The Federal Bureau of Investigation has issued an alert related to cybercriminals and scammers using fraudulent bank fraud alerts via text messages to initiate contact with potential victims.
Victims report the contact starts with a text message below, or a similar message:
Free Msg- (Insert financial institution name here) Bank Fraud Alert- Did You Attempt an Instant Payment in the amount of $5,000.00? REPLY YES or NO or 1 To STOP ALERTS
The payment amount and name of the financial institution changes based on the victim.
When the victim responds to the text message, they receive a response that a fraud specialist will be in touch. That call comes from a number that appears to match the financial institution’s legitimate 1-800 support number, and claim to represent the institution’s fraud department. The callers often speak English, many without an easily discernable accent.
After the caller establishes credibility, the victim is led through the various steps needed to “reverse” the fake instant payment transaction referenced in the text message. The scammers often lead victims to processing payment with an app tied to the bank account.
These schemes are often backed by significant data including name, financial institution, victim’s past addresses, social security number, and the last four digits of their bank accounts. This information was used to convince customers that the steps being requested of them were the financial institution’s legitimate process for retrieving stolen funds.
Using the bank’s legitimate website or application, the actor instructs the victim to remove their email address from their digital payment app. The actor, after asking for the victim’s email address, adds it to a bank account controlled by the actor. After the email address has been changed, the actor tells the victim to start another instant payment transaction to themselves that will cancel or reverse the original fraudulent payment attempt.
Believing they are sending the transaction to themselves, the victims are in fact sending instant payment transactions from their bank account to the actor-controlled bank account. In many cases, the cyber actors engaged with victims for several days. Victims often only realized they had been scammed after they checked their financial account’s balance.
The FBI recommends the following:
- Be wary of unsolicited requests to verify account information. Cyber actors can use email addresses and phone numbers which may then appear to come from a legitimate financial institution. If a call or text is received regarding possible fraud or unauthorized transfers, do not respond directly.
- If an unsolicited request to verify account information is received, contact the financial institution’s fraud department through verified telephone numbers and email addresses on official bank websites or documentation, not through those provided in texts or emails.
- Enable Multi Factor Authentication (MFA) for all financial accounts, and do not provide MFA codes or passwords to anyone over the phone.
- Understand financial institutions will not ask customers to transfer funds between accounts in order to help prevent fraud.
- Be skeptical of callers that provide personally identifiable information, such as social security numbers and past addresses, as proof of their legitimacy. The proliferation of large-scale data breaches over the last decade has supplied criminals with enormous amounts of personal data, which may be used repeatedly in a variety of scams and frauds.
