Fraudulent Text Messages
So your cell phone alerts you to a new text message. It’s from your financial institution, saying your debit card has been deactivated. To clear up the situation, all you have to do is call the number in the text. Should you make the call?
With the popularity of cell phones and the fact consumers are wising up to computer-based fraud, scammers are turning their attention to texting. According to online security experts, cell phone users are three times more likely to fall for fake messages than computer users. Don’t take the bait:
Never respond to unsolicited messages (Even sending a “remove” of “stop” response to a fraudulent text tells the scammer your number is active.)
Never click on unknown links in texts
Block suspicious numbers
Always verify a source before sharing information
Don’t store credit card or account login information on your phone
Set your phone to time out and lock after a short period
Review statements and credit reports regularly to detect suspicious activity
You’ll receive an e-mail that appears to come from a reputable company like a financial institution or government agency, including one of the federal financial regulatory agencies.
The e-mail will warn you of a serious problem that requires immediate attention. It may use phrases such as, “Immediate attention required,” or “Please contact us immediately about your account.” It will then encourage you to click on a button to go to the institution’s Web site. You could be redirected to a phony site that looks exactly like the real thing. Maybe, it’s the company’s actual Web site, but a pop-up window appears to harvest the information.
You may be asked to update your account information, or provide information for verification purposes, such as your Social Security number, account number, password, your mother’s maiden name or your place of birth.
How to protect yourself:
Never provide your personal information in response to an unsolicited request whether over the phone or the Internet.
Never click on the link provided in an e-mail you believe is fraudulent.
If you believe the contact may be legitimate, contact the financial institution yourself. The key is that you should be the one to initiate the contact using contact information you have verified.
Never provide your password over the phone or in response to an unsolicited Internet request. (Do not be intimidated by an e-mail or caller who suggests dire consequences if you do not immediately provide or verify financial information.)
Review account statements regularly to ensure all charges are correct.
If you fall victim to an attack, act immediately. Alert your financial institution. Place fraud alerts on your credit files with the three major credit bureaus (Equifax—800-525-6285, Experian—888-397-3742, TranUnion—800-680-7289). Monitor your credit files and account statements closely.
REMEMBER: CFCU already has your personal information on file. We do not need and will not ask for it!
A variant on the phishing approach uses telephone systems, known as Vishing, is used to obtain confidential information such as bank account and credit card numbers, Social Security Numbers, passwords, and personal identification numbers from consumers.
In essence, Vishing is the criminal practice of using social engineering and Voice over Internet Protocol (VoIP) telephony to gain access to private personal and financial information from the public for the purpose of financial reward. The term Vishing is a combination of “voice” and phishing. Vishing exploits the public’s trust in landline telephone services, which have traditionally terminated in physical locations, are known to the telephone company, and are associated with a bill-payer. The victim is often unaware that VoIP allows for caller ID spoofing thus providing anonymity for the criminal caller. Vishing is attractive to criminals because VoIP service is fairly inexpensive, especially for long distance, making it cheap to make fake calls. In addition, because it’s web-based, criminals can use software programs to create phony automated customer call center service lines.
An example of a Vishing scam is when a consumer receives a recorded message telling them that their credit card and/or financial institution account has been breached and to immediately call a number provided in the recorded message. The phone number provided in the message leads the consumer to a “fraudulent call center” established by the perpetrator of the fraud. The perpetrator then attempts to obtain confidential account information and login credentials in order to access the account. A twist on this scam is when the recorded message provides the address of a fraudulent website for the consumer to access (instead of a telephone number) and to provide certain information to reinstate the supposedly affected account(s).
Vishing is very hard for authorities to monitor or trace. To protect themselves, consumers are advised to be highly suspicious when receiving messages (telephone, email, or otherwise) directing them to call and provide personal, confidential, and/or account related information. Rather than provide any information, the consumer should contact their financial institution or credit card company directly to verify the validity of the message using contact information they already have in their possession (i.e., do not use contact information provided in the suspicious message).