Text Messages & Spoofed Websites Used to Lure Members Into Scam

Fraudulent text messages - appearing to come from the credit union – containing links to spoofed websites are being sent to members.

The spoofed websites are designed to look like the credit union’s legitimate websites, and members are enticed to click links and share confidential information, such as usernames, passwords, and 2-factor authentication passcodes. These fraud attempts have resulted in losses from account takeovers.

Alert Details

SMiShing (SMS text message phishing) is quickly becoming a preferred choice of fraudsters to lure members into giving up their credentials or sensitive information. There have been multiple reports of members receiving fraudulent text messages containing links to spoofed websites made to look like the credit union’s legitimate site.

The text messages have the following themes:

• The member’s account has been locked or suspended due to suspicious or fraudulent transactions.
• Unusual/suspicious transactions at Walmart.
• Unusual/suspicious transactions at cryptocurrency exchanges.
• Suspicious Zelle transfer.

Members are instructed to click on the link contained in the message, which takes the members to spoofed credit union websites where they are instructed to enter their login credentials – usernames and passwords. The fraudsters immediately use the credentials to log in to the members’ accounts.

Since the fraudsters used unregistered devices to log in to the accounts, a 2-factor authentication passcode is generated and delivered to the member who, in turn, enters the passcode on the spoofed website. The fraudsters immediately use the passcodes to complete the login to the member accounts.

Once logged into the members’ accounts, the fraudsters change the members’ contact information and then remove funds using Zelle/P2P or ACH transfers.

In other instances, the fraudster calls or texts the member, claiming to be from the credit union and needing the one-time passcode.

The primary institutions that have been used to move funds include Metabank, Green Dot, Bancorp Bank, and Coastal Community Bank. However, more financial institutions may be used.