FBI Warns of Bank Fraud Smishing Campaign

FBI Warns of Bank Fraud Phishing CampaignThe FBI has warned of a smishing campaign that’s targeting people in the US with phony bank fraud notifications. The text messages inform users that someone has attempted to initiate a money transfer on their account.

“The actors—who typically speak English without a discernible accent—then call the victim from a number which appears to match the financial institution's legitimate 1-800 support number, and claim to represent the institution's fraud department,” the FBI says. “Once the actor establishes credibility, they walk the victim through the various steps needed to "reverse" the fake instant payment transaction referenced in the text message. In these schemes, background information on the victims appears to have been well researched. In addition to knowing the victim's financial institution, the actors often had further information such as the victim's past addresses, social security number, and the last four digits of their bank accounts. This information was used to convince customers that the steps being requested of them were the financial institution's legitimate process for retrieving stolen funds.”

The Bureau offers the following advice to help people avoid falling for this scam:

  • “Be wary of unsolicited requests to verify account information. Cyber actors can use email addresses and phone numbers which may then appear to come from a legitimate financial institution. If a call or text is received regarding possible fraud or unauthorized transfers, do not respond directly.
  • “If an unsolicited request to verify account information is received, contact the financial institution's fraud department through verified telephone numbers and email addresses on official bank websites or documentation, not through those provided in texts or emails.
  • “Enable Multi Factor Authentication (MFA) for all financial accounts, and do not provide MFA codes or passwords to anyone over the phone.
  • “Understand financial institutions will not ask customers to transfer funds between accounts in order to help prevent fraud.
  • “Be skeptical of callers that provide personally identifiable information, such as social security numbers and past addresses, as proof of their legitimacy. The proliferation of large-scale data breaches over the last decade has supplied criminals with enormous amounts of personal data, which may be used repeatedly in a variety of scams and frauds.”

New-school security awareness training can teach your employees to recognize social engineering attacks.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews