Pay a Person Transfer Fraud Scam

Risk Alert from CUNA Mutual Group

Fraudsters continue to target members of credit unions using Pay a Person transfers by using a sophisticated scam to defeat 2-step authentication (also referred to as out-of-band authentication), which leverages the use of one-time passcodes. 

How the scam works:

• Fraudsters send text alerts to members – appearing to come from the credit union – warning members of suspicious debit card transactions.
• Fraudsters call those members who respond to the text - spoofing the credit union’s phone number - and claim to be from the credit union’s fraud department.
• To verify the identity of the member, the fraudster asks for the member’s online banking username and tells them they will receive a passcode via text or email and the member must provide it to the fraudster. In reality, the fraudster initiates a transaction, such as the forgot password feature, that generates a 2-step authentication passcode which is delivered to the member.
• The member provides the passcode to the fraudster who uses it to log in to the member’s account using a device not recognized by the host system.
• Upon logging into the accounts, fraudsters change the online banking passwords and then use Pay a Person transfer to transfer funds to others.

Important things to remember in order to keep from falling victim to a scam:

• Be cautious of texts or calls that appear to be from us. Call us at 540.663.2181 if you have any questions about texts or calls from us.
• Never provide personal information in response to a text or phone call supposedly from the credit union.
• No credit union employee will ever call you and ask for personal information (i.e. account numbers, usernames, passwords/passcodes).