Security Guides, Written for Members

No single tool stops fraud, but a short stack of habits blocks the overwhelming majority of common attacks. Each layer catches what the previous one misses.

• Unique passwords from a password manager, so one breach never becomes five.
• Two-factor authentication on email and banking, which defeats stolen passwords outright.
• Account alerts for every transaction, so fraud announces itself within minutes.
• Card locks in Digital Banking whenever a card is not in your hand.
• A frozen credit file between loan applications, which blocks new-account fraud cold.
• A ten-second pause before any urgent request for money or codes. Urgency is the scammer's whole strategy.

Move in this order and you contain the damage in an afternoon.

• Call ACU at 253-964-3113 immediately so we can freeze activity and secure your access.
• From a device you trust, change the account password, then the password of the email tied to the account.
• Turn on two-factor authentication as you go.
• Check for changes the intruder made: contact details, payees, linked accounts, forwarding rules.
• Review recent transactions and dispute anything you did not authorize.
• Run a malware scan before you sign in again from the affected device.

Your inbox can reset every other password you own, so a compromised email is a five-alarm event. Work fast.

• Change the email password from a clean device and enable two-factor authentication.
• Check forwarding rules, filters, and recovery addresses. Intruders plant these to keep reading your mail after you lock them out.
• Sign out all sessions and review the account's recent-activity log.
• Change passwords on financial accounts next, starting with Online Banking.
• Warn close contacts; the intruder may impersonate you.
• Watch the account for password-reset emails you did not request. Each one shows where the attacker tried next.

An organized inbox is a safer inbox: less noise means fraud stands out.

• Keep a separate email address for financial accounts, shared with no one and used for nothing else.
• Unsubscribe from what you do not read instead of deleting it forever. Less clutter, fewer look-alike targets.
• Never unsubscribe from obvious spam; that click confirms your address is live. Mark it as spam instead.
• Disable automatic image loading, which tells senders when you open mail.
• Purge old emails holding account numbers or documents; your archive is a filing cabinet for whoever breaks in.

Your Wi-Fi router is the front door for every device you own. Ten minutes of settings closes it to strangers.

• Change the router's admin password. The factory default is printed on a label and listed online.
• Use WPA3 or WPA2 encryption with a strong, unique network password.
• Rename the network so it does not advertise the router brand.
• Keep router firmware updated; enable automatic updates if offered.
• Put guests and smart-home gadgets on a guest network, away from the devices you bank on.
• Turn off WPS and remote administration, two features attackers love.

Mail theft remains one of the oldest and most effective identity crimes. Checks, statements, and preapproved offers are cash to a thief.

• Collect mail daily and use a locking mailbox if you can.
• Never leave outgoing checks in your mailbox with the flag up; that flag signals thieves too.
• Drop sensitive mail inside a post office, and place a hold when traveling.
• Go paperless on statements so account data never rides in a truck.
• Use Informed Delivery from the postal service to see what should arrive, so you notice what does not.
• Shred what you discard. A stolen preapproval offer becomes a credit card in your name.

Data brokers sell your address, phone, relatives, and history to anyone, including scammers building convincing scripts. You can cut the supply.

• Search your name and city to see what brokers publish about you.
• Use the opt-out page on major broker sites; they are legally required to honor removals in many states.
• Consider a reputable removal service to automate the recurring cleanup.
• Tighten social media privacy so profiles stop feeding the brokers fresh data.
• Give businesses the minimum: most forms asking for your birthday or phone number do not need them.
• Expect maintenance. Brokers repopulate, so repeat the sweep yearly.

A wire can sometimes be recalled, but the window is measured in hours, not days. If you just wired money to a scammer, act now.

• Call ACU at 253-964-3113 immediately and say the words "wire recall." Every minute matters.
• Have the details ready: amount, date, destination, and what you were told.
• File with the FBI at ic3.gov the same day; their Recovery Asset Team can freeze funds at the receiving bank.
• File a police report to support the recall and any claims.
• Do not pay anyone who promises to recover the wire for a fee. Recovery scams target fresh victims.

Travel puts your cards, devices, and attention in unfamiliar territory at the same time. Prepare before you pack.

• Turn on transaction alerts and carry a backup card stored separately.
• Avoid public Wi-Fi for banking; use your phone's hotspot instead.
• Use ATMs inside branches or hotels, and shield your PIN. Skimmers favor tourist corridors.
• Place a mail hold and light-timer at home; an overflowing mailbox advertises an empty house.
• Save ACU's numbers before you go: 253-964-3113, and 1-866-767-0811 any hour for cards.
• Pause social posts about the trip until you are home.

In a twist of nerve, criminals now impersonate IC3, the FBI's own Internet Crime Complaint Center, contacting past fraud victims with promises of recovered money.

• IC3 never calls, emails, or messages victims about recovered funds, and never asks for a fee, gift card, or bank login to release money.
• The scam targets people already victimized once, using details from victim lists sold between criminals.
• Any "recovery agent" demanding payment up front is a scammer, no exceptions.
• Real updates on an IC3 complaint come through official correspondence you initiated.
• Report the attempt at ic3.gov, and tell us at 253-964-3113 if money moved.

Every credential scam ends the same way: someone convinced a member to hand over a password or one-time code. The fix is a rule with no exceptions.

• No legitimate caller ever needs your password, PIN, or a one-time passcode. Not ACU, not tech support, not the police.
• One-time codes exist to stop thieves who already have your password. Reading a code to a caller hands them the key.
• Type youracu.org yourself instead of following login links in messages.
• If you shared credentials, change the password now and call us at 253-964-3113.
• Treat "verify your identity by telling me your code" as the confession it is: the caller is the thief.

Online purchase fraud runs from fake stores to sellers who ghost after payment. A few checks separate bargains from bait.

• Deals far below every other seller are the oldest lure on the internet.
• Pay by credit card or digital wallet for dispute rights. Never pay strangers by wire, gift card, crypto, or payment apps.
• Check the web address carefully; fake stores clone real brands with one letter changed.
• New marketplace sellers with stock photos and pressure tactics deserve extra doubt.
• Track packages only through the retailer's own site, not links texted to you.
• If a purchase goes wrong, dispute it quickly; time limits apply.

The phantom hacker is a three-act con. Fake tech support finds a fake virus, a fake bank investigator confirms fake theft, and a fake government agent orders you to move your money to a "safe account." Every actor is the same criminal crew, and the safe account is theirs.

• The opening move is a pop-up, email, or call about a virus or suspicious charge, with a number to call.
• They ask to install remote-access software. That software is the actual hack.
• The word "safe account" is the tell; no bank, credit union, or agency ever asks you to move money to one.
• Targets skew toward older members, and losses are often life savings.
• Hang up, disconnect the computer, and call us at 253-964-3113 before moving a dollar.

Smishing is phishing by text: a package problem, a frozen account, a toll bill, a wrong-number hello. The goal is always a click or a reply.

• Real delivery services and banks do not resolve problems through texted links.
• Do not reply, not even STOP, to obvious scam texts; replies confirm a live number.
• Report junk texts by forwarding to 7726 (SPAM), which helps carriers block the sender.
• The friendly wrong-number text that keeps chatting is the opening of a long-con investment scam.
• A text about your ACU account that asks you to click or share a code is not from us. When unsure, call 253-964-3113.

A romance scammer builds real feelings with a fake person, then converts love into money: an emergency, a plane ticket, an investment. The relationship is the product, and you are paying for it.

• They fall hard fast, but can never video chat or meet; the excuses are endless and elaborate.
• The profile photo is stolen. A reverse image search often proves it in seconds.
• Money requests start small and escalate, always urgent, always with a story.
• Never send money, crypto, gift cards, or your account access to someone you have not met in person.
• Victims are smart people who were targeted with industrial patience. If this is happening, stop sending and call us. No judgment, just help.

Crypto's speed and finality make it the scammer's favorite payment rail. The coins are real; the opportunities usually are not.

• Guaranteed returns do not exist in crypto. Anyone promising them is selling fiction.
• Fake exchanges and wallet apps show balances that were never real, letting small withdrawals bait large deposits.
• Celebrity giveaways that double your coins are theft with a famous face on it.
• No legitimate business or agency demands payment in crypto, ever.
• Crypto ATMs are a red-alert payment method when a caller directs you to one.
• Crypto transactions cannot be reversed. Treat every send like handing over cash.

A convincing fake site takes an afternoon to build and minutes to clone. The pixels can lie; the address bar cannot.

• Read the domain right to left: youracu.org.account-verify.com belongs to account-verify.com, not us.
• The padlock icon means the connection is encrypted, not that the site is honest. Scam sites have padlocks too.
• Reach important sites from your own bookmarks, not from links in messages or ads.
• Look-alike letters fool the eye: rn reads as m, capital I as lowercase l.
• Report fakes to Google Safe Browsing and the FTC, and tell us if the site imitates ACU.

Your phone is your bank branch now, and criminals treat it accordingly: malicious apps, SIM swaps, QR bait, and juice-jacking all target the device in your pocket.

• Install apps only from the official stores, and check the developer name; fakes shadow real banking apps.
• Add a PIN or port-freeze with your carrier to block SIM swapping, which steals your number to intercept codes.
• Treat QR codes in public like unknown links, because that is what they are.
• Keep the OS updated and skip public USB charging ports; use your own block and cable.
• Losing service unexpectedly can signal a SIM swap in progress. Call your carrier fast, then us.

Wire fraud persists because wires are fast, final, and trusted. The defense is a personal policy you set before anyone asks.

• Treat every urgent wire request as fraud until proven otherwise, especially changes to payment instructions.
• Verify new or changed wiring instructions by phone, using a number you already had, not one in the email. This single habit defeats most business and escrow fraud.
• Real title companies, courts, and agencies do not change banks at the last minute by email.
• Family emergencies demanding wires get verified through the family first.
• If a wire already left, see our guide on stopping a wire transfer and call us now at 253-964-3113.