Who's Hiding Behind the Mask: The Fright Files Case #004

The Case of the Digital Imposters

Not every monster wears a frightening disguise. Some hide behind familiar logos, friendly messages, and phone numbers that look surprisingly legitimate. 

Cyber criminals have become masters of disguise, impersonating financial institutions, trusted businesses, government agencies, and even people you know. Their goal? To trick you into handing over your money, passwords, or personal information before you realize who's really behind the mask.

This Cyber Security Awareness Month, InRoads Credit Union is opening another installment of The Fright Files to investigate phishing and impersonation scams, expose their favorite tricks, and uncover the clues that can help you recognize a digital imposter.    

 

The Suspect: A Scammer in Disguise

Phishing is a type of scam in which criminals impersonate a trusted person or organization to steal sensitive information or money. These attempts can arrive through emails, text messages (known as smishing), phone calls (known as vishing), or social media.

Imagine receiving a text message that appears to come from your credit union. It warns that suspicious activity has been detected on your account and urges you to click a link immediately.

The logo looks familiar. The message sounds official. There's even a warning that your account could be frozen if you don't respond.

But behind that convincing disguise could be a scammer waiting to steal your login credentials.

Criminals can even manipulate caller ID information to make an incoming call appear to originate from a trusted organization. That's why recognizing a familiar name or phone number isn't enough to establish that a message is legitimate.

Learn more about these deceptive tactics in the FTC's guide to recognizing and avoiding phishing scams.   

 

The Evidence: Five Clues That Can Expose an Imposter

Scammers may be clever, but their messages often contain clues that something isn't quite right. Before responding to an unexpected request, put on your detective hat and look for these five warning signs.

Clue #1: The Unexpected Message

A mysterious message arrives out of nowhere, claiming there's a problem with your account, an undelivered package, or an unpaid bill.

It may appear to come from a company you recognize, but that doesn't mean it's legitimate.

Be particularly cautious of unexpected messages containing links, attachments, or requests for personal information.

Investigator's tip: Instead of clicking the link, open the company's official app or type its website address directly into your browser. 

Clue #2: The Frightening Ultimatum

Your account will be locked! Your money is at risk! You must act immediately!

Sound familiar?

Scammers frequently create a false sense of urgency to pressure you into making decisions before you've had time to investigate.

They may threaten account suspension, financial penalties, or legal consequences if you don't respond right away.

Investigator's tip: Don't let frightening warnings rush you into action. Contact the organization independently to verify the claim. 

Clue #3: The Suspicious Disguise

A familiar company logo doesn't guarantee that a message is authentic.

Cyber criminals can create convincing copies of legitimate emails and websites. They may also use misleading website addresses or impersonate trusted phone numbers.

Watch for unusual sender addresses, unexpected links, and website addresses that don't match the organization they claim to represent.

However, remember that sophisticated scams may contain perfect spelling, professional graphics, and convincing language.

Investigator's tip: Don't rely on appearances alone. Verify unexpected communications using contact information you've obtained independently. 

Clue #4: The Request for Your Digital Keys

A scammer posing as a representative from your financial institution may claim they need your password, account information, or a verification code to resolve a security issue.

That verification code is especially valuable. If a criminal has already obtained your password, they may need only that additional code to access your account.

Some scammers even attempt to convince victims to approve unexpected multi-factor authentication requests.

Investigator's tip: Never share passwords or unexpected verification codes with someone who contacts you. If you receive a login approval request you didn't initiate, deny it.

Clue #5: The Disappearing Act 

One of the most frightening clues is an unexpected demand for money.

A scammer might impersonate a family member experiencing an emergency, a government official demanding payment, or a representative claiming your money needs to be transferred to a supposedly secure account.

They may request payment through gift cards, cryptocurrency, wire transfers, or payment apps, making stolen funds difficult to recover.

Investigator's tip: Never move money to another account based on an unexpected call or message. Verify the situation independently before sending anything.

 

The Investigator's Toolkit: Stop. Investigate. Verify.

Now that you've examined the evidence, it's time to put your detective skills to work. These three simple actions can help you avoid falling for an imposter's tricks.

STOP

Don't click suspicious links, open unexpected attachments, or share sensitive information. Take your time, especially when a message is designed to frighten you into acting immediately.

INVESTIGATE

Look for suspicious details, unusual requests, and pressure tactics. Remember that even professional-looking messages and familiar phone numbers can be faked.

VERIFY 

Contact the person or organization directly using a trusted phone number, official app, or website you've located independently. Never use the contact information provided in a suspicious message.

For additional clues, explore the FTC's guide to avoiding imposter scams.

 

A Frightening Discovery: What If You've Already Been Tricked?

Sometimes, the disguise is convincing enough to fool even a cautious investigator. If you suspect you've shared sensitive information or sent money to a scammer, acting quickly may help limit the damage.

Contact your financial institution immediately if you've disclosed account information or made a suspicious payment. Change compromised passwords, enable multi-factor authentication, and review your accounts for unauthorized activity.

If you've shared personal information that could be used for identity theft, visit IdentityTheft.gov for a personalized recovery plan. You can also report the incident at ReportFraud.ftc.gov. 

 

Case Closed: Don't Let the Imposters Fool You!

Scammers may change their costumes, but their tricks often follow familiar patterns: unexpected messages, frightening warnings, requests for sensitive information, and pressure to act before you've had time to think.

Remember, when something seems suspicious, stop, investigate, and verify before taking action.

As Cyber Security Awareness Month draws to a close, there's still one final Fright File waiting to be opened. Join InRoads Credit Union for our final investigation as we revisit the clues uncovered throughout the month and put your cyber security knowledge to the test.

Stay suspicious of unexpected requests. Keep your digital keys secure. And never trust a stranger hiding behind a familiar mask!