Internet Banking Security Guidelines
Salaam Bank · Republic of Djibouti · v1.0
Purpose
These guidelines define the security standards that Salaam Bank and its customers must follow to protect Internet Banking accounts, transactions, and personal data from fraud, unauthorized access, and cyber threats.
Scope
Applies to all Salaam Bank customers using Internet Banking or any digital channel.
1. Customer Authentication
- Minimum 12-character passwords — unique per account
- Enable MFA on every login without exception
- OTP or authenticator app required for high-risk transactions
- Never share passwords, OTPs, PINs, or security questions
2. Secure Devices
- Use only trusted, personal devices for banking
- Keep OS and apps fully updated at all times
- Install reputable antivirus / anti-malware software
- Never use rooted or jailbroken devices
3. Secure Network Usage
- Never use public Wi-Fi for banking transactions
- Use trusted home or corporate networks only
- If public internet is unavoidable, use a trusted VPN
4. Website Verification
- Access only through the Bank's official website
- Verify HTTPS and valid security certificate (padlock)
- Bookmark the official URL — do not rely on search engines
- Never click banking links in unsolicited emails or SMS
5. Phishing Protection
- Salaam Bank will NEVER ask for passwords, OTPs, PINs, or CVV
- Verify suspicious communications directly with the Bank
- Report phishing emails and fake websites immediately
6. Password Management
- Do not reuse banking passwords on any other website
- Change passwords periodically or if compromise is suspected
- Use an approved password manager where appropriate
7. Transaction Security
- Verify beneficiary details before confirming any transfer
- Check transaction amounts carefully before submission
- Enable SMS / email / push notifications for account activity
- Review account statements regularly
8. Session Management
- Always log out after completing banking activities
- Never leave a banking session unattended
- Do not save passwords on shared or public computers
- Clear browser cache after using shared devices
9. Device & App Security
- Download apps only from official app stores
- Enable biometric authentication where available
- Lock devices with PIN, password, or biometrics
- Report lost or stolen devices to the Bank immediately
10. Fraud Awareness
- Phishing · Smishing · Vishing
- Fake mobile applications
- SIM swap fraud
- Remote access scams
- QR code scams
- Social engineering attacks
Responsibilities
11. Bank Responsibilities
- Encrypt all communications with modern TLS
- Implement MFA and risk-based authentication
- Monitor transactions with fraud detection systems
- Apply transaction limits and account lockouts
- Maintain full audit logs
- Conduct penetration testing and vulnerability assessments
- Notify customers of suspicious activity
- Provide secure password reset procedures
12. Customer Responsibilities
- Keep contact details updated with the Bank
- Report unauthorized transactions immediately
- Never disclose security credentials to anyone
- Review account activity regularly
- Inform the Bank immediately upon suspected compromise
13. Incident Reporting
Report immediately to Salaam Bank: unauthorized transactions · lost/stolen devices · phishing attempts · suspicious login alerts · compromised passwords.
14. Regulatory & Standards Alignment
ISO/IEC 27001PCI DSSNIST Cybersecurity FrameworkOWASP Top 10 & WSTGBanque Centrale de Djibouti (BCD) Directives