CUNA Risk Alert

A recent example of fraudster ingenuity is the use of Voice over Internet Protocol (VoIP) phones to steal members' financial information. This scam is called "vishing" -- short for "voice phishing."

There are at least two "Vishing" methodologies scammers use.

Online version

The scammer sends a blast e-mail, disguised to appear as though it’s from your credit union, bank, online payment service or other well-known business. The e-mail, which may have a trusted logo, typically reports a "security" problem with the recipient’s account and urges the member/member to call a telephone number to "straighten things out." 

Although many members know better than to click on hyperlinks in strange e-mails for fear of being "phished," they often feel safe calling a telephone number that appears to be local or toll-free. When the member calls, they reach an automated attendant prompting them to enter their account number, password or other private information for "security verification" purposes. 

Cold Call

Some "vishers" use automated dialing programs to "cold call" members. The members’ caller ID device may list a legitimate-looking local phone number, to inspire trust from the recipient. A prerecorded message (or sometimes a live "employee") claims the member’s account has been compromised or needs updating or verification. The member is asked to enter their account information, which is digitally transcribed onto the hard drive of the scammer’s computer.

Loss Prevention Recommendations:

• Report VoIP attacks to your local federal law enforcement agency. Many agencies now have cyber threat units that are well-versed in investigating these activities.
  • Use the FTC (Federal Trade Commission) web site, www.onguardonline.gov.
    • Consumers can take interactive quizzes designed to enlighten them about identity theft, phishing, spam and online-shopping scams.
    • Elsewhere on the site, consumers can find detailed guidance on how to monitor their credit histories, use effective passwords and recover from identity theft.
• If you are a victim of phishing/vishing, take appropriate steps to help protect yourself:
  • Block and reissue the compromised credit/debit cards
  • Report to credit bureau
  • Order a credit report