Identity theft is an increasingly common and inventive federal crime. Fortunately, there are many preventative measures you can take to substantially reduce the chance of identity theft occurring, as well as steps you can take to minimize damage if you are a victim. Click here to learn more about the preventative measures you can take.
Protect your Identity with Deluxe ID TheftBlock. Learn more about Deluxe ID TheftBlock.

If you think you've been a victim of fraud, tell a Credit Union Representative by visiting a branch or calling 800.933.3280, press 4.

Important Resources on Identity Theft:

Click on this link from the Federal Trade Commission (FTC), a National Resource for Identity Theft: http://www.ftc.gov/bcp/edu/microsites/idtheft/. Click here to watch the FTC's video entitled, "AvoID Theft: Deter, Detect, Defend"

Click on this link from The New Jersey State Police for additional information on Identity Theft: http://www.njsp.org/tech/identity.html.

Click on this link from the Internet Crime Complaint Center to file a complaint with the federal government: http://www.ic3.gov/

Alert 09/07/10 New Vishing Spree Strikes U.S.: Fraudsters Targeting Mobile Devices, Smaller Communities Source: CUInfoSecurity.com E-News   In July, two phone-based phishing, or vishing attacks, hit residents in Provo, Utah. In August, 10 additional attacks were reported, incorporating a combination of vishing and text-message-based smishing scams, aimed at various communities scattered throughout the United States. The common factor: Perpetrators targeting customers of community banking institutions. Vishing and smishing have replaced the traditional e-mail phishing attacks that were more prevalent three years ago. Since January, the documented number of traditional e-mail or phishing attacks has significantly dropped, but replacing them are these new waves of text and person-to-person scams. In a spree reported in August 2010, vishing and smishing schemes hit residents in Elgin, Ill.; Long Island, N.Y.; Binghamton, N.Y.; New York's Chautauqua and Cattaraugus counties; Bend, Ore.; Arkansas City, Ark.; Rocky Mount and Henry County, Va.; Auburn, Ala.; Texarkana, Texas; and Central Falls, R.I. Rather than being generic, in most cases, the calls and texts identified specific institutions by name. In Elgin, residents received automated telephone calls from fraudsters claiming to be with KCT Credit Union and First Community Bank. In New York's Chautauqua and Cattaraugus counties, calls were posed coming from Cattaraugus County Bank and Mt. Vernon Money Management; in Binghamton, N.Y., it was Empower Federal Credit Union. In Arkansas, Union State Bank was targeted. In Virginia, Martinsville DuPont Credit Union was named; and in Auburn, Ala., Auburn University Federal Credit Union took the hit. The other attacks were not so targeted, either naming several institutions within a certain region or area code or, as was the case in Rhode Island, the calls came from individuals feigning to be travel agents who were giving away trips. As e-mail spam filters have become more sophisticated, fraudsters have turned to other socially engineered methods that prey on consumers' trust. The common use of mobile devices makes smishing an easy scheme. SMS/text-based banking, which is quickly growing to become a mainstream mobile banking service, is helping to set the stage for smishing. In an example, on Aug. 17, members with the $140 million asset Mid Oregon FCU reported receiving suspicious texts and phone calls from sources claiming to be with the credit union. Although it was the first time Mid Oregon FCU had been specifically named in a vishing or smishing scam, the credit union was prepared by focusing attention on member education and fewer than three of the credit union's 20,000 members responded to the calls and/or texts. As more people sign on for text-based banking, fraudsters will be more likely to target it as a channel for fraud. Vishing, because it hooks the consumer directly, through a landline or mobile phone, is hard for a financial institution to detect and control. Consumers should not respond to any request that comes through on the phone to provide any information that could compromise their identity in any way, or with e-mail access via mobile browsers, click on a link with hidden malware that can be installed on their phones.

Alert 08/24/10 NACHA Phishing Alert: Email claiming to be from NACHA NACHA – The Electronic Payments Association has received reports that individuals and/or companies have received a fraudulent email that has the appearance of having been sent from NACHA and signed by a non-existent NACHA employee. See a sample of the email below.   Be aware that phishing emails frequently have attachments and/or links to Web pages that host malicious code and software. Do not open attachments or follow Web links in unsolicited emails from unknown parties or from parties with whom you do not normally communicate, or that appear to be known but are suspicious or otherwise unusual.   NACHA itself does not process nor touch the ACH transactions that flow to and from organizations and financial institutions. NACHA does not send communications to individuals or organizations about individual ACH transactions that they originate or receive.   If malicious code is detected or suspected on a computer, consult with a computer security or anti-virus specialist to remove malicious code or re-install a clean image of the computer system.   Always use anti-virus software and ensure that the virus signatures are automatically updated.   Ensure that the computer operating systems and common software applications security patches are installed and current.   Be alert for different variations of fraudulent emails. = = = = = Sample Email = = = = = =   Dear bank account holder,   The ACH transaction, recently initiated from your bank account (by you or any other person), was rejected by the Electronic Payments Association.   Please Find Attached Transaction Report   ------------------------------------------------------------------   Paul Arnold   Electronic Payments Association Manager

Alert 08/09/10 Verified by Visa® & MasterCard SecureCard Phishing Scam Targeting Online Banking Users We have recently learned of a new phishing scam targeting Verified by Visa and MasterCard SecureCard users. While Financial Resources FCU has not been a target of this scam, we wanted you to be aware that cyber criminals are utilizing the ZeuS botnet to target online banking customers. Here's how it works: The criminals are setting up spoofs of the Verified by Visa and MasterCard SecureCard enrollment pages. The phony enrollment form asks for personal and card account details by claiming new FDIC rules require consumers to enroll in one of the programs. The information collected from the phish is then used to attempt card-not-present fraud. See a sample of the phony enrollment form As with any phishing scam, it is important to know that Visa takes this issue seriously and has a system in place to identify and shut down fraudulent sites. Visa works with client financial institutions and third-parties to remove fraudulent sites, usually within 24 hours of being detected or reported. Visa is working to identify sites related to this scam as quickly as possible and disable them. Visa-related phishing scams can be reported to phishing@visa.com. There is no inherent vulnerability in Verified by Visa related to this particular attack. The scam relies on malware being installed on the member's computer. Members who use updated antivirus software and employ internet browser security controls that prevent suspect scripts or limit injection are generally not vulnerable. If you have any questions or concerns, please contact our Member Service Center at 800.933.3280, press 4.

Alert 07/15/10

4 tips to protect you from ATM thieves

Bankrate, Inc., Constance Gustke, On Wednesday July 14, 2010, 6:00 am EDT 

ATMs are under siege more than ever from skimming. Skimming, where ATM thieves steal your PIN and account number using remote devices, is increasing dramatically. Often done by sophisticated crime rings from the Eastern bloc countries, ATM skimming is becoming a high-tech art that's hard to detect. That's bad news for consumers. Experts say that losses from skimming are approaching $1 billion. Nearly one in five fraud victims reported having their credit card PIN or debit card ATM PIN information stolen in 2009, according to Javelin Strategy & Research. And Robert Vamosi, an analyst handling risk, fraud and security at Javelin, sees ATM skimming continuing to rise this year and next.

"Consumers aren't aware of ATM tampering," he says. "ATMs have 40 years of trust."

Skimming isn't new. It's been around for at least 10 years. What has changed is that the "technology of the bad guy is getting better and better every year," says Robert Siciliano, a security expert based in Boston. "It's up to consumers to watch their own backs."

Typically, ATM thieves use two devices to capture your PIN and card data. One device sits near where you swipe your card and reads the magnetic stripe on your card with your account number. Even more confusing, the device mimics the card slot. "The technology has evolved to a point where the molded plastic fits like it belongs there," says Siciliano. Devices are even readily available over the Internet for as little as $300.

A camera, hidden from view, captures the PIN. "You can get the data in real time," says Siciliano. "You can be in your car with a laptop remotely accessing the device."

Thieves then burn the data onto a blank card to access your money.

U.S. Secret Service spokesman Max Milien wants consumers to be warned. "The public is notified after an event," he says. And don't take bank security for granted. Fraud can occur at any bank in any part of the country. Thieves are even sending out false text alerts to get consumer data.

Banks, they say, are slow to adopt anti-skimming measures. When Javelin surveyed 25 banks, four stood out, though, for their anti-theft measures. They are Bank of America, Chase, Citibank and Wells Fargo.

Experts add that debit card users are most at risk. Typically, consumers must report fraudulent charges within two days, limiting your liability to $50. If you report ATM skimming fraud within 60 days, you're liable for the first $500 of any transaction. Siciliano adds that thieves carefully orchestrate ATM withdrawals, maxing out cash withdrawals one day and waiting until after midnight for the next stash, which quickly adds up.

Here are four tips to help you protect your account:

 

1. Cover your password with your hand

Hidden cameras are disguised so they can pick up your password. By protecting it, ATM thieves can't access your account.

 

2. Use familiar ATMs and limit your visits

ATMs in dimly lighted spots or used late at night could be more susceptible to fraud, while ATMs under video surveillance can be safer. Stay away from ATMs at retail stores or restaurants, adds Siciliano. Recently, skimming devices were found on ATMs in a popular grocery store in central Florida. Airports, convenience stores or kiosks are equally vulnerable to ATM thieves. Still, even highly trafficked ATMs outside a bank branch have been targeted by thieves.

Also, try to limit your visits to the ATM. "With frequency, there's risk," says Siciliano.

 

3. Check bank balances frequently

Given the two-day window for reporting fraud, it pays to check your account frequently. If you don't report fraud within 60 days, you have unlimited liability. "Sign up for alerts and notice unusual withdrawals," says Vamosi.

With credit cards there are more protections in place, and you can dispute charges."You have at least a billing cycle," says Siciliano.

 

4. Observe the ATM

Vamosi cautions consumers to look at an ATM to make sure a card slot is "legitimate and not tacked on." Look for things that strike you, he says. "Some people have felt that when they inserted their card, something went awry," he says. In that case, try another ATM.

When protecting your account against ATM thieves, "it's all about awareness, paying attention and understanding risks," says Sicilano. "There are 400,000 ATMs and every one of them is susceptible to fraud. The speed and convenience of technology has replaced the security of technology."

 

Alert 06/01/10

Fradulent "Online Survey or "Member Survey"

The National Credit Union Administration (NCUA) issued an alert about a new scam targeting credit unions members.

The agency warned of fraudulent emails pretending to come from the NCUA and asking credit union member participation in an "Online Survey" or "Member Survey." The emails even promise a nice $40 compensation as an inducement to respond to the email.

The emails are fraudulent, the NCUA warns, and may be an attempt to obtain confidential member information. The agency does not solicit such information from credit union members.

"This is a phishing activity with no NCUA activity or approval. If you have received these emails please do not respond. If you have any questions or concerns please email NCUA" at this address, pacamail@ncua.gov., an agency alert said.

Alert 02/05/10

SMS/Text Messaging Phishing Alert

Media is reporting an increase in fraudulent text messages sent to mobile phones via SMS/Text Messaging.  These SMS messages may appear to be legitimate, but are actually attacks from a fraudulent source. The goal for the attacker is to convince the end user (mobile banking user) to share confidential financial or personal information, with what the end user believes to be from a trusted source. 

Currently, most SMS/Phishing attacks tend to be broad based, sent randomly to a prefix or area code of mobile phone numbers for a specified region, rather than directed at the customers/members of a specific financial institution.  Although these messages may appear legitimate, if you receive an unexpected SMS/Text message represented as coming from your credit union, you should contact our Member Service Center at 800.933.3280, press 4, weekdays 8 am - 6 pm ET, and Saturday 9 am - 1 pm ET.  Members are advised to protect the data, security, and privacy of their financial information by not responding to the message directly.

Please note: your browser based Mobile Banking service remains secure.  You should always access our Mobile Banking site directly by going to http://m.myfinancialresources.org using the browser of your Web-enabled wireless device and then log in securely using your Financial Resources WebBranch Internet Banking “User ID” and “Password.”  Never use links provided in suspicious e-mail or text messages.


Alert 02/02/10

Mystery Shoppers: The Latest Fraud Scheme

The latest alert from the Internet Crime Complaint Center (IC3) says mystery, or "secret shopper," schemes are rampant. This employment offer comes via email or regular mail, and promises to hire the person to perform secret or random checks on a retailer or its competition. Fraudsters may ask for resumes and performing background checks on the victims before accepting them as a mystery shopper, which opens the victim to further identity theft problems.

How it works: The IC3 says victims are contacted via e-mail or U.S. mail to apply to be a mystery shopper. Applicants are asked to send a resume and are purportedly subject to an extensive background check before being accepted. The employees are sent a check with instructions to shop at a specified retailer for a specific length of time and spend a specific amount on merchandise from the store. The fraud expert's check is drawn on a non-existent bank account.

The employees receive instructions to take note of the store's environment, color, payment procedures, gift items and shopping/carrier bags, then report back to the employer. The second evaluation is the ease and accuracy of wiring money from the retail location. The money to be wired is also included in the check sent to the employee.

The remaining balance is the employee's payment for the completion of the assignment. After merchandise is purchased and money is wired, the employees are advised by the bank the check cashed was counterfeit, and they are responsible for the money lost in addition to bank fees incurred. Sadly, many people are falling for this scam.

The IC3 says in other versions of the scheme, applicants are requested to provide bank account information to have money directly deposited into their accounts. The fraudster then has acquired access to these victims' accounts and can withdraw money, which makes the applicant a victim of identity theft.

Here are some tips you can use to avoid becoming a victim of employment schemes associated with mystery/secret shopping:

• Do not respond to unsolicited (spam) e-mail.
• Do not click on links contained within an unsolicited e-mail.
• Be cautious of e-mail claiming to contain pictures in attached files, as the files may contain viruses. Only open attachments from known senders. Virus scan all attachments, if possible.
• Avoid filling out forms contained in e-mail messages that ask for personal information.
• Always compare the link in the e-mail to the link you are actually directed to and determine if they match and will lead you to a legitimate site.
• There are legitimate mystery/secret shopper programs available. Research the legitimacy on companies hiring mystery shoppers. Legitimate companies will not charge an application fee and will accept applications online.
• No legitimate mystery/secret shopper program will send payment in advance and ask the employee to send a portion of it back.

People who believe they have information pertaining to mystery/secret shopper schemes are encouraged to file a complaint at www.IC3.gov. 


Alert 01/12/10

Automated Phone Phishing Attacks Spread to Three States: GA, IA, IN

Financial institutions in Georgia, Iowa and Indiana report being hit by the automated phone phishing attacks that have been striking institutions across the U.S. since early last fall.

Georgia

Calls made by an overseas scam artist told some Bank of Chickamauga, GA customers that "Your debit card has been restricted" and directed them to call a 1-888 number to lift the restrictions on their card.   If customers chose to give this number (their debit card number), then that gave the perpetrator of the scam permission to access funds (by computer) using that debit card and PIN.  The Federal Trade Commission took over the 888 number and put on its own recorded message to potential victims.

Iowa

Nevada, Iowa residents began getting calls on Dec.28 from a scammer posing as a credit union. Local police say a scheme to get people to give out banking or credit card information is making its way through every phone number in Nevada, Iowa. Police report the caller used "caller ID spoofing," which allows their number to appear as a legitimate business.  Members of a community credit union in Cedar Rapids, IA were hit on the evening of Jan. 4 with a similar scam.

Indiana

The phone scam also hit a credit union and a bank in Indiana over New Year's weekend. The phone phishing scam began on New Year’s Eve in the Hagerstown and Greens Fork areas hitting 489 and 886 area prefixes. Customers were being asked in the phone call to enter their debit card numbers because they are being cancelled.  The fraudulent call puts the unsuspecting customer who enters their card information to unwanted charges on their accounts, along with many potential credit issues.

Alert 12/22/09

Pop-up advertisements offering anti-virus software pose threat to Internet users

An ongoing threat exists for computer users who, while browsing the Internet, began receiving pop-up security warnings that state their computers are infected with numerous viruses.

These pop-ups known as scareware, fake, or rogue anti-virus software look authentic and may even display what appears to be real-time anti-virus scanning of the user’s hard drive. The scareware will show a list of reputable software icons; however, the user cannot click a link to go to the actual site to review or see recommendations.

The scareware is intimidating to most users and extremely aggressive in its attempt to lure the user into purchasing the rogue software that will allegedly remove the viruses from their computer. It is possible that these threats are received as a result of clicking on advertisements contained on a website. Cyber criminals use botnets to push the software and use advertisements on websites to deliver it. This is known as malicious advertising or malvertising.

Once the pop-up appears it cannot be easily closed by clicking “close” or the “X” button. If the user clicks on the pop-up to purchase the software, a form is provided that collects payment information and the user is charged for the bogus product. In some instances, whether the user clicks on the pop-up or not, the scareware can install malicious code onto the computer. By running your computer with an account that has rights to install software, this issue is more likely to occur.

Downloading the software could result in viruses, Trojans, and/or keyloggers being installed on the user’s computer. The repercussions of downloading the malicious software could prove further financial loss to the victim due to computer repair, as well as, cost to the user and/or financial institutions due to identity theft.

The assertive tactics of the scareware has caused significant losses to users. The FBI is aware of an estimated loss to victims in excess of $150 million.

Be cautious—Cyber criminals use easy to remember names and associate them with known applications. Beware of pop-ups that are offer a variation of recognized security software. It is recommended that the user research the exact name of the software being offered.

Take precautions to ensure operating systems are updated and security software is current.

If a user receives these anti-virus pop-ups, it is recommended to close the browser or shut the system down. It is suggested that the user run a full, anti-virus scan whenever the computer is turned back on.

If you have experienced the anti-virus pop-ups or a similar scam, please notify the IC3 by filing a complaint at www.ic3.gov.

Alert 12/15/09

Mobile Banking Security Alert: Android Phishing Attack

It has come to our attention that in the first and second weeks of December 2009 a developer using the Android platform has deployed shells of mobile banking applications to try and gain access to banking customer’s financial information. This phishing attack has been launched from the Android Marketplace and is impacting over 50 financial institutions worldwide, including those that currently do not offer mobile banking solutions, much less an Android download.

Please be advised of this potential phishing threat and anyone that has downloaded this application from the Android Marketplace that the Android downloadable provided by Droid09 is NOT an authorized or legitimate downloadable application of your financial institution.   If you have done this, we suggest you change your login password within WebBranch Internet Banking by selecting "USER OPTIONS" to "Change Password."

In addition, we recommend that you immediately remove the application from your phone and take it into your mobile provider and have the technical team evaluate the phone to make sure the application is completely removed and has not compromised any other applications or records within the phone.

To clarify: the browser-based Mobile Banking solution provided by our Mobile Banking provider, MShift, remains fully secure.  Your still have secure access to mobile banking via your Android device, using the mobile browser interface.  This downloadable hacking/phishing effort provided by Droid09, represents a transparent attempt to gain access to credit cards and account numbers through the emerging Android platform. We recommend you access your bank accounts, or other e-commerce related activity ONLY through the web browser interface, instead of a downloadable application, until the Android platform has been proven secure for financial transactions.


Alert 12/11/09

Tis the season!

Here's a short list of the kinds of scams and schemes criminals are using to make holidays a real heartache.  Practice safe computing during the holiday season and throughout the year. Here's hoping everyone will have a safe, secure holiday season.

Fake charity websites: They're out there and asking, pleading for your credit card information. Stick with the well known ones like the Salvation Army or the Red Cross.

Fake delivery invoices: These can come in both your personal mail and work email, annoying, but they can be ignored. If these fake delivery invoices are opened, they usually deliver some nasty malware onto the computer. If you owe someone money, they're going to call you or send invoice via snail mail.

Fake "New Friend Request" emails: These are sneaky, so be on the watch for these on Facebook and other social media sites.

Holidayecards laden with computer viruses: One word describes these potentially virus-laden missives -- dangerous. Check with the person who supposedly sent it to you; if it doesn't jibe, delete! Even if legit, scan for viruses.

Unsecured, public area computers: Unsecured? Enough said. Many times, keyloggers and sniffers are placed on there by criminals to watch and record every key stroke. Even checking your email is dangerous on public area computers.

Fraudulent holiday-related websites: Try to visit only reputable, well-known sites.

Job-related email scams: Review the alert posted below on 11/02/09.

Auction site fraud: The classic fraud via sites such as eBay and others isn't going away. Buyer beware - if it looks or sounds too good to be true, walk away.

Password theft: This is done in myriad ways, so caution is the watchword. Also, remember to change their passwords frequently and not use the same password for every site you visit.  For password tips, review the alert posted below on 07/20/09.

E-mail banking scams: Can be devastating to a your account balance, and even your identity, so keep reviewing the warnings about phishing, vishing, smishing, because the criminals are using more than just the computer to get what they want.

Alert 11/02/09

Fraudulent Work-at-Home Funds Transfer Agent Schemes

Financial institutions are reporting an increase in schemes to recruit individuals to receive and transmit unauthorized electronic funds transfers (EFT) from deposit accounts to individuals overseas.  These funds transfer agents, often referred to as "money mules," are typically solicited on the internet by criminals who have gained unauthorized access to the online deposit account of a business or consumer. In a typical scenario, the criminal will originate an unauthorized EFT from a victim's account to a money mule's deposit account.  The money mule is then instructed to quickly withdraw the funds and wire them overseas after deducting a "commission" (commonly eight to ten percent).  Often the money mules are recruited through work-at-home employment ads; advance fee schemes; and mystery shopping jobs.

The following are common scenarios:

• Online job posting Web sites are used by criminals to locate individuals seeking employment with flexible work hours that can be performed from home. These work-at-home schemes often involve written employment contracts, job descriptions and procedures to legitimize the scam.
• Advance fee scams promising large monetary rewards for acting as a financial intermediary can entice individuals to participate in this activity.
• Mystery shopping jobs may be used that require the employee to assess the performance of money service businesses by completing EFTs and then evaluating the service using customer satisfaction forms.
• Social networking sites may be used to recruit individuals to act as money mules. Criminals conjure up various imaginative stories to befriend and persuade individuals to receive and forward stolen funds.
• Some hesitant or skeptical money mules have been intimidated, harassed and threatened by their criminal "employers" to process the funds transfers quickly and with secrecy.
• The personal identifiable information provided by the money mule might later be used to commit identity theft or account takeover.

Alerts 10/02/09

Scam Alert

The Department of Homeland Security's Computer Emergency Readiness Team(CERT) is warning Internet users to be on guard against a convincing e-mail virus scam disguised as a message from auditors at the Internal Revenue Service.

CERT recently reported: "The attacks arrive via an unsolicited email message concerning an inquiry by the IRS and may contain a link or attachment. If users click on this link or open the attachment, they may be infected with a malicious code, including the Zeus Trojan."

The Zeus Trojan steals sensitive data, and it is especially interested in on-line banking credentials. According to Gary Warner, director of research in computer forensics at the University of Alabama, Birmingham, this fake IRS notice has been ongoing for several weeks now.

Important Tip: Do not click on attachments included in unsolicited e-mails, especially those that encourage you to act quickly or else suffer some scary fate. These are attempts to plant malicious software on your computer.

Also, note that the IRS does not communicate with businesses or citizens via e-mail.


Potential Text Messaging/Vishing Attack

It has been reported that random New York metro area consumers have been targeted with a fake "warning" via text message that says their debit cards have been closed or otherwise compromised. Consumers are directed to call 845-765-9464, where they hear a recording that asks them to submit their 16-digit card number and PIN. This information is collected for the purpose of account or identity theft.  This is a fraudulent message, and members are urged to not call the number or surrender their card numbers and/or PIN to anyone. The phone number is expected to be out of service soon.

Alerts 07/20/09

Creating a Good Password

Most people use passwords that are based on personal information and are easy to remember. However, that also makes it easier for an attacker to guess or "crack" them. Consider a four-digit PIN number. Is yours a combination of the month, day, or year of your birthday? Or the last four digits of your social security number? Or your address or phone number? Think about how easily it is to find this information out about somebody. What about your email password – isit a word that can be found in the dictionary? If so, it may be susceptible to "dictionary" attacks, which attempt to guess passwords based on words in the dictionary.

Although intentionally misspelling a word ("cardd" instead of "card") does offer some protection against dictionary attacks, an even better method is to rely on a series of words and use memory techniques, or mnemonics, to help you remember how to decode it. For example, instead of the password "baseball," use "BBhbmL" for "[B] [B]all [h]as [b]een [m]y [l]ife." Using both lowercase and capital letters adds another layer of obscurity. Your best defense, though, is to use a combination of numbers, special characters, and both lowercase and capital letters. Change the same example we used above to "BBhb*m1." and see how much more complicated it has become just by adding numbers and special characters.

Don't assume that now that you've developed a strong password you should use it for every system or program you log into. If an attacker does guess it, he would have access to all of your accounts. You should use these techniques to develop unique passwords for each of your accounts. 

Password Tips:

• Don't use passwords that are based on personal information that can be easily accessed or guessed, (i.e., birthdates, social security numbers, family or your pets names)
• Don't use words that can be found in any dictionary of any language
• Develop a memory device to recall long or complicated passwords
• Use a passphrase instead of a password
• Use both lowercase and capital letters
• Use a combination of letters, numbers, and special characters
• Use different passwords on different systems

Alerts 02/10/09

Taxpayers Beware of Identity Theft, Scams, and Phishing

According to the IRS, taxpayers are falling prey to suspicious emails and various forms of identity theft. With a substantial portion of taxpayers electronically filing their tax returns and directly depositing their refunds into their bank accounts, many scams are on the rise.  Fraudsters perpetrating as home repairmen and phony sweepstakes, aren’t new. They often affect the elderly. However, taxpayers should be aware of various forms of phishing, as email allows the creation of recent schemes that lure the unsuspecting.

In phishing scams, internet fraudsters send email messages to trick unsuspecting victims into revealing financial and personal information which is used to steal the victim’s identity. In recent scams, these emails claim to come from the IRS.

In one phishing scam an email purporting to come from the IRS lures taxpayers by falsely claiming that the taxpayer can receive $80 by filing out an online customer satisfaction survey.  The survey does ask standard customer service questions, however, it also asks for the participant name, telephone number, and credit card information.

Another email scam that appears to be a solicitation from the IRS and the U.S. government for charitable contributions to victims of the recent Southern California wildfires is on the increase.  When clicking the link, the recipients are sent to a web site that appears to be the IRS. The participant is then directed to click on a link that opens a donation form that asks personal and financial information that is used to access banking information.

Emails claiming to come from tax.refund@irs.gov, admin@irs.gov, and similar variations, scam recipients by informing them that they are eligible to receive a tax refund of a given amount and directs the recipient to a link and website. The website displayed is an interactive page similar to the genuine IRS page. However, unlike the genuine website it has been modified to ask for personal and financial information.

In another scam aimed at individuals and businesses, the recipient is informed that a customer has filed a complaint against a company, of which the email recipient is a member, and that the IRS can act as an arbitrator.

In addition to emails scams, taxpayers are continuously plagued by identity theft schemes.  Recently taxpayers have received phone calls about the economic stimulus payments, in which the caller impersonates an IRS employee. The taxpayer is asked for their social security number and banking information, and told that the IRS requires the information to complete the processing of the taxpayer’s additional stimulus payment or recovery rebate. In reality, the IRS uses the information from the taxpayer’s tax return to process both the stimulus and recovery rebate payments, rather than contacting taxpayers by phone.

Other scams include one in which taxpayers are called by phone and informed that as a senior citizens, they qualify for a interest-free home improvement loan from the IRS, and another in which first-time home buyers are told that they qualify for a $7,500.00 tax credit, but that the paperwork must be completed online by the IRS. In reality, first-time homebuyers, and those who have not owned a home in three years prior to a purchase can take advantage of a new tax credit. The credit operates much like an interest-free loan because it is paid in equal installments over a 15-year period. The credit is 10 percent of the purchase price of the home, with a maximum available credit of $7,500.00. Taxpayers can apply for the credit while completing their 2008 federal tax return.

Taxpayers are encouraged to take an active role in the prevention of tax scams. Research all solicitations with claims to be from the IRS. Remember that the IRS communicates in writing by mail. Record all interactions by email and by phone. Lastly, taxpayers are encouraged to report tax schemes, the fraudulent misuse of the IRS logo, forms or other IRS property by calling the Treasury Inspector General for Tax Administration (TIGTA) toll-free hotline at 1-800-366-4484.

 

Alerts 01/20/09

'Phishing' activity appears to be on the rise

Summary: Information received recently from other credit unions suggests an increase in phishing activity. The fraud appears to be widespread geographically, and scammers are using a variety of techniques to obtain personal and financial member information.

Details: Examples of recent reported phishing activity includes the following:

• Text messages were sent to members indicating they should call a specific number and provide credit card information based on a freeze on their account.
• Computerized calls to members indicated possible tampering of their check cards and asked them to enter their 16-digit check card number. The phone number shown on Caller ID appears to be a legitimate number, possibly hijacked by the fraudsters.
• Members were blanketed with phone and text messages stating their cards had been suspended and directed them to call a number to reactivate. When members call back, they are instructed to input their card numbers and PIN. It is our understanding that counterfeit cards were then created and ATM/Debit card PIN-based transactions took place in Romania.
• Fraudulent e-mail and text messages are being sent to appear as if they are from a credit union. The credit union’s Web site has been re-created by the scammer, who then asks members to enter their card numbers, expiration date, PIN and CVV2/CVC2 numbers. Members are also being called in the middle of the night stating their cards are experiencing fraud, and they are then asked to provide personal information.
• Credit cardholders received a telephone message from an unknown party who leaves a telephone number for the member to call.  The caller ID reads 'economic relief.'  When members returned the call, they were prompted to press 1 to lower rates, a person then comes on the call and asks for social security number, credit card number, etc.
• The Credit Union National Association (CUNA) has also been the subject of recent phishing attacks.   Credit union members received e-mail messages appearing to be from legitimate e-mail addresses for CUNA and other credit unions stating "Your card has been deactivated." The members are directed to call an 800 number (there are multiple 800 numbers being used) to 'activate' their card and PIN. One aspect of this scam causing particular concern is the realistic nature of the call:  a message indicates all operators are busy, callers hear music for several seconds, and then a normal sounding (non-computer generated) voice prompts them to leave their name and a callback number.  Our understanding  is they will receive a call back from an actual person making the request seem valid.  For additional information, please link to the Fraud Alert  on CUNA’s Web site.

Alerts 11/24/08

New 'Phishing' Scam Uses Fake Airline Ticket

Summary: A new e-mail "phishing" scam seeks to plant malicious software on the computers of recipients who open an attachment purportedly related to the purchase of an airline ticket.

Details:The fake e-mails use the names of various U.S. airlines including Northwest Airlines, Continental Airlines, Sun Country Airlines, US Airways, Allegiant Air, Delta Air Lines, Alaska Airlines, Midwest Airlines, and Hawaiian Airlines.

The e-mail messages urge recipients to confirm a ticket purchase they never ordered. The e-mail requires an entry by thanking recipients for buying the tickets using the "Buy flight ticket online" service offered by the airline. Giving fake details of the purchased ticket, it asks them to confirm the purchase by printing the invoice and the ticket after clicking on an attachment in the mail.

However, when unsuspecting recipients click on the e-mail, a malicious software program downloads onto their computers. This "malware" enables the fraudsters to gain confidential information such as credit card access codes, Social Security numbers, and Internet banking passwords by allowing them remote access to the computers.

Airlines say there are a couple of things inside the mail that should warn people of the scam. The e-mails contain mistakes in spelling and grammar, and the formats in which the itineraries are presented are different than those used by the airlines.

You should be aware that these e-mails are not coming from the airline. If the format does not look familiar to you, and you have not recently purchased a ticket, do not open the attachment. Delete the e-mail right away.

Below is an example of an e-mail received:

From: Hawaiian Airlines [mailto:tegoo@qq.com]
Sent: Thursday, November 13, 2008 4:24 PM
To: James Mxxxx
Subject: Your flight ticket
Dear Valued Customer
Thank you for using our new service "Buy airplane ticket Online" on our website.

Your account has been created:
Your login: 1mooreDacu,com
Your password: PASS8QBE

Your credit card has been charged for $424.85.

We would like to remind you that whenever you order tickets on our website you get a discount of 10%!
Attached to this message is the purchase Invoice and the airplane ticket.
To use your ticket, simply print it on a color printed, and you are set to take off for the journey!
Kind regards,
Hawaiian Airlines

New Phishing Scam Sounds like Official Telephone Call

Summary: Plastic-card phishing has a dangerous new twist. In a telephone call to a cardholder, the criminal attempts to obtain the three-digit security code on the back of card. You should never give out this information.

Details: With the holiday season approaching, shoppers increasingly use their credit and debit cards to make purchases at the mall, on the Internet, or over the telephone. When plastic card use increases this time of year, so do the scams.

A new twist on phishing aims to obtain the three-digit security code printed on the back of VISA and MasterCard credit and debit cards. The phishers are trying to get enough information to perform fraudulent card-not-present transactions (Internet, telephone, and mail-order purchases).

Under this scam, a telephone call is placed to a legitimate cardholder.  The caller claims to be a representative from VISA or MasterCard informing the cardholder of suspicious card activity. The caller provides details of an unusual transaction and asks if the cardholder made this purchase, which, of course, the cardholder did not. The cardholder is then asked to verify possession of the card. To do so, the cardholder is asked to read the three-digit security code on the back of the card. The fraudster then provides a control number in the event the cardholder needs to call back with questions, making the call seem legitimate.

The caller does not ask for the credit or debit card number, and that is why you can be fooled into believing the call is legitimate. But the fraudster already has the card number; what they don’t have is the three-digit security code from the back of the card, and that is what they are after with this scam.

The three-digit code on the back of the Visa or MasterCard card is a security tool used for non face-to-face transactions. When conducting transactions that are not face-to-face, many merchants will ask the shopper for the three-digit code to complete a card authorization. If the criminal obtains this three-digit number and already has your card number, card expiration date, and billing address, the criminal may be able to obtain authorization for fraudulent transactions.

Never give that code to anyone who may contact you by telephone, Internet, or mail. This security tool is used when a card-not-present transaction is performed, and during the transaction the merchant may ask for the code to complete the authorization process.

Never respond to any e-mail, telephone call, voice message, text message, or letter received through the mail that requests personal and financial information, including the three-digit number on the back of the card.

Alert 09/05/08

Hurricane Scams

Details: When Hurricane Katrina first hit in 2005, scams popped up within hours. Hurricane Gustav is no different, and Hanna, Ike and others will likely be the same in the days and weeks to come.

Online scams are likely to pop up in your inbox. How can you determine what is a scam and what is authentic?  Chances are that any e-mail asking for donations is a scam. But the e-mail scammers are very tricky. They have created e-mails that sound authentic, tear at your heartstrings, and make you feel compelled to "donate" to disaster relief.

So, to help protect you from scams that are almost certain to find you, we provide the following information. 

Phishing Scams

Prior to Hurricane Gustav’s landfall, the Louisiana Attorney General's office started seeing bogus e-mails asking people to "confirm" their bank information before the hurricane hit. These e-mails sent people to bogus Web sites that could then be used by scammers for financial fraud and identity theft.

Also, Web sites that claim to be legitimate Hurricane Gustav relief organizations have been created. They ask people to donate money by giving your financial information. The donated money will go straight into the pockets of con artists. The scammers can use this information to steal your identity, as well.

Here's an example of what an e-mail could look like:

"Please give your charitable donations to the victims of Hurricane Gustav. The chaos and destruction experienced by the region and its victims is unimaginable. But you can help these people regain their lives by giving them some hope. Your donation will go a long way to giving these victims their lives back. Our prayers and compassion go out to them. Make a generous donation to the American Red Cross by (clicking this link)." [A bogus but legitimate-sounding domain name is listed here] 

This scam sounds legitimate and plays on your emotions.

Action: If you want to make a donation through the Red Cross or another disaster relief organization, go to an organization's office itself, or the official Web site, such as RedCross.org.

Alert 08/05/08

Phishing,  Smishing and Vishing: What's the difference?

E-mail "Phishing"
Phishing (pronounced "fishing") is a scam to steal valuable information such as credit card and Social Security numbers, user IDs, and passwords. In phishing, also known as "brand spoofing," an official-looking e-mail is sent to potential victims pretending to be from their ISP, credit union, bank, or retail establishment. E-mails can be sent to people on selected lists or on any list, and the scammers expect some percentage of recipients will actually have an account with the real organization.

Land line telephone “Vishing” & VoIP (Internet phones “Vishing”)
Vishing, (Voice phISHING) also called "VoIP phishing for the Internet phones," is the voice counterpart to phishing. Instead of being directed by e-mail to a Web site, an e-mail message asks the user to make a telephone call. The call triggers a voice response system that asks for the user's card number or other personal or financial information. The initial bait can also be a telephone call with a recording that instructs the user to phone an 800 number or another area code within or outside of the United States.

In either case, because people are used to entering card numbers over the phone, this technique can be effective. Voice over IP (VoIP) is used for vishing because caller IDs can be spoofed and the entire operation can be brought up and taken down in a short time, compared to a land line telephone.

Text Message “Smishing”
Smishing (SMS phISHING) is the mobile phone counterpart to phishing. Instead of being directed by e-mail to a Web site, a text message is sent to the user's cell phone or other mobile device with some ploy to click on a link. The link causes a Trojan to be installed in the cell phone or other mobile device.

New!  Mail Letter “Phishing”
This new scam occurs where the phisher is creating a letter and sending it through the mail to individuals to respond to the letter by calling a phone number. The phisher outlines in the letter that the individual must respond for their own protection. This scam is used in conjunction with other channels to steal valuable personal and financial information of the individual receiving the letter.

Loss Prevention Recommendations:

• If a message is received by someone claiming to be from your financial institution asking for confidential information, NEVER respond unless you initiated the request.
• If you have doubts about who's on the phone, call back the number of record at your financial institution or Card Company.
• Be wary of any message received from an unknown sender.
• Monitor your accounts on a regular basis.
• If you have a land line or Voice over the Internet (VoIP), create a password protected account.
• Don't display your wireless phone number or e-mail address in public. This includes newsgroups, chat rooms, Web sites, or membership directories.
• If you open an unwanted message, send a stop or opt out message in response.
• Check the privacy policy when submitting your wireless phone number or e-mail address to any Web site. Find out if the policy allows the company to display or sell your information.
• Contact your wireless or Internet service provider about unwanted messages.

If you are a victim of Phishing, Smishing or Vishing, take appropriate steps:

• Contact your financial institution.
• Report the incident to a credit bureau.
• Order a credit report.
• Report suspicious Internet sites and emails to the government and for additional protection tips visit www.ic3.gov or the Federal government's consumer information center at http://www.ftc.gov/bcp/edu/microsites/idtheft/.
• Work with your Internet provider or telephone carrier to shut down fraudulent sites or telephone numbers.
• Use tools provided by a reputable Internet brand protection service to conduct regular comprehensive Internet monitoring.
• Monitor all Web links to ensure proper authorization, content, privacy, and security.
• If you have been victimized by a spoofed e-mail or web site, you should contact your local law enforcement, US Postal Inspector, or FBI.

Fraud Alert 07/17/08

SECURITY WARNING: Current Phishing Scam

Our Internet Banking service provider, Digital Insight, would like you to be aware about a current phishing scam directed at Digital Insight client financial institutions and their end users.  The scam targets users by sending emails that appear to be from an official Digital Insight source (for example, “Digital Insight Customer Care,” “Digital Insight Administration,” etc.), and is designed to trick the recipient into clicking a link in the e-mail for the purpose of acquiring sensitive data, such as passwords or financial information.

You should NEVER click links or install programs suggested in emails, even if the email appears to be from an official or familiar source. Digital Insight and Financial Resources FCU will never send emails containing links to download software or applications.

 -- Sample Phishing Email --

Date: July 16, 2008

To:

Subject: Attention - Important Notification!

Dear Administrator,

We inform you that your account is about to expire. It is strongly recommended to update it immediately. Update form is located here. However, failure to confirm your records may result in account suspension

Fraud Alert 06/25/08

From the Credit Union National Association (CUNA Mutual Group):
"Smishing" Scam Targets Credit Unions via Text Messaging

Credit unions across the country are reporting that their member’s are receiving unsolicited text messages. It’s an attempt at Smishing, the latest form of phishing. In Smishing, an e-mail tries to lure a recipient into giving personal information via SMS, the communications protocol used to send text messages to a wireless device. The recent scam is targeting credit union and other financial institution members.

In Smishing, a member receives a text message via cell phone warning that their bank account has been closed due to suspicious activity. It then tells them they need to call a certain phone number to reactivate the account.

Unsuspecting callers who dial the number provided in the text message will be taken to an automated voice mail box that prompts them to key in their credit card or debit card number, expiration date, and PIN to verify their information.

If you have a question concerning your account or debit card, contact us at 800.933.3280, press 4.

Recommendations: 

• Financial Resources will never solicit personal or private information via e-mail or text message.
• Be wary of any message received from an unknown sender.
• Do not open unsolicited e-mails or text messages.
• Do not click on any links provided in unsolicited e-mails.
• Don’t display your wireless phone number or e-mail address in public. This includes newsgroups, chat rooms, Web sites, or membership directories.
• If you open an unwanted message, send a stop or opt out message in response.
• Contact your wireless or Internet service provider about unwanted messages.

Fraud Alert 02/22/08

From National Credit Union Administration:
Phishing Attempt – E-mail Solicitation Using NCUA Region 1 Address

The purpose of this fraud alert is to inform all federally-insured credit unions about a recent phishing attempt to obtain credit card account numbers and expiration dates.

In cases reported to NCUA, the perpetrator(s) sent e-mails to credit union members and the general public stating that the "National Credit Union Administration temporarily suspended your account due to fraud attempts". The e-mail goes on to state "to reactivate your account call the toll free number" provided. The e-mail is addressed as originating from the NCUA Region 1, Albany, New York office and the phone number to call has an Albany area code of 518.

NCUA does not ask credit union members or the general public for such information. Anyone who receives an e-mail that purports to be from NCUA and asks for account information should consider it to be a fraudulent attempt to obtain their personal account data for an illegal purpose and should not follow the instructions in the e-mail.

Credit union management should inform their employees of this recent fraudulent activity so they can assist in identification of such activity. Credit union personnel should be educating members regarding the signs of such activity. Management should also be aware there may be variants to the scam previously described.

Persons affected by this scam, and variants of this scam, should be advised to forward the entire e-mail message to Phishing@ncua.gov. Additionally, formal complaints concerning any suspected fraudulent e-mail can be filed with the Internet Crime Complaint Center (IC3) at  www.ic3.gov. IC3 is a partnership between the Federal Bureau of Investigation, the National White Collar Crime Center, and the Bureau of Justice Assistance. 

A note about fraud

NEVER provide you personal account information when solicited via phone or email. In the effort to recognize, prevent, and report fraud, the following information is being provided on the National Credit Union Associations's (NCUA) website at http://www.ncua.gov/Resources/FraudAlert/index.aspx.

Important Information from the FBI about fraud:

If you can answer "yes" to any of the following questions, you could be involved in a fraud or about to be scammed!

• Is the CHECK you have from an item you sold on the Internet, such as a car, boat, jewelry, etc?
• Is the amount of the CHECK more than than the item's selling price?
• Is the CHECK connected to communicating with someone by email?
• Is the CHECK drawn on a business or individual account that is different from the person buying your item or product?
• Have you been informed that you were the winner of a LOTTERY such as Canadian, Australian, El Gordo, or El Mundo, that you did not enter?
• Have you been instructed to either "WIRE", "SEND" OR "SHIP" MONEY, as soon as possible, to a large U.S. city or to another country such as Canada, England or Nigeria?
• Have you been asked to PAY money to receive a deposit from another country such as Canada, England or Nigeria?
• Are you receiving PAY or a COMMISSION for facilitating money transfers though your account?
• Did you respond to an email requesting you to CONFIRM, UPDATE OR PROVIDE your account information?