Fraud Awareness

How Does It Work?

An account takeover begins with a fraudster sending a text message to your mobile phone. They usually claim they‘re from a financial institution‘s fraud department. They ask you to confirm a suspicious payment that was sent from your account — this may not be true and could be part of the fraud.

If this is a fraud attack, the fraudster typically follows up with a phone call and asks for your personal information to “cancel the payment.” NOTE: we will NEVER ask for your personal information over the phone.

While account takeover fraud attempts can happen at anytime, it usually begins on a Friday, after business hours, and runs through the weekend.

The phone shows an example of a fraudulent “account takeover” text message.

What to look out for:

• Suspicious sender emails. Criminals often leverage email addresses that resemble reputable organizations but alter a few letters or numbers.
• Generic greetings and signatures such as "Sir/Ma’am" or lack of contact information.
• Odd sentence structure, misspellings, poor grammar, and inconsistent formatting are strong indicators of a possible phishing attempt.
• Spoofed websites and hyperlinks. When hovering a cursor over links in the body of an email, if links do not match, the link may be spoofed.
• Malicious variations from legitimate domains that use different spellings or domains such as .net, vs .com. Other tactics include the usage of URL shortening services to conceal the true destination of links.
• Unsolicited links and email attachments are common delivery mechanisms for malware. Opening one of these could make your entire network vulnerable.
• Suspicious or altered attachments. Often a criminal will edit or alter invoices or payment instructions to have funds redirected.
• Sudden changes in business practice. For example, if a vendor suddenly asks to be contacted at a personal email address instead of their company email or is pressing you to act quickly. Be wary of any financial institutions and other agencies who ask for your account information or credentials via phone or email.

Best Practices:

• Establish dual control procedures. Initiate ACH and wire transfer payments under dual control, with a transaction originator and a separate transaction authorizer. Implement dual control in your company’s callback process.
• Verify the callback number. Do not call back the number on the email or any attachment sent to you. Verify the previous number you had on file, or search for the company’s website to ensure that the number matches.
• Do not confirm payment instructions only via email. Always perform a call back using a phone number from a system of record to the person making the request to validate payment requests or changes to account information.
• Avoid clicking on links or attachments from unknown senders. Don’t click on anything in an unsolicited email or text message.
• Use the forward option instead of hitting reply on important emails, so you can type in the correct email address or select it from your email address book to ensure you’re using the real email address.
• Never open an email attachment from someone you don't know and be wary of email attachments forwarded to you.
• Set up two-factor (or multi-factor) authentication on any account that allows it, and never disable it.
• Enable alerts for suspicious activity, such as foreign logins.
• Enable security features that block malicious emails, such as anti-phishing and anti-spoofing policies.
• Create an IT plan to quickly engage your IT and information security staff to determine if there has been a network or email compromise.
• Verify use of a secure session (https not http) in the browser for all online banking.
• Avoid using automatic login features that save usernames and passwords for online banking.
• Ensure virus protection and security software are updated regularly.

• Contact the bank and call the police immediately.
• Prepare any reports and notifications required by regulation, law or policy and deliver as appropriate.
• For international wire transfers over $50,000, call your regional FBI office (https://www.fbi.gov/contact-us/field-offices) and local police. The FBI offers a Financial Fraud Kill Chain (FFKC) process to help recover large international wire transfers stolen from the United States.
• Any wire transfers that occur outside of these thresholds should still be reported to law enforcement (http://www.ic3.gov/) but the FFKC cannot be utilized to return the fraudulent funds.