By Ray Birch
SAN DIEGO—Credit unions would be wise not to “phone it in” when it comes to educating members about sneakily sophisticated financial fraud tactics, according to one security expert, who is reminding it is easy to forget even the simplest security lessons that have been around for years.
Jim Stickley, CEO of Stickley on Security, shared that advice in an environment in which it is increasingly easy for fraudsters to mimic the caller IDs of organizations consumers and CU members trust.
“One thing I always tell people is to never, ever look at the caller ID and assume it means anything,” said Stickley. “I know credit unions that I work with provide education to their members, but I cannot speak on behalf of all of credit unions. And if some are not providing good fraud education, they're really doing a disservice to their members.”
As CUToday.info recently reported, for example, Bria Williams, a member of Virginia Credit Union in Richmond, Va., was fooled by a spoofing attack in which crooks called her to steal personal information by falsely representing they were from her credit union.
Williams explained that while she was on the phone call with the fraudster she Googled the phone number on her caller ID to check to see if it was in fact a number from Virginia CU. Itt was.
The crook then verified all Williams’ personal info, including her address and credit card numbers.
“So after (the crook) verified those things, I said, ‘OK, this is a legit call.’”
‘Doesn’t Cut the Mustard’
Stickley acknowledged he sees instances where credit unions provide fraud education, but it is not effective.
“Regulators require credit unions to provide education to their members, but credit unions sometimes phone it in,” Stickley said. “Basically, some put the information on one page on their website that has four or five little things about fraud security, and that's their education. It doesn't cut the mustard.”
Stickley said spoofing a phone number has been a tactic criminals have used for many years, noting they tend to use the fraud approach that best suits the stolen data they have.
“Criminals bounce back and forth all over the place. They’ll do phishing, vishing…,” explained Stickley. “Spoofing a phone number is just one of many arrows in their quiver.”
Stickley said fraudsters typically go to the dark web and download stolen personal data and then decide how to attack.
Jim Stickley
“Maybe this data has credit card numbers and phone numbers and persons’ first and last names,” said Stickley. “Maybe they have a bank or credit union name, as well. Then they decide what they can do with the data. Maybe they don’t have an email address for the person but they’ve got their phone number and their name. So, maybe they go to text message and phone call attacks. That’s what they generally do, make decisions based on the data they have.”
Stickley pointed out how easy it has become from criminals to spoof phone numbers—there are even apps in the Google Play and Apple Store for just this application.
Easy to Victimize Mom
Two years ago, Stickley was on the Today Show and he showed reporter Jeff Rossen how easy it is to spoof someone’s phone number.
“Jeff gave me his mom’s phone number and I called her pretending to be Jeff Rossen,” said Stickley, who spoofed Rossen’s phone number from his cell phone. “I got his mom to give me her Social Security number. It’s really easy to do.”
And it can be a fraud tactic too easily overlooked, said Stickley. He added that even people who should seemingly be informed about phone spoofing sometimes are not, which makes it that much more important credit unions not overlook the fraud practice in their member education.
“There's still probably a ton of people who don't know about this, and this type of attack is just one of many attacks that are out there, which is scary,” said Stickley.