Imagine your surprise: You grab your morning coffee, settle in at your desk, log in to your credit union account, and\u2026. Wait; what? Someone\u2014not you\u2014has cleaned it out.<\/p>\n\n\n\n
A scam known as \u201caccount takeover<\/strong>\u201d fraud is on the rise, and there are a few things you can watch out for to try to keep it from happening to you.<\/p>\n\n\n\n What it is.<\/strong> The account takeover scam involves theft of your login usernames and passwords<\/strong> with the intent to access, and then take over, your account. By impersonating you online, the scammers can use your account as they wish, which usually means taking the money out for themselves.<\/p>\n\n\n\n (This scam is also used to take over a person\u2019s email and social media accounts, usually as a preliminary step to later get control of their financial accounts.)<\/p>\n\n\n\n How it works.<\/strong> This scam usually begins with the fraudster calling, texting, or emailing you and claiming to be an employee of your credit union, bank, or other business where you have an account. The caller may already have certain personal details about you, such as the last four digits of a card number, the names of others on your account, a partial Social Security number, or your phone number or address.<\/p>\n\n\n\n The information they have can make them seem like a legitimate representative, but don\u2019t be fooled.<\/p>\n\n\n\n The scammer\u2019s next step is to ask you about questionable transactions<\/strong> on your account. When you say the transactions aren\u2019t yours, they say they need to verify some details in order to freeze the card or account and prevent a theft.<\/p>\n\n\n\n They may ask you for your online banking user ID<\/strong> to \u201cverify your identity.\u201d Once they have your user ID, they\u2019ll enter it and use the \u201cforgot password\u201d option to reset your password, usually while they still have you on the phone. If you have two-factor authorization set up, your bank will send you an automatic verification code; the caller will ask for that code<\/strong>, implying that they<\/em> sent to you.<\/p>\n\n\n\n That\u2019s all it takes.<\/strong> Now the scammer has your user ID, a new password that you don\u2019t know, and full access to your account. Your money won\u2019t stay in that account for long. What\u2019s worse is that the cybercriminals may also attempt \u201ccredential stuffing,\u201d where the login and password from one site are used to try to log in to accounts elsewhere.<\/p>\n\n\n\n Protect yourself.<\/strong> Some risk factors for account takeover and other types of identity theft are out of your control. For example, you may be the victim of a data breach, or your information might have been posted to the dark web. But there are some steps you can take to decrease the risk:<\/p>\n\n\n\n