Consumer Credit Collector News - Return to Menu

E-mail scam targets MSU credit union members

By MARGARET HARDING

The State News

Some MSU Federal Credit Union users could return from spring break to find their bank accounts suspiciously lighter, if they responded to a fraudulent e-mail before they left.

On March 3, credit union officials reported a "phishing" attack had hit the bank. A phishing attack is when a fake e-mail looks as if it's sent from a credible source requesting personal information from recipients. Phishers then use the information to gain access to accounts. A phishing e-mail that seemed to have been created by the credit union was sent to account holders and asked for verification of account numbers, personal identification numbers and credit card numbers.

About 20 account holders called the bank after receiving the e-mails to ask if they should respond. Credit union officials said the e-mail was fraudulent and was created by "phishers," who send e-mails requesting the verification of personal information.

The e-mails trick some people into releasing their account numbers because the mail seems to be sent from a credible source, such as a bank or eBay, said Rich Wiggins, senior technologist for Academic Computing & Network Services.

"The e-mail looks legitimate and will have a direct link to something that looks like eBay, but it goes to their Web site where it captures the information," Wiggins said.

At least five people responded to the e-mails, said Joyce Banish, vice president of marketing for the credit union, but it is unknown if there have been any thefts yet.

"We wouldn't know until people looked at their statements at the end of the month," Banish said. "I don't think there have been, but it is possible. Some of our members may not have recognized that they gave out this information to a fraudulent source, so we won't know until funds are taken out of their account."

The e-mail directed users to a Web site hosted by a company in Chicago, which has been removed. The FBI, the MSU Police and the Federal Trade Commission have all been notified, but Banish said it is unlikely the phisher will be caught because she has never heard of one being prosecuted or arrested.

Phishers can buy e-mail addresses or find them from online directories, Banish said. Phishers randomly send their e-mails to all the addresses they can find, and hope some of the recipients have accounts with the bank or business the phishers claim to be from.

"They send out thousands of e-mails from a bank and maybe 5 percent are actually customers," Banish said. "That can be enough to make money."

The credit union sent out an e-mail to all account holders warning about the attack and included tips to help recognize signs that an e-mail could be fake, such as misspelling names and the incorrect use of product names.

Brandon Chaison, a material science engineering freshman, said he received several "phishing" e-mails, but recognized them for what they were.

"I just deleted them because usually, they're supposed to contact you personally," Chaison said. "I know whenever something goes wrong - like when I lost my ATM card - the bank either will send me something in the mail or call me."

Anyone who responded to the e-mails should contact the credit union immediately, Banish said.

Staff writer Rashad L. Jackson contributed to this report.