Phising/Vishing/SMishing (verb): a cybercrime in which you are contacted by email, telephone or text message by someone posing as a legitimate institution to lure you into providing personal sensitive data such as banking and credit card details, social security number and passwords.

Recently, criminals in possession of card details and other forms of personally identifiable information (PII) are spoofing credit union phone numbers (phone on caller ID display looks like valid #) in an effort to fool members into thinking that text messages are actually from the fraud department of a particular credit union. Fraudsters are sending text messages under the guise of trying to validate recent card activity and are including hyperlinks within some text messages.

Fraudsters are also using text messaging to deceive credit union members into providing card related data and log in credentials. A typical SMishing occurrence can begin with a member receiving a text message inquiring about a suspicious transaction on an account. In reality, the fraudster is looking to obtain other information from members such as debit card numbers, CV2 codes, expiration dates, PINs and other web login credentials.

Although Wellness Federal Credit Union is not aware of Phising/SMishing or Vishing by spoofing our phone number (our phone number displays on caller ID), it may occur at any time without our knowledge.

In order to help you identify a VALID text message from WFCU’s fraud department, below is a list of what a VALID text message may include:

VALID SMS/Text may include:
– CU abbreviated name
– Last 4 of Card #
– $ Amount in question (with dollar sign)
– Merchant Name
– Reply Options: YES, NO, STOP (to opt out)

VALID SMS/Text will NOT include:
– Requests for CH data, such as card numbers, PINs, CV2 Codes, Expiration Dates
– Vague reference of “Merchant”. Transaction details should be included
– Hyperlinks to unknown websites
– Phone Numbers as Hyperlinks

In another scenario, fraudsters are posing as credit union employees in order to obtain One Time Passcodes (OTP) from members. While on the phone with a member, the fraudster logs into a credit union online banking site. When the OTP is sent to the member’s phone, the fraudster asks the member to provide the OTP as a means to validate the member. When the information is shared with the person the member believes is a credit union employee, the fraudster uses the OTP to finalize access to online banking, which is typically followed by changing the online banking password and transferring funds from member accounts.

Suggested Best Practices for Members
-Members must be cautious when responding to SMS text messages as well as voice calls, even if they appear to come from Wellness.

-If you have any doubt about the validity of a request, call us at 860-527-0047 and speak to a representative.

-Never provide personal information in response to SMS text messages and phone calls purportedly from the us.

-Do not click on links included in text messages from unknown sources.

-Legitimate requests to validate card activity will request a simple response of YES or NO. They will not include hyperlinks to other websites or ask for any personal info.

For more information about how to recognize and avoid phising schemes, visit the Federal Trade Commission website.

You can also visit our Financial Resource Center.