Guides / Buyer shortlist

When scammers pose as your fraud department: stopping spoofed calls and texts that steal logins and one-time codes

Informational only, not an endorsement.

This page is for a fraud or BSA officer, a digital-banking manager, a security or IT lead, or a member-service or contact-center lead at a community bank or credit union. The call or the text shows your own number, then asks the member to read back a login and the one-time code you just sent. The question is what you change on your side: the words on the code message, the extra check on a risky action, the signals on the device and the session, the rules on a new payee or a new login, and what the contact center is allowed to ask. When a fact comes from MSGCU, NBC Connecticut, WBRZ, the OCC bulletin, the FFIEC guidance, or a vendor page, the sentence names that source.

Listings are informational only. BankToolkit does not endorse, rank, or score products. Account takeover and other payment rails are in the fraud prevention guide. Inbound mule activity is in the money mule guide. What you can share with another institution is in the 314(b) guide. Check images, positive pay, and kiting are in the check fraud guide. Insider schemes are in the insider fraud guide.

Not legal advice; confirm with counsel and your examiner.

BankToolkit is not your counsel and not a law firm. This is a plain-English reading of public sources. Each fact below names the source that states it. Nothing on this page assesses the controls at the credit unions mentioned in the news reports, and this page does not name those institutions or the people in the stories.

How the fake fraud-department scam works

MSGCU’s scam alert, dated November 4, 2026, says more members are reporting texts from scammers claiming to be MSGCU. MSGCU says the texts start with a false claim that a fraudulent transaction occurred on the member’s debit or credit card, and that the member is asked whether they made that transaction. MSGCU says the scammers then try to collect online banking credentials, including the username, the password, and a one-time verification code, “to deactivate the compromised online banking account.” MSGCU says the criminals use those login details to steal money from the member’s account.

The same alert says MSGCU will never ask for an online banking password, a login verification code, or full credit or debit card details. It also says MSGCU may still call or text from its fraud department about unusual activity on a credit or debit card. The line MSGCU draws is the ask: it says it will not request detailed card information, including the three-digit code on the back of the card or the expiration date. MSGCU tells members not to reply, not to click a link, and not to call the number in the message. It tells them to call MSGCU at a number the member already has, or to visit a branch.

NBC Connecticut, in a story checked November 4, 2026, reports a different path that ends in the same place: a phone call, not a text. NBC Connecticut says a member lost more than $7,000 after a caller posing as her credit union convinced her to transfer savings through Apple Cash. The story says the caller claimed to work for the fraud department of a Connecticut credit union, and that the caller ID on the incoming call showed that credit union’s actual phone number. NBC Connecticut says that over a weekend in August she sent more than $7,000 through Apple Cash to an unknown account, believing she was following her credit union’s instructions. This page does not name her, and it does not name the credit union. NBC Connecticut reports that the credit union said it found no evidence the transaction resulted from a cybersecurity incident, and that the credit union said its systems remain secure. This page does not assess that credit union’s controls.

WBRZ’s headline reports that a man was arrested for allegedly scamming credit union members out of nearly $160,000. This page refers to that institution as a Louisiana credit union and does not use its name. That headline is the only fact this page takes from WBRZ. It does not name the person who was arrested, and it does not retell the rest of the story.

NBC Connecticut, citing the FTC, says victims lost $3.5 billion through imposter scams in 2025, an increase of 300% since 2020. This page did not open an FTC document for that figure. It is NBC Connecticut’s attribution, not a figure this page calculated, and it is not a loss total for community banks or credit unions.

Why caller ID and warnings don’t stop it

The NBC Connecticut story says the imposter call appeared to come from the credit union’s actual phone number, and that the member’s caller ID showed that credit union’s name. NBC Connecticut quotes Steven Weisman, editor of Scamicide.com, who said scammers can manipulate caller ID so a call appears to come from a trusted business, government agency, or other organization. Weisman said a caller can hide the number they are actually using and make it appear to be whatever they want, and that an unsophisticated scammer can do this. Caller ID, on that account, is not proof the call is yours.

A warning on the payment screen did not stop the transfer in that account. NBC Connecticut says Green Dot Bank, which provides Apple Cash services, said it uses real-time fraud warnings meant to help customers recognize common scams. NBC Connecticut reports that the member saw a warning while making the payment, and that the caller told her the alert was expected. In the story NBC Connecticut published, the caller explained the warning away.

A wording change that takes that coaching into account is a suggestion on this page, not a sentence in the NBC Connecticut story and not a regulatory requirement. If you show a scam warning, consider saying that if someone told the member to expect this warning, it is a scam. Pair it with the callback in the member-education section: hang up, and call a number you look up yourself.

What FFIEC’s authentication guidance expects

OCC Bulletin 2021-36, dated August 11, 2021, says the OCC and the other FFIEC members issued guidance on authentication and access to financial institution services and systems. The bulletin says the guidance replaces the FFIEC members’ 2005 guidance, Authentication in an Internet Banking Environment, and the 2011 Supplement to Authentication in an Internet Banking Environment. The bulletin’s note for community banks says the guidance applies to community banks. A footnote in the bulletin defines “banks,” for that bulletin, as national banks, federal savings associations, and federal branches and agencies of foreign banking organizations.

The guidance text is the attachment to that bulletin, Authentication and Access to Financial Institution Services and Systems. It says the FFIEC is issuing the guidance on behalf of its members. The members listed include the NCUA. For purposes of the guidance, “customers” includes credit union members. The guidance says it does not impose any new regulatory requirements on financial institutions, and that it does not endorse any specific information security framework or standard. Confirm with your examiner which issuance applies to your charter. This page does not treat the OCC bulletin as a credit-union exam manual.

The bulletin’s highlights, which the guidance text expands, include attacks that use compromised user and customer credentials; layered security and the weaknesses of single-factor authentication; multifactor authentication, or controls of equivalent strength, to mitigate unauthorized access; monitoring, logging, and reporting; risks at the call center and the IT help desk; and a customer awareness program that complements layered security.

The guidance says single-factor authentication, alone or with layered security, is inadequate in many situations, and that single-factor authentication with layered security has been shown to be inadequate for customers in high-risk transactions and for high-risk users. It says that when a risk assessment finds single-factor authentication with layered security inadequate, multifactor authentication or controls of equivalent strength, as part of layered security, can more effectively mitigate the risks. It says authentication controls are applied to match the risk of the transaction or the access, and it gives a customer starting a payment as an example of a higher-risk activity.

The guidance also says some multifactor factors can be intercepted. Its example is a man-in-the-middle attack in which a hacker intercepts a one-time security code sent to a customer. That is not the same event as a member reading a code to a caller. It is the guidance’s own example that a one-time code can leave the channel it was sent on. The appendix lists one-time passwords as an authentication example and says they may be more secure than static passwords that change only at set intervals. It does not say a one-time password, by itself, stops a person from reading the code to a caller.

On the call center, the guidance is about someone deceiving your staff. It says threat actors have used social engineering to get customer call center and IT help desk representatives to reset passwords and other credentials. The appendix lists examples for that setting: stronger authentication before a credential reset, a call-back to a phone number already on file, and training for call center staff on the reset process. Those examples are about inbound resets. They are not a script for an outbound fraud call.

The customer-awareness section says a program educates customers about authentication risks and can complement layered security. Examples in the guidance include explaining how a customer can judge whether a communication is really from the institution, especially a communication that asks for information that could be used to access the account; listing contacts the customer can use to report suspicious activity; and educating customers on threats such as phishing and social engineering. The guidance says failing to update that program when risks change, such as when a faster payment service is added, has been shown to make the program ineffective. It also says marketing that conflicts with the security risks described in the awareness program could raise legal compliance risks.

The appendix is a list of examples, not a required control set. It says the list is not all-inclusive and that the effectiveness of a listed practice may change. Examples that sit next to this scam include stronger authentication for account-maintenance changes (physical or email address, password, contact information, or enrolled devices); transaction value limits, limits on which devices can add a payment recipient, and limits on how many transactions are allowed per day; fraud monitoring for changes in behavior, transaction velocity, and increases in login or account-lockout activity; and behavioral biometrics software and device identification. On device identification, the appendix says some identifiers, including device cookies, geolocation, and IP address matching, are insecure and ineffective if used alone, and that they can be combined with other controls.

The guidance does not use the phrase “step-up authentication.” The controls in the next section use that phrase for a practice. Where a sentence is a practice on this page, it says so. Where a sentence is in the guidance, it says so.

Controls you own

These are practices an institution can put on the channels it already runs. They are not a finding about any credit union in the news reports above. They are not a vendor requirement.

OTP wording

Write the code message so it says what the code is for, in the member’s words: to add a new payee, or to sign in on a new device. In the same message, say that you will not call or text to ask for this code. That second sentence mirrors MSGCU’s statement that it will never ask for a login verification code. It should not say you will never contact the member at all. MSGCU says it may still call or text about unusual card activity. The promise that matches MSGCU’s alert is narrower: we may contact you, and we will not ask you to read this code back.

Step-up on the risky action, not only at login

A login that succeeds is not the end of the session in the incidents above. MSGCU describes criminals using a completed login to steal money. The NBC Connecticut account is a member moving savings while she believes the fraud department is on the phone. A second check at login, and no second check on the payment, leaves the risky action open.

“Step-up,” on this page, means a stronger check when the action is riskier than a routine login. Actions worth that review are a new device, a change to the password, phone, or email, a new payee, a person-to-person or other external transfer, and a limit increase. The payment, the new payee, and the contact change are the part the FFIEC guidance already speaks to, in different words. The guidance says authentication controls are applied to match the rising risk of a transaction, and it names a customer starting a payment as an example where stronger controls have been effective. The appendix lists stronger authentication for address, password, contact, and device changes, and restrictions on which devices may add a payment recipient. A person-to-person transfer is the rail NBC Connecticut describes, which in that story was Apple Cash. A requested limit increase is a further example on this page, not a detail in that story. The guidance does not use either label.

The guidance’s standard for choosing the check is the risk assessment: when single-factor authentication with layered security is not enough, use multifactor authentication or controls of equivalent strength. This page does not say every action on the list requires a particular product.

Device and behavior signals

A new device followed quickly by a new payee is a pattern your own rules can see. What a session “looks like” while someone is being coached is a vendor description, not an FFIEC definition. The guidance appendix lists behavioral biometrics software, and device identification combined with other controls, as examples. It does not name a product.

On its own site, BioCatch describes the signals below. The BioCatch homepage says Account Takeover Protection monitors sessions past login for remote access, malware, and impersonation, even when the credentials and the device look legitimate. It says Scams360 detects cognitive behavioral signals of scam activity, including hesitation, confusion, and external pressure. BioCatch’s one-time-password social engineering page says session behavior consistent with an active phone call may indicate real-time social engineering, and it names delayed entry, stop-and-go typing, backspaces, and deletions. It also says a new or unfamiliar device, together with a longer time to start entering the code, suggests possible account takeover. BioCatch’s remote-access page says a fraudster may talk someone into downloading a remote access tool, and that behavioral biometrics use mouse movement, keyboard interaction, device movement, and swipe patterns to tell a human session from remote access. Those sentences are BioCatch’s. Confirm, in a demo, which of them are in the product you would buy.

Payee and login anomalies

Three practices on this page sit next to the guidance’s monitoring examples. They are not quoted from it.

  • A cooling-off period, or a hold, on the first payment to a new payee. The guidance does not require a cooling-off period. Its appendix does list restrictions on devices used to add payment recipients, and transaction value and daily-count limits.
  • A limit on how fast a session on a new device can add a payee and send money. The guidance’s related examples are rate limits on login attempts, daily transaction limits, and fraud monitoring for transaction velocity. It does not use the phrase “new-device velocity.”
  • An alert to the member when the phone, the email, or the address changes. The appendix lists stronger authentication for those changes. It also lists transaction alerts based on size or risk. An alert about the contact change itself is a practice on this page.

The guidance’s monitoring section says logging and reporting help management see whether unauthorized access was attempted or succeeded, and help them respond. That is the theme. The three bullets are how this page applies it to the scam in the news reports.

Contact center

Split the script in two directions.

Outbound, your fraud department calls the member: do not ask for a password, a one-time code, or full card details. That is MSGCU’s public rule for itself, used here as a practice you can adopt. If your fraud staff do call about a card transaction, say so in the same script, so the member is not told “we never call” on a day when you do.

Inbound, the member calls you, or a stranger calls your help desk: the FFIEC guidance treats this as social engineering aimed at your employees. Use the appendix examples that match: a stronger check before a password or credential reset, a call-back to a phone number already on file rather than to the number the caller is using, and training on that reset process. Do not reset a code because the caller ID looks like the member.

Member education that works

The FFIEC guidance says a customer awareness program educates customers about authentication risks. Examples it lists include how a customer can judge a communication that asks for information that could unlock the account, a contact for reporting suspicious activity, and education on phishing and social engineering. It says failing to update the program when risks change has been shown to make the program ineffective.

Three pieces put that on a page a member can find without trusting the call they are already on.

  • A standing statement, in language you control, that you will not ask for a password, a one-time code, or full card details. MSGCU publishes that statement about itself. Publish yours where a member can open it from a bookmark or a statement, not from a link in the suspicious text.
  • A banner in online and mobile banking that repeats the same sentence. The banner is a practice on this page. The guidance does not specify a banner.
  • A script the contact center and the public site use together: hang up, then call the number printed on the card or on the statement. NBC Connecticut’s advice to consumers is not to rely on caller ID, to hang up, and to call a number you look up yourself. MSGCU tells members not to call the number in the text, and to call MSGCU at a number they already have. The card or the statement is one place that number already lives. Do not tell members to call back the number that just called them.

NBC Connecticut also reports that both the Connecticut credit union and Green Dot Bank said customers should never share account information, passwords, PINs, verification codes, or other sensitive information based on an unsolicited call, text, or email. That is those two organizations’ statement to NBC Connecticut. It is a reasonable sentence to put next to yours. It is not, by itself, your policy until you adopt it.

The warning-wording suggestion from the section above belongs in the same set. A warning the member has been told to ignore will not carry the stop. Say, in the warning itself, that if someone told them to expect the warning, it is a scam.

Staff training is a different audience. The guidance says education for employees and other users can include training and testing on phishing and social engineering. KnowBe4 and Proofpoint are linked in the tools section as staff-training listings only. This page does not claim either product educates members.

Tools that say they flag the takeover

This is a map of sentences on each vendor’s own page, plus directory links where this page makes no feature claim. It is not a ranking. Nothing in the table says a product meets a rule, satisfies an examiner, or would have stopped the incidents above. Confirm the wording in a demo, against the page linked here.

Digital banking platforms are a separate shelf. Digital Banking lists Q2, Alkami, Apiture, and Lumin Digital, among others. This page does not describe multifactor, step-up, or one-time-code features for those listings, because it did not take those claims from each vendor’s site. Bankjoy is not in that category. It is listed under Marketing & CRM at Bankjoy. This page does not describe Bankjoy’s features.

Listing BankToolkit page What that vendor's own page says What to confirm in a demo
BioCatch BioCatch, on Fraud Prevention The homepage says BioCatch Connect continuously analyzes application, behavioral, device, network, and transactional signals. It lists Account Takeover Protection (session monitoring past login for remote access, malware, and impersonation, even when credentials and devices look legitimate), Scams360 (cognitive behavioral signals of a scam, including hesitation, confusion, and external pressure), and Mule Account Detection. The one-time-password social engineering page says callers pressure customers to disclose codes during a real authentication, and that BioCatch reads delayed entry, stop-and-go typing, backspaces, deletions, and session behavior consistent with an active phone call. The SIM-swapping page says BioCatch correlates behavior with device telemetry to detect loss of device ownership even when a one-time password is intercepted and the login succeeds. The remote-access page describes a remote access tool a person is talked into installing, and behavioral biometrics on mouse, keyboard, device movement, and swipes. Which of those signals are in the contract, and whether an alert can hold or step up a payment before it is sent.
ThreatMark ThreatMark, on Fraud Prevention The homepage describes scams and social engineering, account takeover, and a behavioral intelligence platform that combines transaction risk analysis, threat detection, and user behavior profiling. It announces ScamFlag. The ScamFlag page calls the product scam detection built for banking, says it is powered by ThreatMark's behavioral intelligence, and says a user can submit a screenshot of a message, an email, or a similar image for a risk result. This page does not repeat accuracy figures from that page. Whether ScamFlag is the screenshot tool, the session-monitoring platform, or both, and which one your core or digital banking app can actually launch.
Sardine Sardine, on Fraud Prevention The homepage describes an agentic risk platform that unifies fraud prevention, AML compliance, and real-time transaction monitoring. It says the platform offers real-time, behavior-based fraud detection. It lists account takeover as stopping unauthorized access during logins and live sessions. It says the platform automates financial crime operations, including agents that detect risk, investigate alerts, and help AML teams move from review to resolution. This page did not find a homepage sentence that says Sardine prevents AI-driven attacks. Whether the account-takeover control on that page is in the package you would buy, and whether it runs during the session or only after the payment.
Feedzai, Featurespace, DataVisor, Hawk, Alloy, Unit21 Feedzai, Featurespace, DataVisor, and Hawk are listed on Fraud Prevention. Alloy and Unit21 are listed on BSA / AML and also appear on Fraud Prevention. No feature claim. This page did not use their sites to describe account takeover, scam calls, or one-time codes. Ask the vendor what the demo will show for a spoofed fraud-department call. This page has no product sentence to check them against.
KnowBe4, Proofpoint KnowBe4 and Proofpoint, on Cybersecurity No feature claim. Linked here only as staff-training listings. This page does not say either product trains members. Whether the module you are shown is for employees. Member wording stays with the education section above.

What we still cannot cite

  • Names. The NBC Connecticut story does not name the member. This page also leaves out her age and her city. This page does not name the Connecticut credit union, the Louisiana credit union in the WBRZ report, or the person WBRZ says was arrested.
  • Any WBRZ fact other than the headline: a man arrested for allegedly scamming members out of nearly $160,000. Dollar amounts and the method in the body of that story are not used here.
  • An FTC page for the $3.5 billion figure. The sentence above is NBC Connecticut, citing the FTC.
  • The words “step-up authentication” in the FFIEC guidance. They are not there.
  • A BioCatch product named Strong Customer Authentication. It is not on the BioCatch pages linked in Sources.
  • “Behavioral biometrics” or “device intelligence” as ThreatMark’s own product labels. Those phrases are not on the ThreatMark homepage or the ScamFlag page linked here. ThreatMark’s pages say “behavioral intelligence” and “user behavior profiling.”
  • A Sardine homepage sentence that the platform prevents AI-driven attacks. The homepage sentences this page uses are the ones in the table.
  • Feature claims, prices, detection rates, or ranks for any vendor. ScamFlag’s accuracy figure and BioCatch’s scale statistics are on those sites. This page does not repeat them.
  • A finding that any credit union in the news reports lacked a named control. The Connecticut credit union told NBC Connecticut it found no evidence of a cybersecurity incident.

Sources

Checked Nov 4, 2026.

Quick answers

Can scammers spoof a credit union’s phone number?

NBC Connecticut, in a story checked November 4, 2026, reports that a caller claiming to be a Connecticut credit union’s fraud department reached a member, and that caller ID showed the credit union’s actual phone number. The story quotes Steven Weisman, who said scammers can hide the real number and make a call look like a trusted organization, and that an unsophisticated scammer can do this. Do not treat caller ID as proof the call is yours.

Will my bank ever ask for a one-time code?

MSGCU’s November 4, 2026 alert says MSGCU will never ask for an online banking password, a login verification code, or full card details, even if MSGCU calls or texts about unusual card activity. NBC Connecticut reports that the Connecticut credit union and the Apple Cash provider both said customers should not share passwords or verification codes on an unsolicited call, text, or email. That is not a rule for every institution. Confirm the script with counsel.

What is step-up authentication?

Step-up authentication, as this page uses the term, means a stronger check on a risky action, not only at login. Review a new device, a password or contact change, a new payee, a person-to-person or external transfer, and a limit increase. OCC Bulletin 2021-36’s FFIEC guidance does not use the phrase. It describes stronger authentication when risk is higher, such as a payment, and multifactor authentication or equivalent controls when single-factor authentication is not enough.

What does FFIEC guidance say about authentication?

OCC Bulletin 2021-36, dated August 11, 2021, conveys FFIEC guidance that replaces the 2005 and 2011 authentication guidance. The bulletin says the guidance applies to community banks. The guidance text says customers include credit union members, and that it imposes no new regulatory requirements. Highlights include compromised credentials, layered security, the limits of single-factor authentication, multifactor authentication or equivalent controls, monitoring and logging, call-center and help-desk risks, and a customer awareness program. This is not legal advice.

What tools detect account takeover after a scam call?

BioCatch’s site describes Account Takeover Protection that monitors a session after login for remote access, malware, and impersonation, and a use case for one-time-password social engineering. ThreatMark lists account takeover and offers ScamFlag, which its page calls scam detection built for banking. Sardine’s site says its account-takeover control stops unauthorized access during logins and live sessions. Other fraud listings on this page are links only, with no feature claims. This is not a ranking. Confirm coverage in a demo.