+
+ | Area |
+ Protection |
+
+
+ | 💬 **Contact with your users** ∗ |
+ Swan never calls your users without previously notifying them. If your users receive an unexpected phone call from Swan, strongly encourage them to hang up and inform you and Swan immediately. |
+
+
+ | In place of emailing Support, Swan prefers that both you and your users open tickets. The [partner](https://partner-support.swan.io/hc/en-gb/requests/new) and [end-user](https://support.swan.io/hc/en-150/requests/new?ticket_form_id=18444696903837) support forms initiate a secure way to communicate about sensitive topics. |
+
+
+ | Swan doesn't request sensitive personal or account information by phone or email. Your users might be asked to verify their name or phone number, but nothing more. |
+
+
+ | 🔐 **Authentication** and **Consent** |
+ To access Swan platforms, you and your users must [log in](../../topics/users/index.mdx#login). If there's no activity for a set time period, you're [automatically logged out](../../developers/index.mdx#ttl) to ensure the security of your account. |
+
+
+ | Swan uses a mix of biometrics, passcodes, and one-time passwords to secure access to Swan platforms. |
+
+
+ | You and your users must [consent](../../topics/users/consent/index.mdx#sensitive) to all sensitive operations. |
+
+
+ | 💶 **Payments** |
+ Swan offers [single-use virtual cards (SUVs)](../../topics/cards/virtual/index.mdx#suv). Consider prioritizing issuing SUVs as it's more difficult to use them fraudulently. |
+
+
+ | You and your users can save [trusted beneficiaries](../../topics/payments/credit-transfers/index.mdx#beneficiaries). Only eligible account members can send credit transfers to unsaved beneficiaries. |
+
+ When making online payments, you and your users are required to complete [3-D Secure (3DS)](../../topics/payments/cards/index.mdx#3ds), an extra security layer when paying online. Please note that 3DS might be bypassed if Mastercard deems a payment low risk. |
+
+
+∗ *You, your users, and Swan each have a direct relationship due to the [three-party partnership model](../index.mdx#model).
+As a result, Swan can contact your users directly, when necessary, under strict privacy guidelines.*
+
+
+## Common types of fraud {#types}
+
+### Account takeover (ATO) {#ato}
+
+Account takeover fraud occurs when those committing fraud gain control of a victim's payment account, and then use the account to perform unauthorized actions.
+
+:::note Tips to combat ATO fraud
+- Keep account **login information secure**.
+- Use **strong, unique passwords** and passcodes.
+- **Don't share account details** by email, phone call, or text message.
+:::
+
+### Authorized push payment (APP) {#app}
+
+With APP fraud, those committing fraud trick victims into sending money from the victim's account to a legitimate account managed by the malicious actors.
+
+They impersonate trusted organizations or people—including people your users may know—and convince victims to transfer sizable sums of money urgently.
+APP fraud often occurs by email or over the phone.
+
+:::note Tips to combat APP fraud
+- **Contact the organization or person directly** in a new email or phone call to ask about the request.
+- Don't do anything **urgently**.
+- **Check links before you open them**. Is there a spelling error or typo in the domain name? Are there extra characters, letters, or numbers in the link?
+:::
+
+### Card {#card}
+
+Those committing card fraud **steal virtual card details**, such as card numbers and card verification values or codes (CVVs or CVCs), or **actual physical cards**.
+Then, they use that information to make payments online or by phone, where the purchaser's physical card or presence isn't required.
+
+Types of card fraud include **remote purchase fraud**, **card not present (CNP) fraud**, and any activity with **lost**, **stolen**, or **misplaced cards**.
+
+:::note Tips to combat card fraud
+- Only enter card details on websites with a **secure connection**.
+- Only enter the card number and security code into **fields designed for those numbers**. Don't enter card details in free-text fields, which are open for any type of text input.
+- **Block (cancel) lost or stolen cards immediately**. If you use Swan's Web Banking, send your users the [Support Center article about blocking cards](https://support.swan.io/hc/en-150/articles/18538920070045-Blocking-your-card).
+:::
+
+### Chief Executive Officer (CEO) {#ceo}
+
+CEO fraud, also known as business email compromise (BEC), is cybercrime where individuals impersonate a company's CEO or other top executive.
+These individuals send **convincing emails** to company employees that seem to require **immediate and urgent attention**.
+In the email, they might request the employee to transfer funds, provide access to secure portals or documents, or otherwise reveal confidential information about the company.
+
+Consider the following example:
+
+> Subject: Urgent financial matter (confidential)
+>
+> Hi Alex,
+>
+> There's been an urgent development and we need to pay an invoice immediately.
+> I'm in a critical meeting and can't send this transaction myself.
+> Could you please handle this right away?
+>
+> *includes transfer details*
+>
+> Let me know when it's done.
+>
+> Thanks,