Consumer Alert! Phone & Text Message Caller ID Spoofing Scams

We at 21^st Century Bank take our customers’ privacy and security very seriously.  This is why we try our best each day to stay on top of cybersecurity threats, whether they are new or changes to old threats.  We have recently been made aware of phone calls and text “spoof” attempts in and around our communities.  The criminals carrying out these attempts use caller ID spoofing and robocall technology to target banking customers with the goal of obtaining sensitive information they can use to take control of the customer’s account(s).

What is spoofing, and how does it work?

“Spoofing” occurs when a caller deliberately falsifies the information transmitted to your caller ID display to disguise their identity. Spoofing is often used as part of an attempt to trick someone into giving away valuable personal information so it can be used in fraudulent activity or sold illegally. U.S. law and FCC rules prohibit most types of spoofing.

Caller ID lets consumers avoid unwanted calls by displaying caller names and phone numbers. The caller ID feature is sometimes manipulated by spoofers masquerading as representatives of banks, creditors, insurance companies, or even the government.

What can you do if you think you’re being spoofed? (fcc.gov/spoofing)

You may not be able to tell right away if an incoming call is spoofed. Be careful about responding to any request for personal identifying information.

• Never give out personal information such as account numbers, Social Security numbers, mother’s maiden names, passwords, or other identifying information over the phone without verifying whom you are speaking with. This also includes multi-factor/two-factor authentication codes provided in an app, email or text.
• If you get an inquiry from someone who says they represent 21^st Century Bank seeking personal information, hang up and call the phone number on your account statement or send a message through our contact page on the 21^st Century Bank website.
• Use caution if you are being pressured for information immediately. Attackers will attempt to use your emotions to persuade you into providing information before you have stopped to consider who is requesting it. 
• Don’t answer calls from unknown numbers. If you mistakenly answer one of these calls, hang up immediately.
• If you have a voice mail account with your phone service, set a password. Some voicemail services are preset to allow access if you call in from your phone number.  A hacker could spoof your home phone number and gain access to your voicemail if you do not set a password.
• Talk to your phone company about call-blocking tools and check into apps you can download to your mobile device. The FCC allows phone companies to block robocalls by default based on reasonable analytics. More information about robocall blocking is available at fcc.gov/robocalls.

Is spoofing illegal?

Under the Truth in Caller ID Act, FCC rules prohibit any person or entity from transmitting misleading or inaccurate caller ID information to defraud, cause harm, or wrongly obtain anything of value.  If no harm is intended or caused, spoofing is not illegal.  Anyone who is illegally spoofing can face penalties of up to $10,000 for each violation.  In some cases, courts can permit spoofing for people who have legitimate reasons to hide their information, such as law enforcement agencies working on cases, victims of domestic abuse or doctors who wish to discuss private medical matters.

The FCC has taken steps recently to crack down on criminals utilizing spoofing by pressuring phone providers to implement controls on their networks to combat the threat directly.  This has forced some attackers to block caller ID information so a call will appear “unknown” instead.

How do I report suspected spoofing?

If you receive a call and you suspect caller ID information has been falsified, or you think the rules for protecting the privacy of your telephone number have been violated, you can file a spoofing complaint with the FCC.

In any scenario, it’s best not to provide information over the phone or via text message unless you are 100% sure you know whom you are speaking with.