Client Security Guidance
Protecting Your Payments and Your Information Online
The Security Center provides practical steps for recognizing suspicious communications, reducing payment-fraud risk, and safeguarding online banking credentials.
Use this page to review security tools, payment controls, multi-factor authentication practices, phishing warning signs, and public resources for reporting suspicious activity.
Verify a Suspicious Message
If you receive a suspicious call, text, email, login alert, or payment instruction claiming to be from Chain Bridge Bank, N.A., do not click links, open attachments, share credentials, share one-time codes, or allow remote access to your device.
Contact the Bank directly at 703-748-2005 or through the official Get in Touch page. Do not use contact information supplied in a suspicious message.
Chain Bridge Bank, N.A. will never ask you to share your password, one-time code, or security key with anyone. That is true whether the person says he or she is from the Bank or from a company that works with the Bank. The Bank will never ask for remote access to your computer or mobile device.
Never Log In Through a Link Someone Sends You
Chain Bridge Bank, N.A. will never call, text, or email you and ask you to open a link and enter your username, password, or one-time code to sign in to online banking or to approve a payment. This is true even if the caller says he or she is from the Bank’s Fraud Department or Security team, and even if the caller ID shows the Bank’s name or number.
A link sent to you can lead to a fake sign-in page that looks like online banking. Anything you type there goes to the criminal, who can then sign in and take over your account.
To sign in safely, type chainbridgebank.com into your browser yourself, use your own saved bookmark, or open the Bank’s mobile app. Do not sign in through a link, button, or web address provided in a call, text, or email.
If someone asks you to log in through a link he or she sent, stop, end the contact, and call the Bank directly at 703-748-2005.
Documents We Send You for Electronic Signature
Chain Bridge Bank, N.A. sends account documents for electronic signature through DocuSign®. You should receive a document only after you have asked the Bank for a service or your Bank officer has told you a document is coming. The email comes from DocuSign, shows who at Chain Bridge Bank, N.A. sent it, and asks you to review and sign a document. It never asks for your online banking username or password.
You do not have to click the link in the email. You may type docusign.com into your browser, choose Access Documents, and enter the security code printed in the email.
To complete your signature, DocuSign sends a one-time code by text message to the mobile telephone number the Bank holds for you. You enter that code on the DocuSign signing page yourself. Never give that code to anyone who asks for it by telephone, text, or email, whether the person says he or she is from the Bank or from DocuSign. If anyone asks, end the contact and call the Bank at 703-748-2005.
For certain documents, DocuSign will also ask you to verify your identity before the document opens. You may be asked to photograph a government-issued ID and, for some documents, to record a short video of your face. For some documents, DocuSign may instead let you verify through an identity service account you already hold. You complete every step inside DocuSign. Never send a picture of your ID by email or text, and never read your ID details to a caller. If you want to know in advance whether a document requires an identity check and what to have ready, ask your Bank officer or call 703-748-2005. If you cannot complete the identity check, contact your Bank officer.
If you receive a DocuSign email that you were not told to expect, do not open it, do not photograph your ID or record a video for it, and call the Bank at 703-748-2005 to ask whether the document is ours. Do the same if the document differs from what your Bank officer described. A criminal who has taken over your email can see what you are expecting, so when in doubt, call.
Similar Names and Unrelated Institutions
Chain Bridge Bank, N.A. is a separate institution from other organizations that use similar names containing “Bridge Bank.” This Security Center applies only to accounts, services, communications, and security practices associated with Chain Bridge Bank, N.A.
For questions about a message, account notice, payment instruction, or website claiming to involve Chain Bridge Bank, N.A., contact the Bank directly at 703-748-2005 or through the official Get in Touch page.
Fraud-Prevention Tools for Commercial Clients
Positive Pay is an automated monitoring service that helps detect altered or unauthorized payments by comparing the checks or ACH items you issue against items presented to Chain Bridge Bank, N.A. Any mismatches appear in your online dashboard for review before posting.
Available Options for Commercial Clients
Check Positive Pay with Payee Name Verification
Compares the check’s payee name, amount, and check number to the item presented for payment.
ACH Positive Pay
Enables you to approve or block incoming electronic debits based on account number, company ID, or transaction amount.
These services add an important risk-control layer, but they require timely client review of exception items to be effective. They are offered at no charge to commercial clients.
To enroll or adjust your parameters, contact your Relationship Officer or Treasury Management professional.
Dual Control and Approval Levels
For outgoing wires, ACH payments, and Bill Pay transactions, Chain Bridge Bank, N.A. strongly recommends dual control. One user initiates a transaction, and another user independently reviews and approves it. The Treasury Management platform supports multi-level approvals, up to four, for organizations that require additional oversight or segregation of duties.
Security Procedures and Dual Control
Under Article 4A of the Uniform Commercial Code, as incorporated in Federal Reserve Regulation J, each commercial client and the Bank agree to a “security procedure” that governs how payment orders are verified and authorized. A payment order that satisfies the agreed-upon procedure may be treated as authorized by the client, even if initiated fraudulently.
Dual control adds an additional layer of oversight by requiring independent review before release. This separation of duties helps reduce errors and exposure to business email compromise, phishing, spoofing, and other social-engineering frauds.
Important Notice
This material is provided for educational purposes only. It does not constitute legal advice, amend any agreement, or create legal obligations. Clients should consult qualified legal counsel regarding their specific security-procedure arrangements.
Choosing How to Pay
Paper checks remain a familiar payment method but carry increased risk of mail theft, alteration, and counterfeiting. Electronic payment options, such as ACH transfers, wire transfers, and online bill-payment services, offer stronger authentication and tracking features. No payment channel is entirely risk-free.
Important Consideration
Before shifting from paper checks to electronic payments, evaluate your internal controls, user-access management, and employee cybersecurity training. Make sure users can recognize and report phishing, business email compromise (BEC), spoofing, and other social-engineering attempts.
Losses caused by credential compromise, malware, or social engineering may fall outside your account or service agreements and are often not reimbursable.
Review your organization’s insurance or cyber-risk coverage to determine whether it protects against electronic payment fraud or credential theft. Treasury Management services are banking tools designed to help reduce risk exposure. They are not insurance products and do not provide reimbursement for fraud losses.
Discuss appropriate controls with your Relationship Officer or Treasury Management professional before making operational changes.
When Using Any Electronic Channel
- Assign unique credentials to each authorized user; never share logins or tokens.
- Implement dual control or multi-level approvals for all outgoing payments.
- Verify new or changed payment instructions using an independent channel before sending funds. Do not rely solely on a text message, an automated call, or contact information supplied in the request.
- Reconcile transactions daily, investigate exceptions promptly, and report suspicious activity to the Bank without delay.
Treasury Management Security Notice
The Treasury Management system requires multi-factor authentication (MFA) at login and again at initiation of wires and ACH transactions. MFA adds a second proof of identity beyond a password to help confirm that only authorized users can transmit payment instructions.
For that second step, Chain Bridge Bank, N.A. issues Treasury Management users a security token: a small key fob, or an authentication app the Bank enrolls on the user’s phone. The token generates a new code for each payment on the device itself. The Bank enrolls new Treasury Management users on the token and recommends it for every user. A user who approves payments with a code sent by text message or voice call today may continue to do so; to move to the token, contact your Relationship Officer or Treasury Management professional. Only the Bank can disable a token. When a user leaves your organization or a device is lost, tell the Bank the same day so the Bank can disable the token and remove the user’s access. Use the same token to sign in.
Protecting User Credentials
Even with MFA, compromised credentials can lead to unauthorized access.
To safeguard your Treasury Management credentials:
- Create long, unique passphrases rather than short, complex passwords.
- Do not reuse or share passwords across systems or by email or chat.
- Store credentials securely in a password manager or vault approved by your organization; never store them in browsers.
- Assign individual user IDs tied to job roles.
- Change passwords promptly when compromise is suspected or after employee departure.
- Use the Bank-issued security token for sign-in and for payment approval. One credential, issued and enrolled by the Bank, protects both steps, and only the Bank can disable it. An app you set up on your own is not a Bank-issued token: the Bank cannot see it or disable it, and it does not approve payments.
- Never approve a payment or code request unless you initiated the transaction.
Credential Security Reminder
Chain Bridge Bank, N.A. will never ask you to share your password, one-time code, or security key with anyone. That is true whether the person says he or she is from the Bank or from a company that works with the Bank. The Bank will never ask for remote access to your computer or mobile device. Chain Bridge Bank, N.A. will also never send you a link and ask you to enter your username, password, or one-time code to sign in to online banking or to approve a payment. If you receive such a request, end the session and contact the Bank directly at 703-748-2005 or through the official Get in Touch page.
The Bank maintains security controls based on applicable guidance and industry standards. Each client is responsible for maintaining appropriate internal controls.
Sign-In Security and Multi-Factor Authentication (MFA)
Chain Bridge Bank, N.A. requires MFA for online and mobile banking sign-in and for initiating wires and ACH transactions through Treasury Management. MFA adds a second proof of identity beyond a password to help confirm that only authorized users can transmit payment instructions. For business and Treasury Management clients, the security token the Bank issues satisfies both steps with one credential.
Recommended Practices
- Business and Treasury Management clients: use the security token the Bank issues to you for sign-in and for every payment approval. Enroll every authorized user through your Relationship Officer or Treasury Management professional.
- A code generated on a Bank-issued token is created on the device itself and does not travel over the telephone network.
- Never share codes or approval requests with anyone, even if he or she claims to represent the Bank.
- Approve requests only when you initiate the transaction.
- Maintain secure devices: keep software updated and lock screens when unattended.
Credential Security Reminder
Chain Bridge Bank, N.A. will never ask you to share your password, one-time code, or security key with anyone. That is true whether the person says he or she is from the Bank or from a company that works with the Bank. The Bank will never ask for remote access to your computer or mobile device. Chain Bridge Bank, N.A. will also never send you a link and ask you to enter your username, password, or one-time code to sign in to online banking or to approve a payment. If you receive such a request, end the session and contact the Bank directly at 703-748-2005 or through the official Get in Touch page.
MFA is one layer of defense. Clients remain responsible for maintaining credential-protection and internal-control practices appropriate to their risk environment.
Recognizing Phishing, Smishing, and Spoofing Attempts
Attackers use email (phishing), text messages (smishing), and phone spoofing to impersonate banks or trusted individuals. Fraudsters may spoof legitimate bank numbers, including the Bank’s own numbers, and impersonate employees. Caller ID cannot be relied upon.
These scams create urgency or fear to trick victims into revealing credentials or approving fraudulent transactions.
Common Warning Signs
- A call or message claiming to be from the Bank demanding immediate action or secrecy.
- Slightly altered email addresses or domain names.
- Unfamiliar payment instructions or last-minute account-number changes.
- Requests for credentials, codes, or remote access.
- Unexpected attachments, links, or QR codes.
If You Suspect Fraud
- Do not click links or download attachments.
- Do not trust caller ID. Hang up immediately.
- Verify independently by calling 703-748-2005 or using the official Get in Touch page on chainbridgebank.com.
- Preserve evidence for your IT team and notify the Bank immediately.
Never Send Sensitive Information
Never send passwords, PINs, security codes, or identification documents by email or text. Chain Bridge Bank, N.A. will never ask you to send this information by email or text, and will never ask for remote access to your device. Chain Bridge Bank, N.A. will also never send you a link and ask you to enter your username, password, or one-time code to sign in to online banking or to approve a payment. If you receive such a request, even if the caller ID shows the Bank’s name or number, end the call and verify directly through published channels.
What You Can Do Today
Taking proactive steps now helps reduce exposure to payment fraud and credential compromise.
Immediate Actions
- Activate Check and ACH Positive Pay with Payee Name Verification.
- Use electronic payments wisely and confirm payment instructions independently.
- Require dual control for all outgoing payments.
- Enroll every authorized user in the Bank-issued security token for sign-in and payment approval.
- Protect credentials and remove access promptly when roles change. Tell the Bank the same day when a user leaves or a token is lost, so the Bank can disable the token and remove the user’s access, and return the key fob to the Bank.
- Educate staff about phishing, smishing, and spoofing schemes.
- Monitor and reconcile accounts daily.
- Review cyber-insurance coverage and understand what losses it does or does not cover.
Reminder
These actions reduce, but cannot eliminate, cyber risk. Each client is responsible for implementing internal controls suited to their organization’s risk tolerance.
Shared Responsibility and Legal Context
Most cyber incidents exploit social engineering. The Bank employs layered security controls to deter unauthorized activity, but no system can prevent every risk. Clients are responsible for protecting devices, credentials, and internal processes.
Legal and Liability Notice
Losses resulting from credential theft, phishing, spoofing, or other client-side compromise may not qualify for reimbursement under law or agreement.
Federal and state laws, including Regulation E and UCC Article 4A, define each party’s rights and obligations. Clients should review their account and service agreements and consult qualified legal or insurance advisors to determine how these rules apply and whether additional cyber-risk or crime insurance is appropriate.
This information is provided for educational awareness only. Chain Bridge Bank, N.A. does not provide tax, legal, or accounting advice. Clients should consult their own advisors.
Key Public Resources
Use these public resources to report internet crime, review cybersecurity guidance, and learn more about ransomware prevention and response.
Report Internet Crime IC3.gov FBI Internet Crime Complaint Center for reporting suspected internet crime. Account Takeover and Impersonation IC3 Public Service Announcement Federal guidance on financial-institution impersonation and account-takeover fraud. Cybersecurity Guidance CISA.gov Cybersecurity alerts, resources, and toolkits from the Cybersecurity and Infrastructure Security Agency. Ransomware Guidance StopRansomware.gov Federal ransomware prevention, reporting, and response guidance.
Frequently Asked Questions
Q1. How do I verify a call, text, or email that appears to be from Chain Bridge Bank, N.A.?
Do not rely on caller ID, logos, email signatures, or links in the message. They can be spoofed. End the call or close the message, then contact Chain Bridge Bank, N.A. at 703-748-2005 or through the official Get in Touch page. Do not use contact information supplied in a suspicious message.
Q2. Will Chain Bridge Bank, N.A. ask for my password, one-time code, security key, or remote access?
No. Chain Bridge Bank, N.A. will never ask you to share your password, one-time code, or security key with anyone. That is true whether the person says he or she is from the Bank or from a company that works with the Bank. The Bank will never ask for remote access to your computer or mobile device. If you receive such a request, end the session and contact the Bank directly.
Q3. Will Chain Bridge Bank, N.A. ever send me a link and ask me to log in?
No. Chain Bridge Bank, N.A. will never send you a link and ask you to enter your username, password, or one-time code to sign in to online banking or to approve a payment. A link in a call, text, or email can lead to a fake sign-in page that captures what you type. To sign in safely, type chainbridgebank.com yourself, use your saved bookmark, or open the Bank’s mobile app. If someone asks you to log in through a link he or she sent, end the contact and call the Bank directly at 703-748-2005.
Q4. I received a DocuSign® email from Chain Bridge Bank, N.A. Is it legitimate?
Chain Bridge Bank, N.A. sends documents for electronic signature through DocuSign. You should receive one only after you have asked the Bank for a service or your Bank officer has told you a document is coming. The email comes from DocuSign and shows who at Chain Bridge Bank, N.A. sent it. It never asks for your online banking username or password. You do not have to click the link; you may type docusign.com into your browser, choose Access Documents, and enter the security code printed in the email. To complete your signature, DocuSign sends a one-time code by text to the mobile telephone number the Bank holds for you. You enter that code on the DocuSign page yourself. Never give it to anyone who asks for it by telephone, text, or email, whether the person says he or she is from the Bank or from DocuSign. For certain documents, DocuSign will also ask you to verify your identity before the document opens: by photographing a government-issued ID and, for some documents, recording a short video of your face, or, for some documents, through an identity service account you already hold. You complete every step inside DocuSign, never by email or text. If you cannot complete the identity check, contact your Bank officer. If you receive a DocuSign email you were not told to expect, or one that differs from what your Bank officer described, do not open it, do not photograph your ID or record a video for it, and call the Bank at 703-748-2005. A criminal who has taken over your email can see what you are expecting, so when in doubt, call.
Q5. What is the security token, and why does the Bank ask business clients to use it?
The security token is a credential Chain Bridge Bank, N.A. issues to authorized users of business and Treasury Management accounts: a small key fob, or an authentication app the Bank enrolls on the user’s phone. Each time you sign in or approve a payment, the token generates a new code that is valid once; the code is created on the token itself. The Bank enrolls new users on the token and recommends it for every user. A user who approves payments with a code sent by text message or voice call today may continue to do so. Only the Bank can disable a token. When an employee leaves or a device is lost, tell the Bank the same day so the Bank can disable the token and remove the user’s access. An app you set up on your own is not a Bank-issued token; the Bank cannot see it or disable it, and it does not approve payments. To enroll, contact your Relationship Officer or Treasury Management professional.
Q6. What should I do if I think my credentials or account have been compromised?
Contact Chain Bridge Bank, N.A. immediately by calling 703-748-2005 or using the official Get in Touch page. Change affected passwords, review recent account activity, preserve suspicious messages, notify your IT team if the issue involves a business account, and follow any additional instructions from the Bank.
Q7. What should commercial clients do before changing payment instructions?
Verify new or changed payment instructions through an independent channel before sending funds. Do not rely only on email, text, or a phone number provided in the payment request. The FBI’s Internet Crime Complaint Center (IC3) recommends secondary channels or two-factor verification for account-information changes.
Q8. What is Positive Pay?
Positive Pay compares checks or ACH transactions you issue against items presented to Chain Bridge Bank, N.A. Exceptions appear for review before posting. These tools help detect altered or unauthorized items, but clients must review exceptions promptly.
Q9. Is Chain Bridge Bank, N.A. the same as other organizations named “Bridge Bank”?
No. Chain Bridge Bank, N.A. is a separate institution from other organizations that use similar names. This page applies only to accounts, services, communications, and security practices associated with Chain Bridge Bank, N.A.
Last reviewed: October 22, 2026.
Disclaimers
Advisory Disclaimer: Chain Bridge Bank, N.A. does not provide tax, legal, or accounting advice. Clients should consult their own advisors.
No Guarantee of Loss Prevention: Security controls reduce risk but cannot eliminate it. Electronic payments and online banking involve inherent risks of fraud, system intrusion, and credential misuse.
