FEDERAL WAY, Wash. -
In one case, the thieves convinced Woodstone CU to transfer $665,000 from an elderly couple’s HELOC, which was rapidly sent overseas and out of the reach of U.S. law enforcement. “We don’t know if we fully understand how they’re doing it,” said Vince Wagner, a risk manager at CUNA Mutual Group, which is working with the FBI and the U.S. Secret Service to investigate the thefts.
But the scam appears to work like this: the thieves use some form of data mining to gain access to individual members’ financial information. It’s not clear whether they are able to access the CU’s database or they obtain information on HELOCs from public sources, like county registries of deeds.
Once they determine that the member has a HELOC, the thieves contact the CU by fax or e-mail to request a funds transfer. Usually, the requests are sent to CUs with call centers, as personnel at smaller credit unions without call centers often know their members personally.
In many cases, an employee with the credit union will call back the member to verify the request, which is usually in excess of $100,000.
Here’s where a new twist comes in, according to Wagner. In some cases, the thieves have made arrangements, presumably with telephone service providers, to forward the calls to their phones, allowing them to pose as the legitimate member and verify the transfer request. Because of the practice of most telephone service providers, the number that comes up on the CU’s caller ID is the member’s actual number that has been forwarded.
In the Woodstone CU case the 66-year-old member first learned the money had disappeared from his account when a credit union representative called to say $450,000 had been transferred from his and his wife’s home equity credit line. A credit union representative called a short while later to say another $215,000 had been transferred.
The thieves have used several different phone companies, making them difficult to track, said Wagner. In addition, they may be using disposable phones, making it even harder to track. “They’re difficult to trace to the final number,” said Wagner. “Until we catch one of these perpetrators everything is speculative. Our goal is to get the word out to credit unions and tell them to be on the look-out.”
Through last week, at least 18 CUs had been hit by the scam, with as much as $6.5 million either transferred or attempted to be transferred. Some CUs were successful in recalling the wire transfer before the crooks get the money.
CUNA Mutual is recommending several precautions for credit unions to guard against this HELOC scheme. Among them are: set a password for HELOC or other large funds transfers, so if a credit union representative calls a member the member needs to provide the password; limit the amount of wire transfer that can be completed by a call center employee; record conversations during a call-back and compare it to previous conversations with a member; and listen to the caller closely to determine if he or she has an accent that is inconsistent with the credit union’s membership.
In addition; if there is any doubt of the authenticity of the funds transfer request, a credit union is not required to perform a wire transfer (for more tips, see related story page 15).
Credit unions that believe they have been contacted by the HELOC thieves are urged to contact CUNA Mutual’s CU Protection Response Center at 1-800-637-2676.
