Your Money, Guarded Like It Is Ours

Email is the front door for most fraud, so treat every unexpected message with the same caution you would give a stranger at your actual front door. A safe habit beats a smart filter.

• Check the sender's full address, not the display name. A single swapped letter is a classic tell.
• Hover over links before clicking, and when in doubt, type the address yourself instead.
• Never open attachments you were not expecting, even from people you know.
• Turn on two-factor authentication for your email account itself. Your inbox resets every other password you own.
• ACU will never email you asking for your password, PIN, or a one-time code.

Strong account hygiene stops most attacks before they start. A few settings today protect every dollar you move tomorrow.

• Use a unique password for Online Banking that you use nowhere else, ideally from a password manager.
• Turn on two-factor authentication and account alerts so you hear about activity the moment it happens.
• Lock your cards instantly in Digital Banking when they are not in use, and set spending limits and alerts.
• Review statements monthly and question every transaction you do not recognize, no matter how small. Criminals test with small amounts first.
• Log out of shared devices, and never bank on public Wi-Fi without a trusted VPN.

Your identity is the master key to your finances. Guarding the documents and numbers that prove who you are is cheaper than reclaiming them after a theft.

• Freeze your credit with all three bureaus when you are not actively applying for credit. It is free and reversible.
• Shred documents with account numbers or your Social Security number. Watch for ACU Shred Day events.
• Give out your Social Security number only when legally required, and ask why it is needed.
• Collect mail promptly and place a hold when traveling.
• Monitor your credit reports. Credit monitoring is built into Command Center.

A phone scam works by making you act before you think: an urgent problem, a limited window, a demand for secrecy. Legitimate organizations do none of those things.

• Urgency is the tell. Real institutions never demand action on one phone call.
• Gift cards, wire transfers, and crypto payments are how scammers get paid. No government agency or credit union takes them.
• If a caller claims to be your bank, your utility, or the IRS, hang up and call back on the number printed on your card or bill.
• Never read out a one-time passcode to anyone who called you, for any reason.
• Let unknown numbers go to voicemail. Scammers rarely leave one.

Criminals impersonate the people you trust, and that includes us. Knowing what America's Credit Union will never do is your strongest defense.

• ACU will never call, text, or email asking for your password, full card number, PIN, or a one-time passcode. Ever.
• Caller ID showing our name or number proves nothing. Numbers are trivially faked.
• A real ACU employee will never pressure you to move money to a "safe account." That account belongs to the scammer.
• When in doubt, hang up and call us directly at 253-964-3113, or send a secure message after signing in through Online Banking.
• Report impersonation attempts to us even if you did not fall for them. Your report protects other members.

Social engineering is hacking people instead of computers. The attacker researches you, builds trust or fear, and then asks for the thing they wanted all along.

• Be suspicious of anyone who contacts you first and then asks for information or money, however friendly or official.
• Verify identities through a channel you control: call the published number, walk into the branch, sign in directly.
• Limit what you share publicly. Your pet's name, hometown, and birthday are password-reset answers.
• Slow down. Every social engineering attack depends on speed and emotion.
• It is never rude to say "I will call you back through the main number." Real organizations expect it.

AI tools now let criminals clone a voice from seconds of audio, write flawless phishing emails, and fake video calls. The old advice to watch for bad grammar is obsolete. Verify identity, not polish.

• A cloned voice can sound exactly like your grandchild, spouse, or boss. Agree on a family code word for money requests.
• Hang up and call back on a number you already have. Voice cloning cannot answer your real callback.
• Treat urgent money requests on any channel as unverified until you confirm through a second channel.
• Deepfake video is real. A live video call is no longer proof of identity for financial decisions.
• Perfect spelling and a professional tone mean nothing. Judge requests by what they ask, not how they sound.

Phishing is a fraudulent message dressed up as a legitimate one, designed to steal credentials or install malware. It arrives by email, text (smishing), phone (vishing), or QR code (quishing).

• The hook is always emotion: a package problem, a suspicious login, a refund, a prize.
• The payload is a link or attachment. The link leads to a look-alike login page that harvests what you type.
• Check the domain carefully. youracu-secure.com is not youracu.org.
• Report phishing that uses ACU's name to us, then delete it. Do not reply, and do not click "unsubscribe" in a suspicious message.
• If you clicked and entered anything, change that password immediately and call us.

Most online fraud is preventable with settings you configure once and habits that take seconds. Layer them and you become a hard target.

• Keep your devices and browsers updated. Updates are mostly security patches.
• Use a password manager and two-factor authentication everywhere they are offered.
• Shop only on sites you navigated to yourself, and pay with a credit card or digital wallet for stronger dispute rights.
• Secure your home Wi-Fi with a strong password and current encryption, and change the router's default admin password.
• Back up what matters. Ransomware loses its leverage when your files exist twice.

Scams differ in costume but share a skeleton. If you can answer yes to two or more of these, stop and call us before you send anything.

• Did they contact you first, out of nowhere?
• Is there urgency, a deadline, or a threat if you do not act now?
• Have you been asked to keep it secret from family or your credit union?
• Is payment demanded by gift card, wire, crypto, or a payment app to a stranger?
• Were you asked for a password, PIN, or one-time code?
• Does the deal, job, prize, or relationship feel too good to be true?
• Talking it through with a real person breaks the spell. Call 253-964-3113 or walk into any branch. We have this conversation with members every week.

Pig butchering is a long-con investment scam. A stranger builds a friendship or romance over weeks, introduces a can't-miss crypto or trading platform, lets you win small withdrawals, then takes everything once you invest big.

• It starts with a wrong-number text, a dating app match, or a social media follow that turns unusually attentive.
• The platform they recommend is fake, no matter how professional the app or website looks. The balances on screen are fiction.
• Early "profits" you can withdraw are bait, paid from your own deposits.
• When you try to cash out, they invent taxes and fees to extract even more.
• Never invest through a platform recommended by someone you have never met in person. If this is happening to you, stop sending money and call us. Shame keeps this scam alive; skip it.

Financial exploitation of older adults is the fastest-growing form of elder abuse, and the criminal is often someone the victim knows. Watching for the signs protects parents, grandparents, and neighbors.

• Warning signs: sudden account changes, new "friends" involved in finances, unpaid bills despite adequate income, secrecy or fear around money, and gift card purchases in bulk.
• Common schemes: grandparent emergencies, romance scams, fake sweepstakes, tech support fraud, and abuse of powers of attorney.
• Set up account alerts and, where appropriate, a trusted contact on the account.
• Talk about scams openly. Targets who have heard the script hang up sooner.
• If you suspect exploitation of an ACU member, call us at 253-964-3113. Our staff are trained to spot it, and we can act to protect the account. Also report to Adult Protective Services.

Caller ID spoofing lets scammers display any number they want, including ACU's. You cannot trust the screen, but you can shrink the flood and neutralize what gets through.

• Never trust caller ID for identity. Verify by hanging up and calling the published number yourself.
• Enable your carrier's spam-call filtering. All major carriers offer free tools.
• Silence unknown callers on your phone. Real callers leave voicemail.
• Register at donotcall.gov. Legitimate telemarketers respect it, which makes the rest easier to spot.
• Do not press numbers or say "yes" to robocalls. Interaction marks your number as live and invites more.

The call comes at night: a grandchild in jail, a child in an accident, a relative stranded abroad. The voice may even sound right, thanks to AI cloning. The script demands money now and silence always.

• Secrecy is the confession. "Do not tell Mom" means it is a scam.
• Hang up and call the family member directly on their known number, or call another relative to verify.
• Ask a question only the real person could answer, or use your family code word.
• No real emergency is paid in gift cards, wire transfers, or crypto.
• Courts, hospitals, and police never call demanding immediate payment by phone.