Criminals on Phishing Expedition in NCUA's Virtual Waters

ALEXANDRIA, Va.-Phishing scammers hit NCUA’s Web site last week, the agency warned the credit union community. NCUA sent out an alert last Monday that the agency had been the victim of a phishing scam in which e-mails that appear to be from NCUA were sent to the general public and credit union members. The e-mail provides a link to verify account registration at a false Web site and asked for the recipient’s credit union account number and PIN. “If you responded to such an e-mail and provided any confidential account information, please notify your credit union immediately of the scheme,” NCUA warned consumers. “You should also change your account’s PIN, and take any additional action recommended by your credit union to protect your account.” NCUA has a three-pronged approach in place for responding to these types of scams, according to NCUA Director of External Affairs Nicholas Owens. Within hours of learning of the scam, NCUA alerted the credit union community through its Web site and sent a notice out to staff, state supervisory authorities, and credit unions, which were also picked up by the press. Then, the agency acted to shut down the scam by alerting the service provider, which quickly pulled the site. Finally, NCUA is gathering as much evidence as it can and has referred the scheme to law enforcement, Owens said. NCUA Region I was alerted to the scam Monday by a credit union official who had forwarded the illegitimate e-mail to the regional office. The alert the agency issued noted “multiple phishing scams.” Owens explained, “At this point, we are not sure [if there is one or more perpetrators]. It does appear that some members of a particular CU received the phishing e-mail. In addition, non-CU members received the same e-mail. Our initial belief is that the recipients of this e-mail visited a common, non-CU Web site. The e-mails appear to be similar and both directed the recipients to the same Web site, which has now been shut down.” More information is available at http://www.cybercrime.gov or contact the NCUA Fraud Hotline at 1-800-827-9650. “Tracking and defeating this sort of crime is very difficult,” Owens said. “The agency is still examining the various tools available to it. In addition, NCUA has alerted the law enforcement agencies with responsibility for investigating and prosecuting Internet crimes such as this scam.” He added that the agency is not aware of anyone losing money yet from the scam or having even responded to the e-mail. A few months ago, CUNA also alerted the credit union community that its Web site had been faked. According to CUNA Vice President of Web Services Dorothy Steffens, she had not heard of anyone losing money in that situation either, probably because of a quick response from the organization. However, no one was ever apprehended either. [email protected]