CUISPA released an alert, today, to credit unions informing them of a new fraud targeting home equity lines of credit. CUISPA is asking all credit unions to immediately notify their call center reps of this scam. Starting in December credit unions began identifying suspect attempts to wire transfer money from member owned HELOC accounts.

The fraudsters make the wire requests by phone armed with extensive personal information for verification purposes, including all necessary authentication information, most recent transactions, family member names, account information, address, phone, etc. Additionally, the fraudsters are requesting phone line forwarding from the phone companies to circumvent “call-back” procedures. Average attempts on the transfers range between $70k and $900K.

“We began receiving notification of this scam from members on New Year’s Eve,” says Kelly Dowell, CUISPA Executive Director. “After polling our constituents, we heard that some started receiving these attempts in November. Although, the frequency accelerated around Christmas. At this point the FBI and Secret Service have been notified and have open cases.”

We speculate at least some of the information necessary to perform these attacks is coming from public land records providing details about the HELOC accounts, credit lines, and signature samples. Additionally, the perpetrator(s) are making multiple calls into the institution’s call center asking for basic information like account balances, in an effort to verify the authentication procedures of the institution. In most cases the perpetrator is ordering a credit report on the account holder within 24 hours of attempting the transfer. With proper signature, the wire transfer requests are faxed in or called into the credit union. In some occurrences even the fax header uses the account holders actual home phone number. Call back verification is being circumvented by (the fraudsters) transferring/forwarding the account holders secure phone number to an alternate number answered by the fraudster. Call Id systems are being spoofed to show the account holders secure phone number.

It is strongly recommended that all member-facing employees be notified of this scam and to be cautious of giving out account specific information that would not be public. Precautions for future wire transfers should include checking for recent changes to phone number(s) and address changes for any HELOC and using your CU security verification question procedures. Be aware of calls from member who do not perform many transactions. Listen for pauses in conversations and red flag calls where the person appears to be looking for verification answers. Requests for address or phone number changes should be considered suspect.

CUISPA is in the process of scheduling a Webcast to educate institutions on this scam. For more information logon to www.cuispa.org and click on events.