Lakeland Credit Union - 8 Ways Fraudsters Are Getting Around Security Codes

8 Ways Fraudsters Are Getting Around Security Codes (MFA)

A fraudster will phone you and impersonate a bank, credit card company, law enforcement officer or shopping website employee or investigator. They will request your assistance in a fraud investigation for a variety of reasons such as catching a fraudster who is stealing, to resolve suspicious purchases, or to confirm large money transfers from your accounts. The scammer will then try to get you to withdraw money or purchase gift cards, send money by various other means, or attempt to gain access to your online banking.

They may

Say your account is compromised
Pressure you to act quickly
Ask for security codes or passwords
Ask you to install apps or give access

Important:

They may already know some of your information - this is how they gain your trust.

Protect yourself:

Never share security codes or passwords
Never hand over your cards
Hang up and call the person or organization back using a number you trusted-not the one that called you

Fraudsters transfer your phone number to their device. In a SIM swap scam, a fraudster tricks your mobile carrier into transferring your phone number to a SIM card they control without your knowledge. Once they do, all your calls, texts, and data are redirected to their device. From there, scammers can initiate “Forgot Password” requests on your accounts, like your email or bank, since the scammers now receive your SMS-based two-factor authentication codes.

This scam often starts when you click a malicious link, reuse passwords, or fall for a phishing email. Once a fraudster gets into your email account, they don’t need your banking password right away - they simply use the “Forgot Password” option on your accounts.

Because your email is used to reset passwords and receive security alerts, the fraudster can quietly:

Reset your banking passwords
Access personal information
Take over multiple accounts

Protect yourself:

Use strong, unique passwords
Don’t ignore unexpected password reset emails

This scam usually happens after a fraudster already has some access to your account (through phishing, email compromise, or SIM-swap).

Once inside, fraudsters may:

Get into your account first
Change your security settings
Add their own authentication app
Remove or replace your existing MFA

After that, they can approve transactions without you knowing.

Protect yourself:

Review your security settings regularly
Report anything unusual immediately

They contact your credit union and:

Pass security questions
Change your email or settings
Take control of your account

Protect yourself:

Never share personal or banking information (passwords, security answers, codes) with anyone who contacts you unexpectedly
Be cautious about how much personal information you share on social media (fraudsters can use it to answer security questions)
Use strong, unique passwords for all accounts - especially email and banking
Enable multi-factor authentication (MFA) wherever possible
Set up account alerts so you’re notified of any changes (email, phone number, password)
If you receive a notification about a change you didn’t request, contact your credit union immediately
Regularly review your account information to ensure your contact details have not been changed

This scam often happens during normal activities like buying or selling on Marketplace. Instead of sending a real e-Transfer, the fraudster sends you a link or QR code that looks like a legitimate deposit or payment page. When you click it, you’re taken to a fake website that looks like your financial institution.

When you enter your login details and security code, you’re not completing a transaction, you’re giving your information directly to the fraudster. They can then use it to access your account and send money out.

You think you’re accepting money, but you’re giving away your login info.

Protect yourself:

Don’t click suspicious links
Always log in directly through your bank

Common during tax season. A fraudster claims to be an employee of either the Canada Revenue Agency or Service Canada.

You may receive: Texts, emails or calls

They create urgency (audit, refund, penalties).

Protect yourself:

CRA will NOT ask for personal or banking information by text or email.
Do not click on links in unexpected messages claiming to be from the CRA
Be cautious of messages that create urgency (audit, penalties, refunds)
Never send money, gift cards, or cryptocurrency to someone claiming to be the CRA
Do not share SIN, banking details, or passwords
Always verify by going directly to the official CRA website or calling them using a trusted number