When Someone Claims to Be Your Credit Union
Imposter scams are the most reported fraud in the country, and the most convincing ones already know something about you. Here is what the real institutions actually do.
Why This One Works
An imposter scam borrows trust you have already given to someone else. You do not have to be persuaded that your credit union matters or that the IRS can cause you trouble. That part is done, so the scammer only has to be plausible for a few minutes.
Caller ID can be spoofed to display any name or number, including your credit union's real one. A text can land in the same thread as genuine alerts, because threads are grouped by the sender ID being imitated. An email can copy branding exactly. None of these are signs of legitimacy, and all of them feel like it.
Your name, the last four digits of a card, your address, where you bank, a recent purchase. Data breaches make all of it purchasable. Knowing a detail proves nothing about who is calling, and an opening line built from real information is a technique rather than a credential.
What Your Credit Union Will Never Do
A short list, worth knowing exactly:
- Ask you to move money to keep it safe. Not to a "secure account", not to a new account, not to a wallet. They can freeze and block from their side.
- Ask for your full card number, PIN, online banking password, or the one-time code they just texted you. They do not need any of them. The code in particular is the whole lock: reading it out hands over the account.
- Ask you to buy gift cards for anything, ever.
- Send someone to your home for cash, cards or documents.
- Refuse to let you call back. A real employee expects it and will wait.
- Ask you to install software so they can "see the problem" on your computer.
Anything on that list ends the conversation. Not "makes you cautious": ends it.
The One-Time Code Is the Account
This deserves its own section because it is where most account takeovers now happen.
The scammer has your username and password, from a breach or a fake login page. What stops them is the code texted to your phone. So they call, claim to be fraud prevention, say they are verifying your identity, and ask you to read back the code they have just triggered by attempting to log in as you.
The code arrives from the real institution and the message usually says plainly that nobody will ever ask for it. Read it out and you have completed their login. Never say a verification code aloud or type it into anything except the screen that requested it.
The Other Common Costumes
Government
The IRS, Social Security, the police, immigration. Real agencies generally initiate contact by mail, do not threaten immediate arrest by phone, and never take payment in gift cards or cryptocurrency. Threat of arrest over the phone is close to a definitive tell.
Tech support
A pop-up warns your computer is infected and gives a number. The number is the scam; the pop-up is just a web page. Real security software does not display a phone number and no legitimate company cold-calls about a virus. The goal is remote access to your machine while you are logged into your bank.
Utilities
Power will be cut off within the hour unless you pay now, usually by prepaid card. Utilities send written notice and offer payment plans; they do not dispatch collections by phone with a thirty-minute deadline.
Family
A grandchild in jail, in hospital, stranded abroad, needing money quietly. Voice cloning has made these considerably more convincing, and a few seconds of audio from anywhere public is enough. Agree a question with your family that only they could answer, and use it.
Employers and recruiters
A job offer with an upfront payment for equipment, or a first task involving depositing a check and forwarding part of it. The check is fake, clears provisionally, and is reversed after you have sent real money.
After someone is defrauded, they are often contacted by a "recovery service", a law firm or an agency offering to get the money back for an upfront fee. Victim lists circulate among scammers, so a second approach is common rather than bad luck. Nobody legitimate charges you in advance to recover stolen funds.
What to Do Instead, Every Time
- Hang up. You do not owe a cold caller politeness, and ending the call is not rude.
- Do not use any number they gave you. Not in the call, the text, the email or the pop-up.
- Find the number yourself on your card, your statement, or the institution's own site.
- Ask directly: "Someone just called claiming to be you. Is there anything on my account?" It takes one minute and settles it.
- Report the attempt even though nothing was lost. It is how patterns get spotted.
If you are ever unsure mid-conversation, that uncertainty is itself the answer. Real institutions are entirely comfortable with you ending the call and reaching them another way.
If something does not look right on your account, reach KCCU directly: contact KCCU, or use the number on your card.