Social engineering continues to be a problem. As scammers continue to evolve their attack methods, credential theft is a popular tactic used to steal usernames or passwords. Credentials are the log in information and user authentication data that allows access to a system or service. It is important to secure your credentials and protect your accounts from these scammers.
How do these attacks work?
Credentials can be obtained via social engineering with scammers use tactics like phishing or spear phishing to execute these attacks. Once credentials are stolen, scammers gain access to accounts to locate information for fraud. This could lead to a loss of funds with bank accounts and credit cards. There is also the possible exposure of personally identifiable information (PII).
Credential Theft Methods:
• Phishing. Emails with malicious intent disguised as legitimate used to trick a user into divulging sensitive information like credentials. An example of this is an email from your financial institution asking you to make immediate changes in your account. When you click on the link it leads to a fake log-in screen for your financial institution. When you try to log-in they capture your credentials and can gain unauthorized access to your account.
• Weak Passwords. Having weak passwords makes your account more susceptible to unauthorized access. It is important to have a long and complex password, avoid repeating passwords, and don’t use any personal information in your password.
• "Man-in-the-middle" attacks. A Man-in-the-middle attack occurs when a scammer intercepts or overhears a conversation between two parties, therefore eavesdropping on any sensitive information or password sharing.
How to prevent Credential Theft?
Below are some best practices for protecting yourself and your office:
• Never click on links or open attachments from unknown sources.
• Keep all systems up to date.
• Create long and complex passwords.
• Utilize a password manager.
• Enable Multi-Factor Authentication (MFA) on accounts.
• Never allow remote access to your devices.
I think I may be a victim of Credential Theft. What should I do?
1. Stop all communication. If you are in contact with a scammer, cease communication immediately.
2. Report the incident. You can file a complaint with the FTC on their website.
3. Protect your identity. Monitor your financial accounts, credit reports, and any other sensitive information for signs of unauthorized access and activity. With most accounts, you can place a fraud alert or a credit freeze to prevent further compromise.
4. Document the incident. Keep any record of communication and documentation related to the scam. This can be extremely useful when reporting the incident and resolving any issues with authorities.
Additional Considerations:
If a scammer accessed your accounts…
• Immediately change all passwords associated with the scam. Ensure the new password is strong and do not reuse passwords. Enable Multifactor Authentication on all accounts.
If a scammer has access to financial information…
• Contact your bank or credit card company immediately. They can help monitor your accounts for suspicious activity.
If a scammer has your Social Security number…
• Place a fraud alert and initiate a credit freeze on your credit reports by contacting one of the three major credit bureaus. Additionally, file a report with the IRS and your bank so that they can protect your identity and monitor your accounts.
1. Mutual Funds and variable annuities are sold by prospectus only. Contact your financial professional to obtain a prospectus before purchasing any Variable Annuity or Mutual Fund products. Read the prospectus carefully before investing.
Securities and advisory services are offered through LPL Financial (LPL), a registered investment advisor and broker-dealer (member FINRA/SIPC). Insurance products are offered through LPL or its licensed affiliates. CEFCU and CEFCU Investment Services are not registered as a broker-dealer or investment advisor. Registered representatives of LPL offer products and services using CEFCU Investment Services, and may also be employees of CEFCU. These products and services are being offered through LPL or its affiliates, which are separate entities from, and not affiliates of, CEFCU or CEFCU Investment Services. Securities and insurance offered through LPL or its affiliates are:
| Not Insured by NCUA or Any Other Government Agency | Not Credit Union Guaranteed | Not Credit Union Deposits or Obligations | May Lose Value |
Your Credit Union (“Financial Institution”) provides referrals to financial professionals of LPL Financial LLC (“LPL”) pursuant to an agreement that allows LPL to pay the Financial Institution for these referrals. This creates an incentive for the Financial Institution to make these referrals, resulting in a conflict of interest. The Financial Institution is not a current client of LPL for advisory services. Please visit https://www.lpl.com/disclosures/is-lpl-relationship-disclosure.html for more detailed information.
The LPL Financial registered representative(s) associated with this website may discuss and/or transact business only with residents of the states in which they are properly registered or licensed. No offers may be made or accepted from any resident of any other state.
