Reports are being shared with credit unions that Zelle users have been experiencing fraudulent texts and calls. This article explains the scam and what you can do to protect yourself. 

Zelle is a preferred target because of the speed in which the transfers are made, which is usually done within hours, and not days. Other person-to-person (P2P) vendors have been targeted as well with the same process.

Here’s how the scam works:

• Fraudsters send text alerts that appear to come from the financial institution warning of suspicious debit card transactions
• Fraudsters call when you respond to the text, often spoofing the financial institution’s phone number and claiming to be from the fraud department.
• To verify your identity, the fraudster asks for your online banking username and tells you that you will receive a passcode via text or email that you then need to provide to the fraudster. It’s actually the fraudster initiating a transaction that will send the verification to you.
• Providing the code to the fraudster will allow them to log into the account using a device not recognized by the system. 
• Once they are logged in, the fraudster will change online banking passwords and use Zelle to transfer funds to others.

Even with the more sophisticated out-of-band authentication with transaction details that Zelle provides, the fraudsters have a work around. They keep you on the phone even after getting your passcode and have you wait for the additional message, telling you that you need to reply Yes to the message to reverse the fraudulent transaction.

What you need to do to protect yourself:

1. Be wary of texts or calls regarding Zelle coming from any financial institution. 
2. Never provide personal information in response to a text message or a call placed to you from a financial institution.
3. Make sure that any call you make to a financial institution is using a reliable and published phone number.
4. If you suspect fraudulent texts or calls from ELGA Credit Union, please report them by calling (810) 715-3542 and talking to a call center agent.

Once again, scammers are upping their game. It typically starts as someone contacting you to solve a technology problem that you may not even know you had and offering assistance that (in the end) you may not even need. They start by requesting remote access to your computer to determine what the problem is, and that is when the trouble can start.

Below is an outline of things that can happen when a scammer gains access to a computer:

• You may be asked to purchase software or a fix. They will request your credit card information.
• Software may be installed that is hidden from the user and not authorized by you.
• Screen scrapers (software that records and transmits what is displayed on your screen) and key loggers (software that records and transmits what you type) may be used to help them gain credentials (user names and passwords). At this point they could get access to everything to which you have access.  
• If they are able to get a password to online banking, scammers may attempt to transfer a small amount of money between accounts to see if it works before attempting “transfer to any account” and draining all available. These test transfers are usually for a $1 or less. Since the scammers have access to email accounts on that computer, they can receive your email verification code to complete the transaction.

Here are some things you can do to protect your accounts:

• Set up an online banking alert to message you for any of the following:
  • Unauthorized Change in your Contact Info
  • Login Credential Change
  • Unauthorized Password change or Reset Request
• Keep an eye on your account for small transfers that you did not originate.
• Avoid setting up an automatic login to accounts.
• Only allow computer updates and fixes from verified sources.
• Never give credit card or personal information to someone who calls you.  It’s best if you look up the support number or verify their contact information. Be cautious if they will not allow you to contact them.

Protect the Confidentiality of Your Login ID and Password

There are three very simple steps you can take to keep your online banking account secure.

#1 – Create a unique login name that is only used for your ELGA account
#2 – Create a good, strong password
#3 – Never share the above information.

Here are additional tips you can follow to prevent unwanted access to your accounts:

• Memorizing your password is the best protection. Never store account information with your login name or password.
• Do not set your internet browser to remember your login ID and/or your password.
• Do not share your password with anyone. Sharing your password with someone else is the same as giving that individual authority to use your name in a transaction.
• Make sure you log out when you’re done using online or mobile banking. Closing the browser is a good practice after you log out.

These are 30 of the most used passwords in the world. Please don’t use any of these.

It’s a good time to check your mobile devices for upcoming subscription services that will automatically deduct money from your account. These are apps that you’ve agreed to pay a monthly or annual fee to use. It’s easy to forget they exist.

Fleeceware apps have been found on Android and Apple IoS devices. Fleeceware apps are not malicious but they do set themselves up for recurring payments, typically after you’ve accepted a trial version. Deleting the app does not always cancel the subscription.

How to cancel mobile app subscriptions

This is how to do it on iOS devices (as described in this Apple support page):

1. Open the Settings app.
2. Tap your name, then tap Subscriptions.
3. Tap the subscription that you want to manage. Don’t see the subscription that you’re looking for?
4. Choose a different subscription option, or tap Cancel Subscription. If you don’t see Cancel Subscription, the subscription is already canceled and won’t renew.

Steps needed on Android devices (based on this Google Play Store support page):

1. Open the Play Store.
2. Check if you’re signed in to the correct Google Account.
3. Tap the hamburger menu icon ​​ Subscriptions.
4. Select the subscription you want to cancel.
5. Tap Cancel subscription.
6. Follow the instructions.

There are a number of peer-to-peer payment apps, also known as P2P, available to make it easy to transfer funds from one person to another. These are a few of the most popular:

• Venmo
• Cash App
• Paypal Friends and Family
• Square Cash
• Zelle 
• Facebook Messenger
• Apple Pay
• Google Pay

P2P is similar to using cash, without actually touching the money. You take funds from an account where you have money and transfer it to another person. Because it’s easy, and because you don’t have to be physically present to make the transaction, this convenience becomes a breeding ground for scams. 

The most common types of P2P scams occur with online ads for merchandise, tickets to concerts and sporting events, puppy scams, fake check scams, and romance scams. What’s common among them is that they claim making a P2P payment is the only option to get the item or service.

Important things you should know about P2P transactions:

• The application is only responsible for transferring of funds. The company backing the application is not responsible for the merchandise.
• These purchases are not able to be disputed, you are fully responsible for any loss you may incur.

Tips to protect yourself:

• Don’t use P2P to purchase products 
  If an online retailer requires payment via a P2P payment service, it’s probably a scam.
• Double check the address, username or phone number of the person you are trying to send money 
  If you make a mistake and send the money to the wrong person, it can be very difficult, or even impossible, to get the money back. If you’re worried you may have the wrong person, send a small amount first to confirm that your intended recipient received it.
• Opt-in for stronger security 
  Almost every popular P2P platform offers the ability to create a personal identification number (PIN). Once that PIN is created, it will be required before any money can be transferred. This extra layer of security protects your money should your phone fall into the wrong hands.
• Send money only to people you know 
  Many peer-to-peer transactions are irreversible, a fact scammers know and exploit.
• Don’t use P2P services for business purposes
  Most of the P2P apps have terms of service which prohibit commercial use, such as using the P2P service to get paid for selling goods or services.

Big events bring out scammers. Here’s what to be aware of going into Super Bowl Weekend:

Summary: One of the most-anticipated sporting events of the year is almost here. Like any popular event, the Super Bowl can be a fertile breeding ground for various malicious actors looking to scam you out of your hard-earned money or your personal data. A wide variety of scams targets both spectators who are watching from the comfort of their living rooms and those cheering for their teams in the stadium. Here are some ways you can tackle security offenses that may be targeted against you.

The Big Three!

• Streaming from unverified sites
• Tickets from unofficial sources
• Special apps and hotspots

Read more on how to protect yourself here: Don’t get sacked!

Beware the false sense of urgency many phishing attacks cause.

The ongoing PayPal attack sends emails camouflaged as ‘unusual activity’ alerts warning you of suspicious logins from unknown devices. This campaign attempts to gather all your credentials and financial info. The newest phishing attack and how it works is explained here.
The following information is taken from the linked site.

PayPal lists the following signs you can look for to identify phishing messages easier:

• Impersonal, generic greetings are used; such as “Dear user” or “Dear [your email address]”
• Asks you to click on links that take you to a fake website
• Contains unknown attachments
• Conveys a false sense of urgency
• “Your account is about to be suspended,” “You’ve been paid,” or “You have been paid too much” warnings

Customers who have spotted a phishing message in their inbox posing as an official email sent by PayPal are asked to report it as soon as possible by forwarding it spoof@paypal.com and to delete it as soon as possible.

As always, the safest way to get to a site is to write the address of the site manually in the web browser or use a previously created bookmark if available to avoid being redirected to sites designed to collect your info or infect your computer with malware.

Having an often used website store your credit card information was a nice feature for a short time. Putting your credit card information into someone else’s hands makes a very attractive target for skimmers. Please consider removing your credit card information on retail sites to help prevent having your card info compromised.

The following information is an excerpt from an in-depth article on the October data breach at Macy’s.

Stored credit card information is now a target

Until now, one common aspect of almost all web skimming attacks was that they targeted the checkout processes because that’s where shoppers input their payment information. Injecting malicious code into a single page instead of the entire website, like is the case with other web-based malware, decreases the chances of the compromise being discovered, but on the other hand, it gave defenders a specific place to monitor and look for web skimming code.

The hackers who compromised Macys.com realized that there are multiple areas in an online shop where users can input card information and not targeting them as well is a wasted opportunity. One of such places is the wallet – an account section where users can configure payment cards to be used without manually inputting them in the future.

The problem is that when displayed in their wallet or when selecting an already stored payment card during checkout, the card numbers are usually masked by the websites and most digits are replaced by asterisks. To overcome this problem, the Magecart skimmer used on Macys.com was designed to hook into the wallet functions that handle editing, adding or removing payment cards.

“The ability for attackers to skim the Macy’s wallet page is a momentous development for web skimming,” the RiskIQ researchers said. “For the longest time, having stored payment information was an effective way of avoiding skimming attacks. The attackers targeting Macy’s took this as a challenge and made their skimmer multifaceted. It is not just a skimmer for a checkout process; it is a skimmer for valuable information, wherever it may be.”

Most people only think of credit card skimmers being a physical device. The article linked here Credit Card Skimmers Found in Counterfeit Shoe Store Pages shows how they’ve been found as software code on sites selling counterfeit designer shoes. The article gets detailed on how this works. If you’re just interested in how to protect your card, the article provides these guidelines:

Here are some tips on how to reduce the risks associated with online shopping:

• Make sure that your computer is malware-free and running the latest patches. Leverage a security product that offers web protection.
• If you are shopping on a site for the first time, check that it looks maintained. While this does not replace a thorough security scan, seeing notes such as “Copyright 2015” may indicate that the website is not really being looked after.
• Minimize how often you enter your credit card data by relying on other payment methods instead. For example, large reliable online retailers, such as Amazon already have your payment details archived into your account. Other safe methods include Apply Pay or prepaid Visa or Mastercards.
• Check your bank/credit card statements regularly to identify potentially fraudulent charges.
• Help prevent further attacks by reporting any fraudulent activity (especially if you were victim) to law enforcement authorities.

It’s human nature to use the shortcuts provided to us. The criminal element is getting better at recognizing that and using it to their advantage.

One of the best things you can do when going to a site where you need to identify yourself, is to type out the URL. Avoid clicking on links in an email or text messages.

If it isn’t already second nature, start building the habit of looking at the URL critically before clicking on a link. Hovering your mouse cursor over a link should show you where the link will take you.

• For the ELGA site, is ELGA spelled correctly?
• Is it where you thought you were going?

Remember: the official URL for the main ELGA website is www.ELGACU.com

If there is anything about the link that feels off to you, don’t click the link and don’t input information about yourself on the site.

Remember that your identity and personal information is valuable and there are those who will try and trick you. Don’t give them the chance.