First State Bank of Graham

Visitors to this bank Website remain anonymous. We do not collect identifying information about visitors to our site. We may use standard software to collect non-identifying information about our visitors, such as:

• Date and time our site was accessed
• IP address (A numeric address given to servers connected to the Internet)
• Web browser used
• City, State, and Country

First State Bank of Graham uses this information to create summary statistics and to determine the level of interest in information available on our site. Visitors may elect to provide us with personal information via E-mail, online registration forms, or our guest book. This information is used internally, as appropriate, to handle the sender's request. It is not disseminated or sold to other organizations. Some areas of our Website may use a "cookie" temporarily stored in the visitor's computer memory (RAM) to allow the web server to log the pages you use within the site and to know if you have visited the site before.

Corporate Account Takeover

Corporate Account Takeover is the business equivalent of personal identify theft. Hackers, backed by professional criminal organizations, are targeting small and medium businesses to obtain access to their web banking credentials or remote control of their computers. These hackers will then drain the deposit and credit lines of the compromised bank accounts, funneling the funds through others that quickly redirect the monies overseas into hacker's accounts.

As a business owner, you need an understanding of how to take proactive steps and avoid, or least minimize, most threats.

• Use a dedicated computer for financial transactional activity. DO NOT use this computer for general web browsing and email
• Apply operating system and application updates (patches) regularly
• Ensure that anti-virus/spyware software is installed, functional and is updated with the most current version
• Have host-based firewall software installed on computers
• Use latest versions of Internet browsers, such as Explorer, Firefox or Google Chrome with "pop-up" blockers and keep patches up to date
• Turn off your computer when not in use
• Contact your information technology provider to determine the best way to safeguard the security of your computers and networks
• Employee awareness:
  Provide continuous communication and training to employees using online banking systems
  Communicate that passwords should be strong and should not be stored on the device used
  Employees should adhere to dual control procedures
  

Visible warning signs that your system/network may have been compromised:

• Inability to log into online banking
• Dramatic loss of computer speed
• Changes in the way things appear on the screen
• Computer locks up so the user is unable to perform any functions
• Unexpected rebooting or restarting of the computer
• Unexpected request for a one time password (or token) in the middle of an online session
• Unusual pop-up messages, especially a message in the middle of a session that says the connection to the bank system is not working
• New or unexpected toolbars and/or icons
• Inability to shut down or restart the computer

Call us immediately at (940) 549-8880 if you believe that your First State Bank account has been compromised.

Conducting Your Transactions Online

Federal financial regulators are reporting that Internet threats have changed significantly over the past several years. Sophisticated hacking techniques and growing organized cyber-criminal groups are increasingly targeting financial institutions, compromising security controls, and engaging in online account takeovers and fraudulent electronic funds transfers.

In order to help ensure the security of your online transactions, we want you to know that:

• We will never email, call or otherwise ask you for your user name, password or other electronic banking credentials
• You can help protect yourself by implementing alternative risk control processes like:
  • Making sure you choose an adequate user name and password that, at a minimum, mixes in small case letters, upper case letters and numbers
  • Periodically changing your password (e.g., at least every 90 days)
  • Having current anti-malware and anti-virus software
  • Safeguarding your user name and password information
  • Making sure you have a firewall in place when conducting your financial transactions
  • Logging off the system when you're done conducting business (don't just close the page or "X" out of the system)
  • Monitoring your account activity on a regular basis

In addition, we may require owners of commercial accounts to perform their own risk assessments and controls evaluations. For example:

• Make a list of the risks related to online transactions that your business faces including
  • Passwords being written down and left out in the open
  • The use of old or inadequate passwords
  • The possibility of internal fraud or theft
  • Delays in terminating the rights of former employees
  • The lack of dual control or other checks and balances over individual access to online transaction capabilities
• An evaluation of controls your business uses may include
  • Using password protected software to house passwords in
  • Conducting employee background checks
  • Initiating a policy and process to terminate access for former employees
  • Segregating duties among two or more people so no one person has too much access or control
  • Conducting internal or third party audits of controls
  • Using firewalls to protect from outside intrusion or hackers

Federal regulations provide consumers with some protections for electronic fund transfers. These regulations generally apply to accounts with Internet access. For example, these federal laws establish limits on a consumer's liability for unauthorized electronic fund transfers. They also provide specific steps you need to take to help resolve an error with your account. Note, however, that in order to take advantage of these protections, you must act in a timely manner. Make sure you notify us immediately if you believe your access information has been stolen or compromised. Also, review your account activity and periodic statement and promptly report any errors or unauthorized transactions. See the Electronic Fund Transfer disclosures that were provided at account opening for more information on these types of protections. These disclosures are also available online (or ask us and we will gladly provide you with a copy).

If you become aware of suspicious account activity, you should immediately contact the authorities and contact us at the number listed below.

Important Information regarding Your Visa-Branded Debit Card

Non-Visa Debit Transaction Processing.

We have enabled non-Visa debit transaction processing. This means you may use your Visa branded debit card on a PIN-Debit Network* (a non-Visa network) without using a PIN.

The non-Visa debit networks(s) for which such transactions are enabled are: PULSE Network.

Examples of the types of actions that you may be required to make to initiate a Visa transaction on your Visa-branded debit card include signing a receipt, providing a card number over the phone or via the Internet, or swiping the card through a point-of sale terminal.

Examples ofthe types of actions you may be required to make to initiate a transaction on a PIN-Debit Network include initiating a payment directly with the biller (possibly via telephone, Internet, or kiosk location), responding to a logo displayed at a payment site and choosing to direct payment through that network, and having you identity verified using known information derived from an existing relationship with you instead of through use of a PIN.

The provisions of your agreement with us relating only to Visa transactions are not applicable to non-Visa transactions. For example, the additional limits on liability (sometimes referred to as Visa's zero-liability program) and the streamlined error resolution procedures offered on Visa debit card transactions are not applicable to transactions processed on a PIN-Debit Network.

*Visa Rules generally define PIN-Debit Network as a non-Visa debit network that typically authenticates transactions by use of a personal identification number (PIN) but that is not generally known for having a card program.

Some transactions to your account may be accomplished electronically. In the event an error occurs or you have a question about this type of transaction, you should be aware of the following:

ln Case of Errors or Questions About Your Electronic Transfers Call us at (940) 549-8880

or

Write us at the address listed below, as soon as you can, if you think your statement or receipt is wrong or if you need more information about a transfer listed on the statement or receipt. We must hear from you no later than 60 days after we sent the FIRST statement on which the problem or error appeared.

1. 1) Tell us your name and account number (if any).
2. 2) Describe the error or the transfer you are unsure about, and explain as clearly as you can why you believe it is an error or why you need more information.
3. 3) Tell us the dollar amount of the suspected error.

If you tell us orally, we may require that you send us your complaint or question in writing within 10 business days.

We will determine whether an error occurred within 10 business days (20 business days for new accounts) after we hear from you and will correct any error promptly. If we need more time, however, we may take up to 45 days (90 days for new accounts or point-of-sale or foreign-initiated transfers) to investigate your complaint or question. If we decide to do this, we will credit your account within 10 business days (20 business days for new accounts) for the amount you think is in error, so that you will have the use of the money during the time it takes us to complete our investigation. If we ask you to put your complaint or question in writing and we do not receive it within 10 business days, we may not credit your account. An account is considered a new account for 30 days after the first deposit is made, if you are a new customer.

We will tell you the results within three business days after completing our investigation. If we decide that there was no error, we will send you a written explanation.

You may ask for copies of the documents that we used in our investigation.

FIRST STATE BANK
1526 4TH STREET
GRAHAM TX 76450-9998