Fraud prevention: Client best practices and Flourish safety measures

Fraud attempts are becoming increasingly sophisticated, but a combination of strong account protections and a few practical habits can significantly reduce your risk.

"You can't guarantee that fraud will never happen to you. But you can take simple steps to ensure you aren't an easy target and get real results."

At Flourish, we hold the responsibility of protecting client information and funds in the highest regard and maintain multiple safeguards designed to help protect accounts. Some of the most effective protections also depend on the actions you take, from securing your email to reviewing account notifications promptly. “You can’t guarantee that fraud will never happen to you,” said Josh Owen, Chief Technology Officer at Flourish. “But you can take simple steps to ensure you aren't an easy target and get real results.”

What can you do to safeguard your account?

In order to protect your funds and information, it is critical that you take an active role in managing your own account security. There are several straightforward steps you can and should take on your end, both with Flourish and other financial accounts.

Use an authenticator app

In addition to requiring a strong password, Flourish uses multi-factor authentication (MFA), also known as two-factor authentication (2FA), to provide an added layer of protection against unauthorized account access. MFA is a security process that adds an extra step when you log in to an account to confirm your identity, like entering a code from your phone. This makes it more difficult for someone else to access your account, even if they know your password.

Flourish offers MFA verification by text message, phone call, or an authenticator app. An authenticator app is generally considered the more secure option. “An authenticator app creates an additional line of defense,” said Owen. “Unlike SMS-based MFA, which can be intercepted, authentication codes require access to your mobile phone, and they typically can’t be ported to another device without your knowledge.”

Check your Flourish notification emails

Flourish sends notifications via email or the mobile app whenever key account activity takes place, such as when a transfer is initiated or a new bank account is connected. We do this in order to flag unexpected activity to you. Ensure that you read all transactional messages sent from Flourish and reach out to the Support team if you see any unexpected activity. And make sure to add Flourish to your contacts so that messages aren't sent to your spam folder.

Reach out to the Flourish Support team

If there is ever a question or concern, our Support team is here to help. “Cases of compromised data most frequently involve a client who has their external bank account or email account compromised,” said Mahany Ortiz, Director of Client Support. “When a client calls in, we can review their history, bank connections, and recent activity, in addition to freezing their account and doing more complex evaluations to ensure the security of the account.”

Use a modern email provider with MFA enabled on your email account

Ensure you’re using an email provider that adheres to modern security standards and set up MFA on your account. "Your email is a central component in the protection of your identity," said Owen. "Modern email providers such as Gmail or Microsoft Outlook offer MFA options, which reduces the risk of compromise and increases the likelihood of detecting suspicious activity. You'll be in a better position to work with your institutions at which your accounts are held to prevent a stolen password from turning into a more serious situation."

"Cases of compromised data most frequently involve a client who has had their email account compromised, which then exposes their other accounts to fraudulent activity. One of the best things a client can do to protect themselves is to make sure their email account is secure through MFA."

Use strong passwords

The more complex a password, the more secure the account. We recommend that you always use a unique password for all websites, including your Flourish account. A password manager, such as 1Password or LastPass, can help you keep track of your passwords across various accounts.

Add extra phone security

Mobile phones often are an essential component of account management. A few steps you can take to increase your security:

Protect your phone by requiring a passcode or biometric authentication, such as Face ID or fingerprint recognition, to unlock it.
Make sure you have the latest software updates installed on your phone, which offer the most recent security features.
If someone from your phone provider reaches out and requests information, first confirm their identity or place a call back to the official company phone line.
Contact your mobile carrier to enable port protection or a number-transfer lock, which can help prevent your phone number from being transferred to another device without additional verification.

Confirm websites

Be extremely cautious whenever clicking on any link to access your accounts, including Flourish, or when clicking links in emails from unknown senders. Always check that the website address is correct before entering your information, which can be done by hovering over a link to preview the address and make sure the website name is spelled correctly before clicking on it. Whenever possible, visit websites directly, whether through a bookmark or a search engine.

Freeze your credit

A credit freeze, also known as a security freeze, blocks access to your credit report. This can help prevent new financial accounts from being opened in your name by someone using your information, which is a common attack vector for stolen login credentials.

A credit pull is not required for Flourish Cash,^† but is for Flourish Lending^◊ and can be common with other financial accounts. Security experts recommend keeping your credit frozen across the three main credit bureaus: Equifax, TransUnion, and Experian. When you are opening a new account or applying for credit, you can easily schedule a 'credit thaw' to temporarily lift the restriction for a designated period of time. You can also use a credit monitoring service to track your credit reports and alert you to any changes.

Protect your login credentials

Only enter your username, password, or authentication code through a website, mobile app, or service you trust. Never share this information with someone who contacts you unexpectedly, even if the caller appears to represent Flourish or another financial institution. Caller ID and personal details can be manipulated to make a request seem legitimate. If you are unsure, end the interaction and contact the institution directly using its official website, mobile app, account statement, or another trusted channel.

How does Flourish help ensure the safety of client funds and information?

Ensuring the safety of client funds and information is a top priority at Flourish. We have put numerous measures in place to support these efforts.

Secure account access

Strong passwords: Flourish requires complex passwords to reduce the risk of unauthorized access to your account.
Multi-factor authentication: Clients are required to undergo multi-factor authentication (MFA) whenever they take certain actions on their account, including logging in, updating bank connections, scheduling transfers, or before executing secure actions if more than 15 minutes have passed since authentication, such as changing your profile.
Automatic logout: Flourish automatically logs out clients who are inactive for an extended period of time to prevent unauthorized account access.

Monitoring and alerts

Notifications: For key account activity, we send a notification to the account owner(s) via email or mobile app to alert them about the action taken. This keeps them informed and, if they see any suspicious activity on the account, they can reach out to the Client Support team.
Account monitoring: Unauthorized account activity often begins with a similar pattern of actions. Our security system proactively monitors accounts for signs of suspicious activity patterns, which flags the activity to our security team for review.

Transaction controls

Holding period for new accounts: Clients can only transfer funds to accounts with which they have previously established a relationship. All newly-added external accounts are subject to a four-calendar-day holding period to ensure sufficient time for a client to be made aware of the new account before a transfer can be initiated.

Data and systems security

Data protection: Client data is protected at all times with bank-level encryption.
Testing and audits: We run frequent internal and external security scans and audits of our software and systems for signs of any vulnerabilities.

Human oversight

In-house Client Support: Our Client Support team is based in-house at our New York and Dallas offices, enabling representatives to work closely with Flourish’s operations, security, and technology teams when suspicious activity requires review. This structure ensures that we have a highly trained team that is closely connected to other teams at Flourish working in concert to protect clients.
Employee training: In addition to a background check, all employees go through ongoing, company-wide training on topics such as data protection, records management, cybersecurity, anti-money laundering, malware, phishing, protecting seniors and vulnerable adults, and more. We also identify high-risk employees who, for example, speak with external parties about wire transfers or have access to clients' personal identifying information, and have them undergo additional training.

Fraud prevention: Client best practices and how Flourish safeguards client funds and information