Fraud Alert: How to Spot Scammers Posing as America's Credit Union

Fraudsters are contacting America's Credit Union members and pretending to be ACU. We have seen more of these scams recently, and they work because the message sounds like help.

ACU will never ask for your online banking password. We ask for a one-time passcode only when you are expecting to hear from us: when you call us, or when our wire team calls to confirm a wire you requested. If a passcode request comes out of nowhere, treat it as a scam, even if the call, text, or email looks like it came from us.

What the scam looks like

A member gets a phone call, text message, or email saying there is suspicious activity on their account. The message is built to feel urgent. The person on the other end then asks the member to confirm account information, share login credentials, install remote access software, or let them "help" with online banking.

Once a fraudster has access, they move fast. We have seen large transfers out of members' accounts, followed by ATM withdrawals, gift card purchases, casino spending, and other online purchases. These often start late on a Friday and run through the weekend.

Fraudsters can spoof phone numbers, emails, and text messages, which means they can make a call or message look like it came from ACU. The name or number on your screen does not prove who is contacting you.

What ACU will never ask you for

ACU will never call, text, or email you and ask you to:

• Give us your online banking username or password.
• Provide your debit card number, PIN, or full account number.
• Allow remote access to your computer, tablet, or mobile device.
• Share a one-time passcode for something you did not request.

One-time passcodes: when to expect a request

A one-time passcode is a security tool that verifies your identity. It is sent to your phone or email so that we can confirm you are the person we are talking to.

When a passcode request is expected

ACU may ask you to read a passcode to us in two situations:

• You call us. If you call our member contact center at 253-964-3113 or 866-968-7128, we may send a passcode to your phone and ask you to read it to the representative.
• You asked us to send a wire. Our wire team may call to confirm the wire and send a passcode to your phone during that call. You started the request, so you should be expecting the call.

When a passcode request is a red flag

Any other request for a passcode is a warning sign. If someone calls, texts, or emails you about something you did not start, such as suspicious activity on your account or a wire you never requested, and asks you to read a code back to them, they are trying to verify themselves as you. Sharing it may allow a fraudster to get into your accounts. That is true even if the caller says they are from ACU, and even if a passcode just arrived on your phone.

If a passcode arrives that you did not request, do not share it with anyone. Someone may be trying to get into your account.

If you are unsure, call us back

You can always hang up and call us at the number on our website, even on a call you were expecting, including one from our wire team. We would rather you check.

Ask yourself one question: was I expecting this? If you called us or asked us to send a wire, a passcode request is expected. If it comes out of nowhere, hang up and call us.

How to protect yourself

• Never share your online banking credentials with anyone.
• Never give a one-time passcode to someone who contacts you unexpectedly, even if they say they are from ACU.
• Be cautious with unexpected calls, texts, and emails that ask for personal information.
• Do not click links in messages you did not ask for.
• Do not install software or apps because someone on an unexpected call tells you to.
• If a caller says they are from ACU and asks for sensitive information, hang up and contact us directly. Use the number on our website or on the back of your debit card, not a number the caller gives you.
• Turn on account alerts so you can spot unauthorized activity quickly.
• Review your account transactions regularly and report anything suspicious right away.

More guides on phone scams, impersonation, and account security are in our Security Center.

If you think you have been targeted

If you shared a password, a passcode, or card details, or you let someone connect to your device, call us right away at 253-964-3113 or 866-968-7128. Phone lines are open Monday through Friday, 8 a.m. to 6 p.m., and Saturday, 9 a.m. to 4 p.m. Our Help Center lists other ways to reach us.

If a card is involved, call our 24/7 card line at 1-866-767-0811 at any hour, and lock your cards instantly in Digital Banking.

Then change your online banking password from a device you trust and review your recent transactions. Tell us about anything you do not recognize.

Our Report Fraud and Identity Theft page has the right form and next step for each type of fraud, and the post-scam recovery checklist walks through what to do afterward.

When in doubt, contact us

If something does not feel right, trust that feeling and hang up. Call us at the number on our website or the back of your debit card. A number you looked up yourself is the only one you can be sure belongs to us.

Stop. Think. Verify. Never share your password, and never share a one-time passcode with anyone you were not expecting to hear from.