Protect Yourself 

New Hampshire Postal Credit Union would like to warn you to be on the look out for financial scams intended to steal your money and/or your identity.

Take Charge: Fighting Back Against Identity Theft

Visit the FTC's Identity Theft website for more information on how you can protect yourself from identity theft.

More useful consumer protection links:

Identity Theft Resource Center 
Privacy Rights Clearinghouse 
NH Dept. of Justice Consumer Protection & Antitrust Bureau 

Latest Updates

OPM Identity-Protection Phishing Campaigns

US-CERT is aware of phishing campaigns masquerading as emails from the Office of Personnel Management (OPM) or the identity protection firm CSID. For those affected by the recent data breach, the legitimate domain used for accessing identity protection services is https://www.csid.com/.

US-CERT recommends that users visit the OPM website for more information. Users are also encouraged to read US-CERT’s guidance on avoiding social engineering and phishing attacks and report suspicious emails.

Credit/Debit Card "Brute Force" Attacks Up

Recently some card issuers and financial institutions across the industry have experienced an increase in attempts by unknown fraudsters to break the card verification value / card verification code (CVV / CVC) on compromised cards, and thereby to commit card fraud, including ATM fraud. This attempt to commit fraud is commonly known as a "brute force attack". To execute these crimes, email is often used to transport phishing scams and malicious software (malware) to obtain personal information including personal identification numbers (PINs) and to take over legitimate merchant accounts to test the compromised cards.

You can help to reduce the likelihood of this type of fraudulent activity succeeding by being alert for email that:

  • contains unfamiliar or suspicious links or attachments;

  • is unsolicited and/or from an unknown sender;

  • is sent multiple times from different senders;

  • contains poor grammar or incorrectly spelled words.

If you receive an email that contains any of these elements or any combination of these elements, you should delete it immediately. Do not open it, click on the links or open any attachment. You should not attempt to reply to the email or forward it to anyone.

Phishing Activity on the rise

The NH Postal CU has received information within the last week suggesting an increase in phishing activity. The fraud appears to be widespread and fraudsters are utilizing a variety of ways to obtain personal member information. Education is a never-ending process, but NH Postal CU is committed to this task so scammers are not able to trick our members into divulging personal and financial information.

Examples of recent reported phishing activity includes the following:

  • Text messages were sent to members indicating they should call a specific number and provide credit card information based on a freeze on their account.

  • Computerized calls to members indicated possible tampering of their check cards and asked them to enter their 16-digit check card number. The phone number shown on Caller ID appears to be a legitimate number, possibly hijacked by the fraudsters.

  • Members are receiving phone and text messages stating their cards had been suspended and directed them to call a number to reactivate. When members call back, they are instructed to input their card numbers and PIN. It is our understanding that counterfeit cards were then created and ATM/Debit card PIN-based transactions took place in Romania. For this to happen, we believe that most likely CVV/CVC counterfeit protection encoded in the mag stripe was not validated.

  • Fraudulent e-mail and text messages are being sent to appear as if they are from the NH Postal CU. The credit union’s website has been re-created by the scammer, who then asks members to enter their card numbers, expiration date, PIN and CVV2/CVC2 numbers. Members are also being called in the middle of the night stating their cards are experiencing fraud, and they are then asked to provide personal information.

  • Credit cardholders received a telephone message from an unknown party who left a telephone number for the member to call. The caller ID read ‘economic relief.’ When members returned the call, they were prompted to press 1 to lower rates, a person then came on and asked for social security number, credit card number, etc.

  • The Credit Union National Association (CUNA), NOT CUNA Mutual Group, has also been the subject of recent phishing attacks. Credit union members received e-mail messages appearing to be from legitimate e-mail addresses for CUNA and other credit unions stating “Your card has been deactivated.” The members are directed to call an 800 number (there are multiple 800 numbers being used) to ‘activate’ their card and PIN. One aspect of this scam causing particular concern is the realistic nature of the call: a message indicates all operators are busy, callers hear music for several seconds, and then a normal sounding (non-computer generated) voice prompts them to leave their name and a callback number. Our understanding is they will receive a call back from an actual person making the request seem valid.