Blog

The scenario: Someone calls you who claims they're from Consumers Credit Union (or a credit card company representative) and says there's fraudulent activity on your account. They ask for your account credentials, including digital banking login information. Or perhaps they ask you to transfer money between accounts or to someone else, initiate a wire transfer, or purchase gift cards.

What do you do?

Anyone asking you for your CCU login credentials is a fraudster and you should hang up immediately. CCU will never ask you for your login credentials, including authentication codes you receive via text.

So who are those people that call you and claim to represent a government agency or some other authority and tell you to send them money? Neither you nor law enforcement agencies are likely to ever know. These people could be in the same town that you are… or they be halfway around the globe. All you know is that they’re voices on the phone.

How can you protect yourself against a fraudster that you have never met but seems to know who you are and has private information about you? The answer is straightforward – be skeptical when anyone you do not know calls you, and rely on common sense. Most importantly, do not be intimidated by them because of assertions they make about being in positions of authority.

Consider how to respond to the following common scam scenarios:

• A call seemingly comes from your financial institution (FI), or the “Security Department at Microsoft” (or Apple, Dell or HP), and you’re told your bank information has been compromised. You are instructed to transfer your money out of your existing FI into an escrow account or bitcoin account that the Security Department will keep safe while an investigation takes place. Oddly, they instruct you not to tell anyone at the FI the reason for doing so, because certain employees at that FI may be suspect. After you deposit the cash into the designated “escrow” account, you lose all contact with these “security personnel” and never see your money again.
• You are called by the Fraud Department of your FI (allegedly). You’re told there is an alert on a Zelle transaction.This “Fraud professional” tells you that a verification code will be sent to you. When you receive the verification code, the “Fraud professional” asks you to say what the verification code is. You provide the information and the “Fraud professional” clears that there were no unauthorized transactions.
  Days later, you attempt to get into your digital banking account and find you can’t because the password has been changed. The “Fraud professional” is discovered to have been an imposter who had enough information to log into the online account and trigger a “forgot password” message, for which the related verification code was sent to you. Thinking you were dealing with a legitimate employee of your FI, you then gave the code to the imposter, thus allowing them to change the password and block you out.
• An “IRS agent” (or state revenue agent or county property tax authority) calls to tell you about your long-overdue tax bill that is accruing interest. You protest, saying that you pay your taxes and file your return on time every year. The “IRS agent” says there is a process in which they can dispute the tax bill and will send you a form you can complete and submit to lodge your protest.

However, in the meantime, you should make a payment to the IRS to be held in escrow so that interest does not continue to be accrued. The “IRS agent” instructs you that the simplest way to make such a payment is to purchase gift cards that are equivalent in value to the principal amount owed on the back taxes. After the gift cards are purchased, the “IRS agent” calls you a second time and asks for the account number listed on the gift cards and explains that you will now not have to mail the gift cards. With the gift cards’ account numbers in hand, the “IRS agent” (who is an imposter) will be able to make purchases through the internet for the value of the gift cards in a card-not-present transaction.

In these scenarios and others like them, you might be inclined to believe that the caller/imposter is who they say they are because caller id identifies the incoming number as “Microsoft,” or “Apple,” or your financial institution, or “IRS,” etc.  Unfortunately, a fraudster can easily spoof another entity’s business number to begin an impersonation. The warning signs (or “red flags”) that these scenarios and similar such scenarios that are actually the work of imposters looking to defraud you include the following:

• Software and hardware technology companies like Microsoft, Apple, Dell, HP, or others do not have knowledge of what may or may not be happening to your bank accounts.
• Technology companies would never direct a person to send them money that they (the companies) would hold for safekeeping.
• No one – whether from a technology company or your financial institution or a law enforcement agency – would direct a person to move money out of that person’s account from one financial institution to an account that person does not control in another financial institution.
• Any caller who tries to convince you to withdraw money from your existing accounts but not tell anyone working at that financial institution (or worse, provides you a lie to tell FI personnel) is a scammer.
• Fraud or Security personnel at a financial institution will never ask an account holder for a verification code the system sends them.
• Government agencies do not make collection calls demanding immediate payment for overdue or back taxes.
• Government agencies would never instruct a taxpayer to pay amounts owed using gift cards, including asking for the gift card numbers over the phone (this is also true for any corporate entity who would be looking for payment on alleged unpaid bills or overdue receivables).
• No financial institution, corporate entity or government agency would ever instruct an individual to deposit money in a bitcoin account (or the related, a bitcoin ATM) that the individual does not personally control – either for safekeeping or to pay an overdue debt.
• Any caller, regardless of who they claim to be – security or fraud professional or government agent – who presents a story whereby you must move your money out of your account (for whatever reason) and you must do so immediately and without delay is likely a scammer.

When people receive these types of calls, they are interacting with imposters who are professional fraudsters. As such, the imposters are prepared to answer any question a caller might have. They can be charming, persuasive and sympathetic. Alternatively, when necessary, they can sound urgent, threatening and/or menacing. As an imposter, they are simply playing a part and looking for the best means to coax the desired response from the caller.

What is the best means for a consumer to protect themselves from such calls? There are three simple suggestions which provide great protection.

• If you receive a call where you are asked, instructed or urged to move money, you should ask for the caller’s name and work location, and then tell them that you will have to call them back. Hang up. After that go to the website of the entity the caller claimed to be a representative of (financial institution, government agency or business) and call the number from the website. When you reach the true entity, explain the previous call you received and the supposed representative you talked to in order to confirm – or more likely refute – the legitimacy of the initial call.
• Before withdrawing funds out of an account at your personal financial institution for a purpose that appears at all unusual (due to purpose, amount or urgency, or due to any entity or individual you have never met) talk to a representative at the FI. Do not hide elements of the story from the FI representative or recite a lie given to you by the unseen imposter. The FI representatives welcome the opportunity to provide service to their account holders.
• If after an interaction with an unknown person you suspect they are an imposter, contact your FI to request the account(s) be frozen, and then work with the FI’s representatives to change your account number and online login credentials.

(Portions of this article were adapted from the Federal Trade Commission’s article, “How to Avoid Imposter Scams” at consumer.ftc.gov/features/how-avoid-imposter-scams.)