Protecting Yourself from Financial Institution Spoofing

Perhaps it’s happened to you: Your financial institution texted you to verify unauthorized charges made to your account. If your first response is to reply to the sender, you’re not alone — but before you do, it’s important to step back and review the message closely. You may have been targeted in a spoofing attack.

Scam text messages — also known as “smishing” — use SMS messages to “spoof,” or look like, a legitimate source, such as a financial institution or government agency. This type of phishing is on the rise, with consumers reporting $330 million in losses due to text scams in 2022 – double the losses reported in 2021¹.

Bogus bank fraud warnings are the most common type of text message scam, according to the Federal Trade Commission. In this type of scam, a fraudster will send thousands of messages to area codes within a geography served by a bank or credit union such as Patelco. The intent? To collect money or personal information, such as your Social Security number, for possible identity theft.

Would you have known the text below is NOT from Patelco? Read on to learn how you can tell messages like this are fake!

You Can Outsmart Financial Institution Spoofing

No matter what fraudsters do to try and trick you, you can fight back to protect yourself. Here’s how:

1. Check how long the sender’s number is

Text scams usually come from wrong numbers, usually a 10-digit number that looks a lot like a regular phone number. It may even be very similar (or identical) to your financial institution’s actual phone number – this is because fraudsters can spoof numbers. Sometimes scammers also use an email address (which can also be spoofed) or an international phone number.

Check out the image above. See how the number is a regular phone number? Real Patelco fraud prevention messages asking you to verify a transaction always come from a short code, which is five to six digits long, and can only send and receive texts. Real Patelco texts will not come from an email address.

2. Contact Patelco if you’re unsure if it’s us

If you’re ever unsure if you’re being contacted by us or a fraudster, don’t reply. Reach out to us first: call our fraud specialists at 800.358.8228 and enter extension 5323 when prompted.

Calls, texts, and emails can all be made to look like they’re coming from Patelco or other institutions but can be from fraudsters – even if your Caller ID or text message app says it’s from Patelco. Stay alert for anything that seems out of place, and then ask us before responding or taking action.

Your best practice is to only call numbers printed on your card, or numbers you find on patelco.org (this website). And don’t trust an incoming call just because your Caller ID shows one of these numbers.

3. Don’t share your personal information when you didn’t initiate the conversation

Whether by text, email, or phone, Patelco will never call you for personal information like:

• Your online banking password
• One-time Passcodes for transactions, registrations, or logins
• Your card PIN, security code, or full card number

We may call you to verify something, but we won’t ask you for the information above unless you initiate the conversation or request we contact you.

4. Check links before clicking

Another common tactic is faking sites that look like real URLs but are a bit different. Fraudsters may create a URL like patelco.biz or potelco.org that look similar to patelco.org, but they are fake.

We’re constantly working to remove sites like these as they pop up. You can protect yourself by checking links before you click. On a computer, hover your cursor over the link (without clicking) to see the URL. On a mobile device, press and hold to preview the URL before opening it.

We’re here for you

We care about your wellbeing. We encourage you to continue to explore our fraud center to learn about the latest scams, fraud prevention tips, and more resources. Plus, learn how you can keep your money and account safe with a Trusted Contact.