Protect Your Accounts from the Latest Scammers

Consumers love technology — and so do crooks. While e-banking is a secure way to manage finances online, fraudsters often trick people into sharing the very security details designed to keep their accounts safe. These bad actors combine stolen account details or other personally identifiable information along with smishing and vishing techniques to steal money directly from members by pretending to be credit union representatives.

Learn how this growing fraud scheme works and what you can do to avoid becoming a victim.

What is smishing?

Smishing is a phishing scheme that uses spoofed SMS text messages to convince people they are receiving communications from a trusted source.

How does smishing work?

Crooks contact members by sending an SMS text message that appears to originate from Credit Union of Colorado, tricking members into believing the notification is legitimate. The message falsely claims that the member needs to click on a link or respond to the text to confirm suspicious account activity or confirm a loan approval.

The member may be instructed to enter their account credentials, passcode, or other confidential information to help quickly resolve the issue. The scammer uses this information to log in to the member's account or commit other fraudulent acts.

The text message may instruct the member to call a phone number instead of clicking on a link — but the call goes to the scammer, not the credit union. During the live call, the scammer pretends urgent account access is needed so they can resolve a fraud alert or another account issue. Their goal is to have the member share the one-time passcode that's sent to the member's telephone. The member is unaware that the fraudster has triggered the passcode and is ready to enter it so they can proceed to their next step.

If the member questions why account information is needed, the criminal says they need to verify the member's identity. Once the crook is logged in to the account, they lock the member out of the account by changing the e-banking login credentials, and then they transfer the funds to an external account within minutes.

What is vishing?

Vishing is another type of phishing scheme. This scheme uses spoofed phone numbers and caller ID displays, so calls appear to be coming from the Credit Union of Colorado, convincing members they are receiving communication from a trusted source.

How does vishing work?

Fraudsters pretending to be credit union employees contact members via telephone and claim that they need help resolving an issue with one of the member's accounts. The phone call appears to be from the credit union's main number, and the caller ID reads “Credit Union of Colorado”, tricking the member into believing the call is legitimate.

The call is conducted in a manner similar to that of a live call initiated by a smishing scam. The scammer says account access is urgently needed so they can resolve a fraud alert or another account issue. They want the member to share the one-time passcode that's sent to the member's telephone. The member doesn't know that the fraudster has triggered the passcode and is ready to enter it so they can proceed to their next step.

If the member questions why their login information is needed, the criminal says they can't verify the member's identity without it. Once the crook is logged in, they change the e-banking login credentials, lock the member out of the account, and transfer the member's funds to an external account within minutes.

Tips for Protecting Your Account from Scammers

Resist the urge to immediately respond to SMS text messages or voice calls requesting confidential information, even if they appear to originate from the Credit Union of Colorado.

Remember that legitimate accounts:

• Do not require you to provide account credentials via SMS text message or to another person via telephone
• Do not ask you to click on hyperlinks provided via SMS text message or email as the only means of resolving an account issue
• May require that you provide a simple response of “YES” or “NO” but not anything more.
• Encourage you to contact the financial institution at the main phone number on the website, not a hyperlinked number that appears in the communication

If you believe someone is attempting to or has gained access to your account, contact us at (800) 444-4816 to report the incident.