|
|
||||
|
Scam Alerts This page is intended as an education and reference material for our visitors. For information about recent fraud attempts involving Ashland CU, please visit this page. If you suspect someone is engaged in fraud relating to your member account(s) or is impersonating Ashland Credit Union, please call us at 1-800-245-8112 or 606-329-5489. Tip: "Phishing" is the term for fraud initiated by fake emails which entice victims into visiting fake websites that collect your information. The unusual spelling is derived from hacker slang. For more information on phishing, visit OnGuard Online (http://onguardonline.gov), the federal government's interagency website dealing with ID theft, online fraud and computer security. Tip: "Vishing" is the term coined for scams resembling earlier "phishing" scams, but employing Internet telephone services rather than email as the bait. To learn more about vishing, visit the FBI's February 2007 press release regarding vishing (http://www.fbi.gov). Financial institutions are reporting that cell phone and other mobile device users are being targeted with mobile spam that attempts to trick them into revealing personal information or account information. Known as "smishing," this technique's name is derived from a combination of the acronym 'SMS' (Short Message Service, the technical name for cell phone text messaging) and 'phishing' (mass emailing for the purposes of financial or identity theft). In one instance, cell phone users receive a text message via cell phone warning that their account has been closed due to suspicious activity. The message then directs the consumer to call a certain phone number to reactivate the account. Unsuspecting callers who dial the number provided in the text message will be taken to an automated voice mail box that prompts them to key in their credit card or debit card number, expiration date, and PIN to verify their information. Other strategies send consumers to malicious websites that attempt to harvest this same information or install spyware, "trojan horse" software, etc. onto their computers. If you have any questions concerning your account or debit/credit card, contact your financial institution using a telephone number or web address that you know to be valid. Consult your statement, telephone directory, or a reliable Internet search engine to make contact with your institution. Never visit a website or use a hyperlink that has been sent to you via an unsolicited email or text message. The IRS is warning taxpayers to beware emails which claim the recipient is under criminal investigation by the IRS. These messages contain links or attachments that will launch "Trojan Horse" software on your PC. Trojan Horse software can potentially steal any information that you store or input on your computer, such as account numbers, passwords, social security numbers, etc. For more information, visit the IRS news release (http://www.irs.gov). Students, faculty, and staff of the University of Kentucky with university email addresses received a “phishing” email that appeared to be sent by the University of Kentucky Federal Credit Union. The email contains a UKFCU logo that appears to be a scanned image from some old stationary. The email states:
The indicated link takes victims to a website that is identical to the UKFCU home banking site. Members are then asked to enter their home banking account number and access code as if they were logging into the site. Once the members enter that information, a new screen appears requesting them to enter their full name, debit card number, card expiration date, ATM PIN, and the CVV2 number. Once the member has entered that information, it then thanks them and returns them to the actual home banking site. Therefore, the thieves have not only captured the member’s card information, they have also captured their home banking information as well. Think Before You Act: Did you really try and repeatedly fail to sign on to your Internet banking site? If so, contact the institution yourself by telephone or a secure website messaging system if offered. Use the telephone number or web address that you know and use regularly. Does the logo on your correspondence look official, professional, and current? A Louisville credit union reported the following fake email circulating:
The email contained an attached file with one of these possible names: account-details.zip, account-info.zip, account-report.zip, document.zip, email-details.zip, important-details.zip, information.zip, readme.zip You’ll notice that the email is crafted with false statements asserting that no virus was in the attachment. However, according to a leading antivirus vendor, the attachment is infact a mass-mailing worm that propagates by emailing itself to addresses that it gathers from compromised computers' address books. Furthermore, the worm listens for commands arriving over the Internet that allow the remote attacker to perform any of the following actions: download/execute files, obtain system information such as CPU type, OS version, available memory, etc., remove/update/terminate the worm for detection prevention, perform a Denial of Service (DOS) attack, start a proxy server, start an FTP server, and port redirection. Think Before You Act: Is it wise to open an email attachment that I was not already expecting? Should I telephone customer service before complying? How would my financial institution know anything about my email account or Internet Service Provider? A Louisville, KY credit union reported phony emails which mimicked their email design and referenced the name and title of one of the credit union officers to make the message appear authentic. The message was part of a phishing scheme directing recipients to a fake website designed to imitiate the credit union's authentic website. The website sought to collect usernames, passwords, email addresses, card numbers, card expiration dates, ATM PINs, and phone numbers. The page was hosted by a Japanese Internet provider. The phishing email contained some misspelled words. Think Before You Act: Why is my institution emailing me? Should I contact them using their phone number and website address that I know by heart? Does thes email message use correct grammar and business vocabulary? Should I follow directions sent to me via unsolicited email? The NCUA (National Credit Union Administration - the federal supervisory agency for credit unions) announced the discovery of the following email message targeting consumers and credit unions:
Think Before You Act: What does a federal supervisory board have to do with my personal account(s)? Why does the email state to never give account information in response to an email and then directly contradict that advice? Why is the grammar and capitalization so inconsistent and awkward? Should I ever follow the directions I received in an unexpected email message? There's a new scam on the block, dubbed "vishing," and it's coming to a telephone near you (Networkworld.com 07/12/06). Vishing mimics phishing by trying to trap you into divulging your account numbers. But instead of being phished in an email message, you may receive a telephone call from an automated random dialer, and the voice on the other end of the line may tell you your credit card has been used illegally. You are then asked to dial a fake 1-800 number with another voice that asks you to confirm your account details and credit card number. If you give the information, you can count on your accounts being drained. All of this is possible because of Voice over Internet Protocol (VoIP), the new technology that makes possible inexpensive and anonymous Internet calling. And industry analysts are concerned that it's becoming more difficult to tell phish and vish from actual attempts to contact customers (USA Today 07/12/06). A similar attack recently imitated PayPal (The Wall Street Journal 07/17/06). The fraudulent message urged victims to call a California-based phone number to update credit card account information "to prevent any fraudulent activity from occurring." The number was traced to an Internet-phone service and shut down. A Louisville credit union member received a check drawn on an account at Country Federal Credit Union of Macclenny, Florida issued by Hallmark Financial Services, along with a letter stating she had won a sweepstakes. Country Federal Credit Union was contacted by telephone to verify the check, and it was determined to be fraudulent. Information about the nature of the sweepstakes or whether the member truly entered it was not released. Fraudulent items from several travel and marketing companies in Florida are being drafted against legitimate accounts at many credit unions. The amounts have been small dollar amounts, specifically $49.95, $59.95, and $149.00. The share drafts are all unsigned, as they are supposedly being authorized over the telephone. We believe that these travel and marketing companies already have account numbers as well as names and routing numbers of the credit unions. The payees are located in Florida, with the drafts being payable to accounts in Palm Bank of Florida or Wachovia Bank. Remember to check your statements monthly for any unusual changes in the amounts listed above and please notify us immediately if you suspect you are a victim of this scam. A Louisville, KY credit union reported that a member was contacted via email by an individual who supposedly worked for a company by the name of A. Simons Textiles. He was in need of a bookkeeper in the U.S. to work from home. His clients would make payments for supplies every week in the form of money orders or traveler’s cheques. All the member was required to do was to get the items cashed, deduct his 10%, and forward the remainder via Moneygram or Western Union money transfer to an address in Nigeria. The member received $1,500 in American Express Traveler’s Cheques in the mail from "James Goodwin" and "Kolawole Poopola" in Lagos, Nigeria. They were very poor quality and American Express verified that they were invalid. Think Before You Act: Why would a reputable business have the need to contact a stranger overseas to act as their business intermediary sight unseen? Why would they send currency or checks via international mail rather than by wire, which is their method of receiving funds? Why don't the senders fear the loss of their money overseas? Is it perhaps because their financial instruments are worthless until someone falls for this con and converts them into real money? Do the checks have the usual security features such as embedded strips, real or pseudo-watermarks, color-shifting ink, embossed print, microprinted lines, etc.? A Louisville, KY credit union member placed an ad on roomates.com in hopes of finding a roommate. He was contacted by someone supposedly from Asia (olympianwalter@yahoo.com) wanting to come to the United States. The member was sent five Wal-Mart money orders, each in the amount of $850.00. He was asked to cash the items, keep $600.00 for the first month’s rent and transfer the remaining $3,650 via Western Union to a travel agent (Padgett Charles Alfred, 996 Rama 9 Road, Bangkok, Thailand). The money orders were counterfeit. Wal-Mart is aware of the counterfeiting of their money orders for payment of Internet transactions. Details on the counterfeits used in this scheme include 1) color and corporate trade name and logo duplicated, 2) amount box lines lack “TRAVELERS EXPRESS COMPANY, INC." microprinting, 3) the words "PAY ONLY THIS AMOUNT" (normally written in white against a tan background) missing, 4) excessive values indicated on the money orders (money orders are limited to $1,000) and 5) missing or incorrect phone number (1-866-853-8846 is incorrect; 1-800-543-3590 is correct) Think Before You Act: Why would a someone send such an excessive overage of funds overseas or any funds at all? Why would someone expect a foreign resident to conduct his business by proxy? Why wouldn't the sender wire the funds - a faster and safer method - since he also wishes to receive the return of his fund sin that method? Do the money orders have the usual security features such as embedded strips, real or pseudo-watermarks, color-shifting ink, embossed print, microprinted lines, etc.? A company called Atlantic One (among others) called a credit union member to promise a credit card with a line of credit up to $5,000 with no credit check or application necessary. The only requirement is to pay $319 up front. They called every day and told the member that he was referred to the company by the credit union. Think Before You Act: Why would a credit union, which offers its own line of credit cards, steer you towards another entity? Do you recognize the name of the bank or institution offering you the credit card? Have you ever made a deposit to get a credit card? If someone wants to issue credit to you, why would they first demand a deposit from you? The widespread availability of credit and the highly competitive nature of the business make it highly unlikely that you require a secured credit card. Be sure to patronize a reputable institution that you know by name, reputation, or existing relationship. Perhaps the most notorious and costly Internet fraud is the Nigerian 419 Scam, a type of advance fee fraud. The name of the scam originated from the section of Nigerian penal code dealing with this type of crime, though Nigeria is no longer the sole origin of such scams. The cover story for these scams usually entails a wealthy individual who is desperate for assistance in moving a large sum of money across international borders. The scam offers millions of dollars in potential reward in return for your cooperation in supplying an upfront payment of a few thousand dollars and/or your account information. Naturally, the only transfers of money are the upfront payment from the victim, plus whatever funds the scammer is able to withdraw from the account. The version of this scam shown below was circulating in May 2007 and involves a South African gold mining fortune up for grabs:
It is important to note that being a recipient of such a message does not mean you are being individually targetted. Your email address was probably generated randomly or was perhaps included in a black market database of email addresses obtained by rogue "harvester" software that trolls the World Wide Web and gets passed around on virus infected emails. The first message will announce the potential rewards for your cooperation, and is simply bait to get a response. Successive messages will aim to gain your confidence and ask that you deposit several thousands of dollars for withdrawal, to be used for expenses incurred in moving the money to your account, such as travel, bribes, fake documents, legal expenses, etc. There are documented cases where gullible victims' accounts have been drained again and again in such a method. | ||||
top