a password manager. A reputable password manager creates and remembers strong passwords for you, so you only have to remember one. Most phones and browsers include one.
  • Turn on multi-factor authentication (MFA) everywhere it is offered. Harpeth online banking uses a second step to confirm it is really you. Enable the same protection on your email account especially — email is where password resets go, so whoever controls your email can reset everything else.
  • Don’t save banking logins in your browser or on shared devices. If you use a password manager, let it fill your credentials instead of the browser’s “remember me.”
  • Log out when you are done, and never leave an online banking session open on an unattended computer.
  • Change it immediately if anything feels wrong, then call us.

Email, Text & Phone

Phishing, Smishing, and Vishing

Phishing is a fake message designed to make you click, call, or reply. By email it is phishing; by text it is “smishing”; by phone it is “vishing.” AI has made these messages more convincing — flawless grammar is no longer a sign that something is legitimate.

How to Recognize It

  • Alarming language: “unauthorized login detected,” “your account is suspended,” “confirm your identity within 24 hours.”
  • A link or attachment you are urged to open. Hover over links on a computer to see the real destination; on a phone, don’t tap — go to the site yourself.
  • A sender address that is close but not quite right, or a text from a number you don’t recognize claiming to be Harpeth.
  • A request to “verify” information the bank already has.
  • QR codes in unexpected emails, letters, or stuck onto parking meters and signs. A QR code is just a link you can’t read.

What to Do

  • Don’t click, don’t reply, don’t call the number in the message. Use the number on your card or on this website.
  • Report it. Forward suspicious emails to the Anti-Phishing Working Group at reportphishing@apwg.org and texts to 7726 (SPAM). Then delete it.
  • If you already clicked, disconnect from the internet, run a security scan, change your passwords from a different device, and call us.

Common Scams

Popular Scams Currently

The Federal Trade Commission reports that Americans lost about $16 billion to fraud in 2025, and imposter scams — someone pretending to be a bank, a government agency, a business, or a person you know — were the single most reported category. Here are the ones most likely to reach a Middle Tennessee household or small business.

Bank Impersonation

A text or call warns of a suspicious charge, then a “fraud department” helps you move your money to a safe account. The caller ID even shows our number. The money goes straight to the criminal. Harpeth will never ask you to move money.

AI Voice Cloning & Deepfakes

A panicked call from a grandchild, child, or boss — in their actual voice — asking for money fast. Criminals clone voices from a few seconds of social media video. Hang up and call the person back on their known number. Agree on a family code word ahead of time.

Government Imposters

Callers claiming to be the IRS, Social Security, Medicare, the sheriff’s office, or even the FTC, threatening arrest or demanding payment. Government agencies do not call to demand money and do not accept gift cards or crypto.

Investment & Crypto “Pig Butchering”

A new online friend or romantic interest slowly introduces a can’t-miss crypto or investment platform. Early “returns” look real, until you try to withdraw. Be very skeptical of any investment advice from someone you met online.

Tech Support Pop-Ups

A screen freezes with a warning to call “Microsoft” or “Apple.” The technician asks for remote access, then “finds” fraud on your bank account. Close the browser; real companies do not put phone numbers in pop-ups.

Payment App Scams

Payments sent through Zelle®, Venmo, or Cash App are like handing over cash — they are meant for people you know and trust. Treat any stranger asking for a payment app as a scam, including “accidental” payments you are asked to return.

Delivery, Toll, and “Unpaid Bill” Texts

“Your package could not be delivered.” “You have an unpaid toll.” These texts link to look-alike sites that harvest your card number. Check the real carrier or agency site directly.

Fake Checks and Overpayments

A buyer, employer, or “mystery shopper” sends a check for more than they owe and asks you to send the difference back. The check bounces days later and you owe the bank the full amount. Never send money back from a deposited check until we confirm it has fully cleared.

Romance Scams

Months of attention, then an emergency, a customs fee, a plane ticket. Never send money to someone you have not met in person, and talk to someone you trust before you do.

Job and “Work From Home” Offers

Legitimate employers do not ask you to buy equipment with a check they send you, pay for training, or receive and forward packages or payments through your bank account. The last one makes you a money mule, which is a crime.

Check Fraud

Check Safety

Check fraud has come roaring back. Thieves steal mail from mailboxes, “wash” the ink off checks with household chemicals, and rewrite them for thousands of dollars — or sell photos of your check on social media. A few habits, drawn from the ABA’s #PracticeSafeChecks campaign and the U.S. Postal Inspection Service, go a long way.

  • Pay digitally when you can. Online bill pay, and card payments don’t expose your account number and signature to whoever finds the envelope.
  • Mail checks from inside the post office or hand them to a carrier. Avoid leaving outgoing mail in your home mailbox with the flag up, and never drop mail in a blue collection box after the last pickup of the day.
  • Use a gel pen with black ink. Gel and permanent inks resist washing; ballpoint ink does not.
  • Fill in every line. Write out the amount completely, draw a line through unused space, and never sign a blank check.
  • Pick up delivered mail promptly, and ask the post office to hold mail when you travel.
  • Watch your account. Set up alerts in online banking so you see checks as they clear, and compare the amount and payee to your records. Report anything wrong immediately — the sooner you tell us, the more options we have.
  • Keep check photos private. Never post a picture of a check — even a voided one — online.
  • Business customers: ask about Positive Pay, which matches checks presented against the ones you issued and flags anything that does not belong.

Phones & Computers

Keep Your Devices Safe

Your phone and computer are where banking happens, so their security is your account’s security. CISA’s “Secure Our World” guidance comes down to four habits: recognize phishing, use strong passwords, turn on MFA, and update software. Here is the longer list.

  • Install updates promptly, and turn on automatic updates. Most updates close security holes that criminals are already using.
  • Use reputable security software and keep it current. Windows and macOS include capable built-in protection — make sure it is turned on.
  • Lock your screen. Use a passcode, fingerprint, or face unlock, and set your phone and computer to lock automatically.
  • Download apps only from the Apple App Store or Google Play, and get the Harpeth mobile app from the links on this website. Review the permissions an app requests.
  • Be careful on public Wi-Fi. Avoid banking from airport, hotel, or coffee-shop networks. Your phone’s cellular connection is safer.
  • Don’t bank from a shared or borrowed computer, and be cautious at libraries and internet cafés.
  • Plan for a lost phone. Turn on Find My iPhone or Find My Device so you can locate, lock, or erase it remotely. Tell us right away if a device with the mobile app is lost or stolen.
  • Protect your mobile number. Add a PIN or “port freeze” with your wireless carrier to prevent SIM-swap attacks, where a criminal takes over your number to receive your security codes.
  • Know the warning signs of an infected computer: sudden slowdowns, new toolbars or icons, unexpected pop-ups during a banking session (especially one saying the bank’s site is “unavailable”), or being asked for a security code at an unusual time. Stop and call us.

Digital Banking

Get the Most From the Security Tools You Already Have

Harpeth online and mobile banking include tools that catch fraud early. Most take two minutes to set up.

Real-Time Alerts

Get a text or email for every card purchase, large withdrawal, login from a new device, or change to your profile. The fastest fraud detection is you.

Card Controls

Freeze a misplaced debit card from the app and unfreeze it when it turns up — no call required. Set spending limits and block certain transaction types.

eStatements

Paper statements in a mailbox are a target for identity thieves. Go paperless and review each statement when it arrives.

Review Your Accounts Often

Log in a few times a week and look for anything you don’t recognize. Businesses should reconcile daily.

Only Log In Through Trusted Paths

Type harpethbank.com yourself or use the app. Our personal online banking login is hosted at olb-ebanking.com and business banking at harpethbank.ebanking-services.com — bookmark them once and use the bookmark.

Keep Your Contact Information Current

If we spot something suspicious, we need to be able to reach you quickly. Update your phone and email in online banking or with a banker.

Identity Theft

Protect Your Identity

Identity theft is when someone uses your personal information to open accounts, file taxes, or get medical care in your name. The Federal Trade Commission recommends these defenses.

  • Freeze your credit. A credit freeze at all three bureaus (Equifax, Experian, and TransUnion) is free, stops new accounts from being opened in your name, and can be lifted in minutes when you apply for credit. It is the single most effective step you can take.
  • Check your credit reports. You can get free weekly reports from all three bureaus at AnnualCreditReport.com. Look for accounts and inquiries you don’t recognize.
  • Get an IRS Identity Protection PIN at IRS.gov to prevent someone from filing a tax return in your name, and create your own my Social Security account at ssa.gov before someone else does.
  • Guard your Social Security number. Give it out only when truly required, and ask how it will be protected. Leave the card at home.
  • Shred bank statements, pre-approved credit offers, and anything with account numbers before discarding it.
  • Limit what you share on social media. Birthdays, your mother’s maiden name, your first car, your pet’s name — the “fun” quiz answers are the same as your security questions.
  • Watch for the signs: bills for accounts you didn’t open, missing mail, a tax return rejected as a duplicate, calls from debt collectors about debts that aren’t yours, or medical bills for care you didn’t receive.

Older Adults

Looking Out for Older Family Members

Adults over 60 report the highest losses to scams, and much of it never gets reported at all. If you help manage a parent’s or grandparent’s finances, a few conversations now can prevent a painful one later.

  • Talk about the scams above, and agree on a rule: nobody sends money, gift cards, or personal information in response to an unexpected call without checking with a family member first.
  • Set up a family code word to confirm an emergency call is real.
  • Set up account alerts that go to a trusted family member as well, or ask us about adding a trusted contact to the account.
  • Watch for new “friends” who are suddenly very involved, unusual withdrawals, or reluctance to talk about money.
  • If you suspect financial exploitation, call us. Our bankers are trained to recognize it, and Tennessee Adult Protective Services can be reached at 1-888-APS-TENN (1-888-277-8366).

Business Banking

For Business Customers

Businesses face everything above plus a few threats of their own. Business accounts also have fewer legal protections than consumer accounts when an authorized user is tricked into sending a payment, so prevention matters even more.

Business Email Compromise (BEC)

A criminal takes over or convincingly spoofs the email of your CEO, a vendor, or your title company and sends new wire instructions or an urgent payment request. It is one of the costliest forms of cybercrime reported to the FBI. The defense is simple and non-negotiable: confirm every new or changed payment instruction by phone, using a number you already have on file — never one in the email.

Corporate Account Takeover

Malware on an office computer captures online banking credentials, and criminals send ACH or wire payments as if they were you. To reduce the risk:

  • Use dual control. Require one person to initiate ACH files and wires and a different person to approve them, ideally on separate computers. Harpeth business banking supports approval workflows for both.
  • Reconcile every business day, and set alerts for outgoing ACH and wires.
  • Ask about Positive Pay and ACH Positive Pay, which let you approve only the checks and ACH debits you expect.
  • Dedicate a computer to banking if you can — one that is not used for email, web browsing, or social media.
  • Limit administrative rights on workstations, change default passwords on routers and network devices, keep systems patched, and use a firewall.
  • Train your team. Most incidents start with one employee clicking one link. CISA offers free training materials for small businesses.
  • Talk to your insurance agent about cyber and funds-transfer-fraud coverage, and read what it actually covers.

If You Suspect a Business Account Takeover

  1. Stop using the affected computers and disconnect them from the network. Do not turn them off — evidence may be lost.
  2. Call Harpeth immediately. We can disable online access, reset credentials, review recent transactions and bill payments, and check for unauthorized address changes or check and card orders.
  3. Keep a written log of what happened and who you spoke with, with dates, times, and reference numbers.
  4. File a police report and a complaint with the FBI at ic3.gov. Your insurer will likely require both.

Act Quickly

If You Think You Have Been Scammed

It happens to careful, intelligent people every day, and acting quickly makes a real difference. There is no reason to be embarrassed and every reason to call.

  1. Call us first. (615) 803-9100 during lobby hours, or (800) 500-1044 any time for a lost or stolen card. The sooner we know, the more we can do — including trying to recall a wire or stop a payment.

  2. Lock things down. Freeze your card in the app, change your online banking password, then change your email password and any other account that used the same one.

  3. If you gave remote access to a device, disconnect it from the internet and have it cleaned before using it for banking again.

  4. Freeze your credit at all three bureaus if any personal information was exposed.

  5. Report it. Fraud: ReportFraud.ftc.gov. Identity theft: IdentityTheft.gov, which builds a personal recovery plan. Internet crime and business email compromise: ic3.gov. Mail theft: uspis.gov. A police report with the Franklin Police Department or your local agency is also helpful and sometimes required.

  6. Watch for the follow-up scam. Victims are often contacted again by someone offering to “recover” their money for a fee. That is the same criminals, or their friends.

Your Rights

If you report an unauthorized electronic transaction on a consumer account promptly, federal law may limit how much you can be held responsible for. The time limits are short, so review your statements and alerts and tell us as soon as you see something wrong. Transactions you authorize yourself — even if you were deceived into sending them — are treated differently, which is why recognizing a scam before you send is so important.

Learn More

Trusted Resources

These are the sources our own team relies on. Links open in a new window and will show our external link notice.

Spotting Scams

Cybersecurity Basics

Identity Theft and Recovery

Deposit Insurance

Zelle® and the Zelle® related marks are wholly owned by Early Warning Services, LLC and are used herein under license. Apple, the App Store, Google Play, Microsoft, Venmo, and Cash App are trademarks of their respective owners. This page is provided for general educational purposes and is not legal advice. Member FDIC. Equal Housing Lender.

Questions? Talk to a Real Person.

Every Harpeth relationship starts with a conversation, and that includes the uncomfortable ones. If something doesn’t look right, call (615) 803-9100 or stop by 120 5th Avenue North in downtown Franklin. We would much rather answer a question than help you recover from a scam.

Call (615) 803-9100 Locations & Hours