- Home
- Services
- Financial Wellness
- Fraud Watch
Financial Wellness
Avoid the snares of schemers, scammers, and fraudsters
We want our members to be aware of the latest trends in consumer fraud, scams, and identity theft. Educate yourself so you can recognize potential schemes and protect yourself and your money.
At CAFCU, we’re here to help! Below is information about recent vishing, phishing, and smishing scams as well as tips for how to avoid becoming a victim. Staying vigilant is the first step toward keeping yourself safe.
Click below to read about the latest scams and frauds.
Uninsured deposits in nonbank apps may be at risk
The Consumer Financial Protection Bureau (CFPB) issued an advisory reporting that billions of consumer dollars may be at risk when stored on popular peer-to-peer (P2P) and other apps that handle payments. These apps are acting like banks in that they store money and allow consumers to make certain types of transactions. However, money stored in some apps may not be federally insured. When you keep your money in a bank or credit union checking or savings account, it is typically insured up to $250,000 by either NCUA (credit unions) and the FDIC (banks).
If you use a fintech application to send or receive money or transact in other ways, make sure to transfer your money to a federally insured credit union or bank account before it accumulates in that app.
Don’t lose big money to transfer scams
People are losing money to fraudsters running complicated scams in which someone supposedly spots fraud or criminal activity on one of your accounts. The scammer will then offer to “protect” your money by creating an urgent need to transfer your money elsewhere. They will also often ask you to share verification codes.
Click HERE to learn more about this money moving scam from the FTC.
So, how can you protect yourself?
Protect your money
If anyone claims that you must give them your account information or transfer your money from your financial institution in order to protect it, they are likely trying to scam you and you should report that scam to the FTC at FTC.gov and, if necessary, reach out to your financial institution to let them know.
Double check who is contacting you
Unless a call, text, or email is coming directly from your financial institution you should ignore it. You can tell if an email is from your financial institution by looking at the domain in the email address. If it says anything other than @[your financial institution’s website] at the end, it is likely a scammer.
If the email ends in any domain like @gmail.com or @yahoo.com or @hotmail.com the email is not from your financial institution and you should ignore it, delete it, and avoid opening any links or attachments in said email.
If you are not sure if it is your financial institution calling you or texting you, go to their website and check for any phone numbers listed. If the numbers do not match up, you are likely dealing with a scammer.
When in doubt, reach out directly to your financial institution if you are concerned that your account might be breached.
CAFCU members can always contact us to determine whether or not the message they received is legit.
For further information on how to spot a scammer check out THIS article from the FTC.
Watch out for suspicious senders
It’s difficult to keep track of all of the possible scams fraudsters run, but knowing how to watch for common tactics will help you stay safe.
The most common way scammers reach their targets is via fraudulent emails, calls, or text messages. Whenever you receive an email, pay attention to the sender’s email address, particularly the domain name. For example, any email from CAFCU will be from @cafcu.org or one of our trusted third-party partners (e.g. @uchooserewards.com).
If you receive an email claiming to be from CAFCU but the domain is from @gmail.com, @yahoo.com, avoid clicking any links or even opening the message if you can.
This applies to text messages and phone calls as well – always check to see that a phone number matches the sender before acting on any call or text.
The best way to protect yourself from these types of scams is to never:
answer calls from unknown numbers.
open, reply to, or open links you receive via text messages from unknown numbers.
open emails from unknown senders that don’t come from a company’s official web domain.
Social Media Scams
Social media platforms like Facebook and Instagram are breeding grounds for a variety of scams. Scammers select targets based on interests, age, and any other publicly available information. One common scam involves scammers making fake accounts impersonating real people to extort money from their friends and family.
Here are some ways to protect yourself:
Be very conscious of what you put in your social media biographies.
Don’t open DMs from anybody you don’t know or trust.
Don’t click links sent over direct message and always fact check who is reaching out to you.
Stay vigilant to protect yourself from being scammed on social media.
Avoid ATM skimmers
- Look out for skimmers with hidden cameras that record your personal identification number (PIN). These cameras are often placed above the reader or keypad and pointed toward where you will enter your pin. Watch for holes in those areas on the ATM. Another way skimmers will obtain your PIN is by using a keypad overlay to track which keys you press.
- Watch for signs that an ATM has been tampered with, such as loose wires or machines that are not flush with one another.
- Check for skimming devices placed over the card insert slot. Since card skimmers are designed to look exactly like the card insert slot, they might be challenging to spot, but there are a few tell-tale indicators that you can look out for, like not being flush to the machine, being raised or bulky, or having too much glue residue around them.
- You can also try a touch test: Jiggle the reader around; if it moves, there is a chance that there is a skimming device attached to it. The same goes for the keypad. If any attachments seem loose fitting, haphazardly glued, taped, or jammed on/in the machine, be cautious and avoid that machine.
- the EMV chip on your card
- tap to pay (available at some terminals)
- the mobile wallet on your phone
Watch for rising 'jugging' theft at ATMs
What to do if you think you've been scammed
When you spot something suspicious on your account statements, what are your options?
Here are some steps you can take:
- Contact your financial institution to inquire about a suspicious transaction right away. At CAFCU, we help our members dispute fraudulent transactions and prevent future transactions from posting to their accounts.
- Notify the credit bureaus, Equifax, Experian, and TransUnion, and find out what they can do to help you protect your credit.
- Check your computer. Make sure your devices weren't compromised. Install and run anti-virus software (or updating the software you currently have). This can detect malware and keylogging software that might be secretly stealing your data.
- Contact vendors: If you think you’ve been cheated, try first to figure out what might have happened with the company directly. Send your complaint to a supervisor, manager, owner, or president of the company in writing and provide copies of any documentation of your complaint. Never send original receipts or canceled checks.
- Contact the Federal Trade Commission (FTC). The FTC is an independent government agency devoted in part to promoting consumer protection. This resource from the FTC can help you with next steps if you think you’ve been scammed.
- Report fraud to your local or state government. For example, in Illinois you can file a consumer complaint with the Consumer Protection Division of the Illinois Attorney General’s office if you’ve been victimized by fraud or deception. File a Complaint (illinoisattorneygeneral.gov). All states have consumer protection acts and agencies tasked with enforcing them.
For more, check out the After Identity Theft Checklist created by our partners at Balance as well as this one-stop resource from the FTC on how to report and recover from identity theft.
You can also read our blog post, "Think you've been scammed? Here's what you need to know."
Three simple rules to avoid Zelle scams
Phony fraud alert text messages and phone calls
Customer service and tech support scams
Zelle utility bill scams
Merchant data breaches
Although credit card account data can be compromised in breaches involving retailers, it does not mean data related to your account was taken or that fraud has occurred on your account.
Please be assured that we are actively monitoring the activity on your account to protect you from fraud. You will be contacted if we determine that your card must be replaced or if we see any activity that requires you to take any action. Otherwise, please review your monthly statements carefully and call us immediately if you see any suspicious activity.
You’re protected! Visa’s Zero Liability* policy means you don’t pay for unauthorized use of your credit or debit card. Rest assured knowing your financial security is our top priority.
*Visa’s Zero Liability policy covers U.S.-issued cards only and does not apply to ATM transactions, PIN transactions not processed by Visa, or certain commercial card transactions. If any unauthorized use is discovered, cardholder must always notify CAFCU promptly.
Phishing scams
What you need to know: Legitimate companies do not send emails asking for personal information. Regardless of a caller’s claims or a website’s official appearance, never give out personal information when you receive an unsolicited phone call or email.
Phishing through fraudulent email surveys
What you need to know: Neither NCUA nor CAFCU solicit personal information or send surveys via email.
DocuSign phishing scam
DocuSign® is a globally-trusted, secure communication channel for signing documents. In the past, criminals acquired email addresses of people that use the service and attempted to commit fraud by sending fake emails that look like they are from DocuSign.
What you need to know:
- Requests from DocuSign always come from one of these two addresses:
- If you are not expecting a DocuSign email, don’t open it. If you feel it may be valid, access the documents directly by visiting www.docusign.com and enter the unique security code included at the bottom of every legitimate DocuSign email.
- DocuSign never asks recipients to open a PDF, Office document or ZIP file in an email. If one is attached, assume the email is not legitimate and delete the email.
Vishing telephone scam
Vishing is a type of cybercrime in which scammers make phone calls or leave voice messages impersonating reputable companies in order to gather personal information from victims.
Credit union members may receive an automated call claiming to be from the credit union. The recipient’s caller ID may even show a legitimate-looking local number. The recorded message requests verification of financial information or claims that the member’s account has been compromised. The member will be asked to enter account information using a touchtone phone. The sensitive information is then digitally transcribed by the scammer’s computer.
What you need to know: CAFCU may need to contact members by telephone for a variety of reasons. Our calls are always made by live credit union representatives and we will always verify your identity by repeating information you have previously shared with us. We will never ask you to volunteer information such as account numbers, credit card numbers or your PIN.
Smishing text message scams
Similar to vishing and phishing, smishing is a type cybercrime in which scammers send text messages impersonating reputable companies in order to gather personal information from unsuspecting victims.
In a vishing scam, text messaging scammers will send an SMS message from an unrecognizable number stating that your credit union account or credit card account has been closed due to suspicious activity. The text will then provide a number to call or URL to follow for more information. When you call or click, you will be asked for personal information like your Social Security and bank account numbers.
What you need to know:
- If you receive unwanted text messages, be careful. Contact your cell phone company and find out how to avoid receiving spam texts. They can help prevent text messaging fraud by adding spam filters to your account.
- Exercise the same caution you would when giving out a mobile phone number as you would with a personal email address or other personal information.
- Never respond to unsolicited text messages – it lets the sender know they've reached a working number.
The Federal Trade Commission recommends never turning over private information based on a text message request. And CAFCU will never ask you to follow a link or call a number via text message. Contact our Member Center immediately at 1-800-359-1939 if you have entered any personal information on a fraudulent web page.
You can also file a complaint on the Federal Trade Commission’s website, www.ftc.gov, or call 1-877-FTC-HELP.
Protecting your mobile device*
- When purchasing a smartphone, know the features of the device, including the default settings. Turn off features you don’t need to minimize the risk of attack.
- Some phones have encryption available. This can be used to protect your personal data in the case of loss or theft. Ask your cellphone dealer if this is available on your model.
- With the growth of the application market for mobile devices, be sure to look at the reviews of the developer/company who published the application.
- Review and understand the permissions you are giving when you download applications.
- Use a passcode to protect your mobile device. This is the first layer of security to protect the contents of the device. Also enable the screen lock feature after a few minutes of inactivity.
- Obtain malware protection for your mobile device. Look for applications that specialize in antivirus or file integrity that help protect your device from rogue applications and malware.
- Be aware of applications that use geo-location, which will track the user’s location anywhere. This application can be used for marketing but can also to assist a possible stalker and/or burglar.
- Jailbreak or rooting is used to remove certain restrictions imposed by the device manufacturer or cellphone carrier. This allows the user nearly unregulated control over what programs can be installed and how the device can be used. However, this procedure often compromises the cellphone’s security, making it more vulnerable to attack.
- Do not allow your device to connect to unknown wireless networks. These networks could capture information passed between your device and a legitimate server.
- If you decide to sell your device or trade it in, make sure you wipe the device (reset it to factory default) to avoid leaving personal data on the device.
- Smartphones require updates to run applications. Update your phone regularly to reduce the risk of the device being hacked or compromised.
- Avoid clicking on or otherwise downloading software or links from unknown sources.
- Use the same precautions on your cellphone as you would on your computer when using the Internet.
*Source: Federal Bureau of Investigations, IC3 (Internet Crime Complaint Center), October 2012.
Visa Card Fraud Prevention Alerts
Your financial security is a top priority of CAFCU. That's why we proactively monitor your Visa credit and debit card(s) for any unusual activity.
