Security Corner Blog

A text message warns of suspicious activity on your card. Moments later, your phone rings—and the caller ID appears to show your financial institution’s real phone number.

It may look convincing, but it could be a scam.

Fraudsters may combine fake card or account alerts with spoofed phone calls to impersonate banks and credit unions. The caller may claim to be from the fraud department and ask for your username, password, one-time security code, card information, or other sensitive details.

The text and call may be part of the same coordinated attempt to gain access to your account.

How Financial Institution Impersonation Works

The scam often follows a familiar sequence:

1. You receive a text claiming there is an unauthorized purchase, suspicious login, or other urgent account issue.
2. A caller follows up pretending to be from your financial institution’s fraud or security department.
3. The institution’s name or legitimate phone number appears on caller ID.
4. The caller asks you to verify sensitive information, share a security code, or approve a login request.
5. The scammer uses that information to access your account, reset your password, or move money.

Caller ID can be manipulated through a tactic known as spoofing. A familiar name or number on your screen does not prove the call is legitimate.

Watch for These Requests

Be cautious if an unexpected caller asks you to provide:

• Your online or mobile banking username or password
• A one-time passcode or multifactor authentication code
• Your full debit or credit card number
• Your PIN, Social Security number, or account information
• Approval of an unexpected login or security notification
• A transfer of funds to a “safe” or “secure” account

Scammers often create urgency by claiming your account or money is at immediate risk. Their goal is to pressure you into acting before you have time to verify the situation.

What You Should Do

Do not respond or click any links. A fake fraud alert may direct you to a fraudulent website designed to steal your information.

Do not share sensitive information. Never provide your username, password, PIN, or one-time security code to an unexpected caller.

Hang up—even if the number looks familiar. Do not rely on caller ID to confirm who is calling.

Contact USSFCU directly. Call 800.374.2758 or use the number on the back of your card. Do not use a phone number provided in the suspicious message or by the caller.

Review your accounts. Check for unfamiliar transactions, transfers, password changes, or updates to your contact information.

If You Shared Information

Contact USSFCU immediately if you provided information to a suspicious caller, clicked a link, entered your credentials on an unfamiliar website, or approved an unexpected login request.

Change any compromised passwords, especially if you use the same password for other accounts, and continue monitoring your accounts closely. You may also report the incident to the Federal Trade Commission at ReportFraud.ftc.gov and the FBI’s Internet Crime Complaint Center at IC3.gov.

Remember: A familiar name or number on caller ID does not prove the call is legitimate. Hang up and contact USSFCU directly.

This article is for educational purposes only.