Vermonters look out for one another. Vermonters look out for one another. That sense of trust is part of what makes our communities strong, but it can also be exploited by criminals who impersonate someone you know or trust.
Maybe you’re standing in line at the grocery store when your phone lights up. The text looks to be from Vermont Federal Credit Union and says there’s a problem with your account. Before you tap the link or reply with your card information, pause. That quick decision is what social engineering is designed to influence, using pressure to get personal and financial information.
The best defense against social engineering is to pause, recognize the warning signs, and verify a request through a trusted source before you take action.
What Is Social Engineering?
Social engineering happens when someone uses fear, trust, or pressure to influence your decisions. They may pretend to represent your financial institution, a government agency, a business, technical support, or even a family member.
A message can look familiar and still be deceptive. The person contacting you may know basic details about you or use information found online to make the request seem credible. Their goal is to get you to act before you have time to think.
Common Types of Social Engineering
1) Phishing: Deceitful Emails and Websites
Phishing uses emails or look-alike websites to collect personal or financial information. A message may appear to come from a trusted organization and claim there is an issue with your account. It may ask you to select a link, open an attachment, or provide confidential info.
These messages often use timely subjects such as tax season, holidays, package deliveries, financial concerns, or account activity to seem believable.
2) Vishing: Deceptive Phone Calls and Voicemails
Vishing, or “voice phishing,” happens over the phone or through voicemail. The caller may claim to be:
- Your financial institution
- Technical support
- A government agency
- A fraud investigator
They may ask for an account number, a password, a PIN, or a one-time verification code. Remember that caller ID can be manipulated, so do not rely on a phone number alone to confirm who is contacting you.
3) Smishing: Deceptive Text Messages
Smishing, or “SMS phishing,” uses text messages to create pressure and prompt a quick response. A message may claim:
- A package delivery has been delayed
- Suspicious activity on your account
- You received a refund or prize
- You must take action right away
The message may include a link or phone number intended to collect information or install harmful software on your device.
Warning Signs to Watch For
Take a moment to examine any message that includes:
- A package delivery has been delayed
- Suspicious activity on your account
- You received a refund or prize
- An unexpected request for personal or financial information
- Pressure to respond immediately
- A warning that an account will be suspended or closed
- Promises of money, gifts, or a refund
- A request for a password, PIN, or one-time verification code
- Links or attachments you were not expecting
- Spelling or grammar that seems unusual
- An unexpected request for personal or financial information
A legitimate organization should not ask you to share your password, PIN, or one-time verification code. Vermont Federal Credit Union will not ask you to disclose your confidential access codes.
How Vermonters Can Protect Their Information
These steps can help you protect your identity, accounts, and financial information:
1) Pause Before You Respond
If a message creates fear or pressure, stop and take a breath. Do not let a demand for immediate action prevent you from checking whether the request is genuine.
2) Keep Your Account Details to Yourself
If someone calls or texts asking for the code just sent to your phone, your Online Banking password, or your PIN, stop there. Do not read it back or enter it into a link they provided. Vermont Federal Credit Union will not ask you to disclose your confidential access code.
3) Use a Trusted Way to Make Contact
Do not use the link or phone number included in an unexpected message. Instead, type the organization’s website address yourself, use its official mobile app, or call the number printed on your debit card, account statement, or other trusted material.
4) Look Closely Before You Click
If you receive a text asking you to sign in, and the link looks like it belongs to a trusted organization. Before selecting it, preview the web address. If it doesn't match their domain or contains an extra character or unusual spelling, close the message and open the official app or type the real domain into your browser.
5) Turn On Multifactor Authentication
Multifactor authentication, or MFA, offers another layer of protection when you sign in. Enable it whenever it is available and never share the verification code you receive.
6) Keep Devices and Software Up to Date
Install updates for your phone, computer, apps, and security software. Updates can address known weaknesses and help keep your information safer.
7) Be Careful with Payment Requests
Use extra caution if someone asks you to transfer money, purchase gift cards, use cryptocurrency, or change payment details. Verify the request with the person or organization through a reliable contact method before taking action.
8) Review Your Accounts Regularly
Check your account activity and watch for transactions or changes you do not recognize. Account alerts can help you notice unusual activity sooner.
What to Do If You Already Shared Information or Sent Money
If you selected a suspicious link, shared personal information, provided a security code, or sent money, act promptly:
1. Contact your financial institution using a trusted phone number or website
2. Change passwords that may have been exposed, especially if you reuse them
3. Review your accounts for transactions or changes you do not recognize
4. Report the incident to your financial institution and the appropriate authorities
5. Continue monitoring your accounts and credit reports for unusual activity
If you are a Vermont Federal Credit Union member and have concerns about your account, contact us through a trusted channel so we can help you understand the next steps.
Remember: Stop, Think, Verify
Social engineering is designed to make you act before you have time to evaluate a request. Taking a moment to pause can help protect your identity, your money, and your peace of mind.
When something seems unusual or too good to be true, stop, think, and verify. For more ways to protect your personal and financial information, visit our Security page. We share the latest cybersecurity tips and current security alerts to keep your information and accounts safe. At Vermont Federal Credit Union, we’re committed to helping members protect what matters most and bank securely with confidence, wherever life takes them across Vermont.
