Financial Impersonation Scams
Protecting Your Accounts From Impersonation Scams
At Cy-Fair Federal Credit Union, protecting your accounts and personal information is one of our highest priorities.
Impersonation and social engineering scam attempts have increased significantly across the financial industry, with every bank and credit union seeing more members and customers targeted. Their goal is to get you to reveal account information or to send or transfer money. This communication explains what is happening, what to watch for, and how you can stay protected.
How We Protect Your Account Information
First, we want to reassure our members that receiving a message from someone impersonating our credit union does not mean that Cy-Fair FCU’s systems have been hacked. Cy-Fair Federal Credit Union has not experienced a data breach. Additionally, receiving one of these messages does not mean your account has been accessed.
Protecting your information is central to everything we do. Cy-Fair FCU uses multiple layers of security, supported by strict policies and ongoing monitoring, to safeguard member accounts and data. We continually review and strengthen these protections as threats evolve.
How Scammers Get Your Information
The truth is that a lot of our personal information is already out there in some form. Personal information, including your name, phone number, address, and even which financial institution you use, can come from other sources that have nothing to do with Cy-Fair FCU, including:
Public Sources: Property records, voter files and similar listings, even social media.
Data Brokers: These companies collect and sell personal profiles built from public records, purchase histories, loyalty programs, and information gathered through websites and apps. Brokers do not operate on the dark web, but this data can eventually flow into the same pools of information.
Data Breaches at Other Companies: Many retailers and service providers have information on you, including your name, address, contact information, and even which financial institution you use to make payments to them. When they experience a data breach, the information can be sold or traded on criminal marketplaces, including the dark web.
Apps and Websites. Many free apps and sites share usage and device information with advertisers and analytics companies, and some of that ends up in broker profiles. Reviewing app permissions is worth the few minutes it takes.
The simplest, most effective fraud today is not breaking into financial systems. Instead, criminals use whatever basic information they can find about their targets and leverage that information to persuade people to hand over what the criminal needs. This is known as social engineering, and the best layer of defense against this is your awareness.
What Social Engineering Is and How It Works
Social engineering is the use of deception and psychological manipulation, rather than technical hacking, to trick a person into giving up information or taking an action. Instead of breaking into a system, the scammer persuades you to open the door.
A typical financial impersonation scam follows a pattern:
Contact. A text, email, or call claims to be your financial institution's fraud team, warning of suspicious activity.
Pressure. You are told to act immediately, or your money or account will be at risk.
The ask. You are asked to confirm account details, share a one-time verification code, click a link, install an app, or move money to a "safe account."
The theft. A verification code is often the last piece criminals need to approve login access to your account or a payment.
How AI is Changing These Scams
Artificial intelligence has made scams faster, cheaper and more convincing. Here are some examples:
Faster access to data. AI tools can quickly sort and match scraps of leaked and public information into a target list with the needed details to be convincing.
Polished messages at scale. Texts and emails can be generated in bulk, without the spelling and grammar mistakes that used to give scams away.
Convincing interactions. A call can use a voice that sounds familiar or trustworthy. Additionally, AI-powered chatbots can interact and carry out personalized, convincing conversations.
Spoofed caller ID. Criminals can make a call appear to come from a bank's real phone number and include the name. The FCC has cautioned that caller ID cannot be relied on to prove who is calling.
The Scammer's Most Powerful Tool Is Urgency
Although the technology they use is becoming more sophisticated, the goal is still to gain your trust and create a sense of urgency to persuade you to reveal information.
Be especially cautious if someone tells you:
Your account has been compromised and you must act immediately.
You need to provide your online banking username, password, PIN, or security code.
You must read back a verification code sent to your phone.
You need to move money to another account to "protect" it.
You need to send money through a payment app, wire transfer, cryptocurrency, or gift card.
You need to withdraw cash and give it to a courier.
Pressure and urgency are classic signs of impersonation fraud. The FTC specifically warns that scammers may pressure victims to act immediately and may tell them not to hang up so the victim cannot independently verify the story.
How to Know If It Is Cy-Fair FCU
Cy-Fair FCU will never initiate a call, text, or email asking you to provide your account number, login credentials, PIN, or verification code, or asking you to screen-share or move money. Nor will we pressure you to stay on the line or take specific action you don’t feel comfortable with.
How to Protect Yourself
Hang up and contact us independently. If a call, text, or email claims to be from us or any financial institution, end the contact and call the number you find on a trusted source, such as our official website. Do not use the number the caller or message gives you, and do not trust caller ID.
Never share a verification code. A code sent to your phone is for you alone. No legitimate caller needs it.
Never move money because someone called and told you to do so to "protect" it. The FTC states that anyone who says you must move your money to keep it safe is a scammer.
Do not click links or open attachments in unexpected messages. Go to our official app or website directly instead.
Slow down and resist pressure. Be suspicious of anyone insisting you need to take immediate action. Urgency is the scammer's main tool. A real issue will still be there after you hang up and verify.
Use a unique password for every account, ideally with a password manager, and turn on multi-factor authentication wherever it is offered.
Never grant remote access or install software because someone on a call or in a message asked you to.
Limit what you share publicly. Personal details help scammers build a convincing story.
Watch your accounts. Review your transactions regularly and turn on account alerts.
Consider a credit freeze. It is free and makes it harder for criminals to open accounts in your name.
If you receive a suspicious call, text, or email…
Do not respond, click, or call back using anything in the message.
Hang up. If you are worried, contact us directly through our official app or website.
Report it. Forward scam texts to 7726 (SPAM). Forward phishing emails to reportphishing@apwg.org. You can also report to the FTC at ReportFraud.ftc.gov and to the FBI at IC3.gov.
If You Shared Information or Sent Money, Contact Us Immediately
If you have disclosed account details, shared a verification code, approved an unfamiliar request, or sent money, contact Cy-Fair FCU immediately. We can help assess what happened and take appropriate steps to protect your account.
Save relevant messages and transaction details. You can also report scams at ReportFraud.ftc.gov or IC3.gov.
If personal information was misused, visit IdentityTheft.gov for recovery guidance.
When in Doubt, Pause and Call Us.
Today's scams can look remarkably legitimate. A text can resemble a real fraud alert. A caller ID can display a familiar number. An email can contain an organization's logo. And a voice on the phone can sound completely convincing.
If something doesn't feel right, stop the conversation and contact us yourself. A legitimate representative will understand why you want to independently verify the situation.
Additional Resources
Your security remains a top priority of the credit union, with a commitment to investing in technology, fraud prevention, and education to help protect you in an increasingly complex digital world.
Thank you for being a member of Cy-Fair Federal Credit Union.