Pay a Person Transfer Fraud Scam
Risk Alert from CUNA Mutual Group
Fraudsters continue to target members of credit unions using Pay a Person transfers by using a sophisticated scam to defeat 2-step authentication (also referred to as out-of-band authentication), which leverages the use of one-time passcodes.
How the scam works:
- Fraudsters send text alerts to members – appearing to come from the credit union – warning members of suspicious debit card transactions.
- Fraudsters call those members who respond to the text - spoofing the credit union’s phone number - and claim to be from the credit union’s fraud department.
- To verify the identity of the member, the fraudster asks for the member’s online banking username and tells them they will receive a passcode via text or email and the member must provide it to the fraudster. In reality, the fraudster initiates a transaction, such as the forgot password feature, that generates a 2-step authentication passcode which is delivered to the member.
- The member provides the passcode to the fraudster who uses it to log in to the member’s account using a device not recognized by the host system.
- Upon logging into the accounts, fraudsters change the online banking passwords and then use Pay a Person transfer to transfer funds to others.
Important things to remember in order to keep from falling victim to a scam:
- Be cautious of texts or calls that appear to be from us. Call us at 540.663.2181 if you have any questions about texts or calls from us.
- Never provide personal information in response to a text or phone call supposedly from the credit union.
- No credit union employee will ever call you and ask for personal information (i.e. account numbers, usernames, passwords/passcodes).