Fraud Alert

Please be aware that a text message is circulating at the moment from fraudsters purporting to be the credit union. This message is not legitimate; we advise you to block the number and delete the message.

The message advises recipients that their credit union account has been placed on hold for a security update. The recipient is requested to verify their account by clicking on a link.

Please note that TUI credit union will never ask you to verify your account by such means.

Here are some examples of the types of messages that are being sent to members

Members are advised to exercise caution and please note the following:

• TUI Credit Union will never contact you and ask you for a code
• If anyone asks you to provide them with a code that has been sent to your phone, it is a scam
• Emails or SMS messages claiming that your account is locked or blocked are fake
• Messages that claim urgent action is required are generally fake
• Never click on links in messages. Always manually enter a web address into the address bar of your browser.

As we understand it, the attack process is as follows:

1. Member receives SMS with an embedded link
2. Member follows link to page(s) which requests information about the member and his/her credit union and credentials
3. Member provides this information
4. Attacker downloads the app for the identified Credit Union
5. Attacker phones member masquerading as a Credit Union staff member
6. Attacker enters the provided information (app still requires activation via SMS code)
7. System sends activation code to member’s phone by SMS
8. Attacker advises member that he is sending a code to the member’s phone
9. Member reads back the code to the attacker
10. Attacker activates app with provided code
11. Attacker logs in to Online Banking as the member and sets up an external beneficiary (requires code to complete operation)
12. System sends a code via push notification to the Mobile App
13. Attacker receives code on the newly activated app and completes the beneficiary setup
14. Attacker transfers funds from the members account to the newly set up beneficiary

Top tips to help you remain Fraud Aware