Scammers hide harmful links in QR codes to steal personal information

Ever tried to pay for parking and discovered you need to scan a QR code to pay? It seems like a convenient way to pay, but it turns out scammers like using QR codes, too. People have reported scammers covering up legit QR codes on parking meters with a QR code of their own. If you scan that scammy QR code, it could take you to a fake site designed to steal your money, your personal information, or both.  So, how can you protect yourself from these scams? 

Follow these steps: 

Think you scanned a bad QR code? Follow these steps:

  • Don’t interact with the scammer: If you reach out to someone through the website you think is fake, they may try to get money or sensitive information out of you. 

  • Change your password: If you entered credentials like your username or password, immediately change them wherever you use the same password for other accounts. 

  • Review your transactions: Check your credit card and bank statements to spot transactions you didn’t make.

Then, report it to the FTC at ReportFraud.ftc.gov.

Has Your Information Been Exposed? Here’s What to Do Next

It seems like every week another company announces a data breach. Retailers, healthcare providers, schools, and even financial services companies have all been targets.

While these headlines can be unsettling and sometimes overwhelming, a data breach doesn’t automatically mean your identity has been stolen. What matters most is how quickly and thoughtfully you respond.

What is a Data Breach and Why Does This Matter?

A data breach happens when unauthorized parties gain access to confidential personal information stored by an organization. What is considered personal information depends on state law, but typically it includes an individual’s first name or initial and last name, plus one or more of the following – Social Security number (SSN), driver’s license or state-issued ID number, or account number or credit or debit card number, combined with any security code, access code, PIN, or password needed to access an account.

Data breaches continue to occur at a record pace. In 2025 alone, more than 4,000 unique data breach events impacted at least 375 million individuals, according to the Privacy Rights Clearinghouse. Financial services remained one of the most frequently targeted industries, but healthcare, manufacturing, and retail are often targeted as well.

Typically, digital accounts and information come to mind, but a data breach can happen to physical records as well. And, while we generally consider data breaches to be tied to criminal activities, a data breach can be accidental and without malicious intent. Accidents happen!

Regardless of whether the data breach incident is accidental or malicious, the consequences can be severe. Once your personal data is exposed, criminals may use it to open fraudulent accounts in your name, steal your money or make unauthorized purchases, commit tax or medical identity theft, sell your information on the dark web, or access your online accounts, including email and social media.

The Federal Trade Commission (FTC) reports that Americans lost more than $16 billion to fraud in 2025, and more than $12.5 billion to fraud in 2024, a 25% increase each year. More than 1.1 million identity theft reports were filed through identitytheft.gov, highlighting just how common these crimes have become.

Even if you aren’t directly targeted or your information has been compromised in multiple data breaches over the year, any breach involving your information has the potential to cause long-lasting damage and stress.

If You Receive a Data Breach Notice, Don’t Ignore It.

Immediately after receiving a data breach notification in your inbox or hearing about a retailer breach that might affect you, it’s important that you act quickly to help secure your information and mitigate any potential damage. By taking a few simple steps now you can make a significant difference later.

Read the notification carefully.

Find out exactly what information was exposed. Was it your email address, password, Social Security number, or financial account information? When did the incident happen, and what is being done to avoid compromises like this in the future?

Change Your Passwords and Enable Multi-Factor Authentication (MFA).

Use a unique password for every account whenever possible. Even if the data breach notification you receive is for an account you don’t use anymore, so it doesn’t have your current credit card information, you might have used a password that you’re still using on other sites. Hackers know there’s a good chance you’re using the same password on multiple platforms. If they access your old gaming password from college, they might also be able to use it to log in to your current financial accounts. 

Activate MFA whenever it is available. Accounts that offer MFA provide extra security by requiring additional forms of identification beyond a password to log in to an account, such as a passcode or secret key obtained via text or email. Adding a second layer of security makes it much more difficult for criminals to access your accounts, even if they have your password.

Monitor Your Accounts and Check Your Credit.

Review your bank and credit card transactions regularly. If something doesn’t look right, report it immediately.

It can often take months for a company to find out that their customers’ data has been stolen and then communicate the information to their users. By then, your personal information could have already been sold on the dark web and used to open lines of credit before you have even been notified of the risk. Federal law entitles you to a free copy of your own credit report at least once every 12 months from each of the three main consumer credit reporting agencies: Equifax, TransUnion, and Experian. Reports can be requested at annualcreditreport.com or by calling 877-322-8228.

You may also consider placing a fraud alert on your credit report. An initial fraud alert is free and will stay on your credit file for at least 90 days. The alert informs creditors of possible fraudulent activity within your report and requests that the creditor contact you prior to establishing any accounts in your name. Visit annualcreditreport.com for details. 

Watch for Warning Signs

Identity theft often starts quietly. Remain vigilant and stay alert for things like:

·       Purchases you don’t recognize

·       New accounts you didn’t open

·       Bills for services you never received

·       Unexpected password reset emails

·       Calls or text messages asking you to “verify” personal information

If something feels suspicious, trust your instincts and investigate.

Remember: Scammers Often Strike After a Breach

Even if you weren’t the direct victim of a data breach, you could still be targeted. Criminals frequently use breach announcements to launch convincing phishing scams. They may send emails or text messages pretending to be your bank, a retailer, or even a government agency.

Stay aware, and before clicking a link or providing personal information, make sure that you:

·       Verify the sender.

·       Visit the company’s website by typing the address into your browser rather than clicking a link.

·       Never share one-time verification codes, PINs, or passwords with anyone.

Our financial institution will never contact you by phone, email, or text asking you for your password, PIN, or security code.

We’re Here to Help

Protecting your financial well-being is our priority. If you notice suspicious account activity or believe you’ve been targeted by fraud, contact us immediately. The sooner potential fraud is reported, the faster we can work together to help protect your accounts and your identity. If you or a family member worry that you have become a victim of identity theft after a data breach or another fraud event, do not hesitate to reach out to one of our Identity Theft Recovery Advocates that are available to you as a NH Postal Credit Union account holder. They can help you assess what information has been compromised and quickly begin the process of recovering any losses that have occurred.

FBI warns of “Banking Spoof Call” scams.

The FBI is warning people about a believable phone scam that can cost thousands of dollars.

Fraudsters are calling people and claiming to represent banks.

Many of them can spoof caller ID, so the bank's name appears when the phone rings.

One victim said the scammer even knew her account number and exact balance.

According to the FBI, legitimate banks will never ask for your username or password over the phone.

You should ignore any request to move money or gain access to your bank account.

If in doubt, hang up and dial the bank's published phone number.


Safeguarding Your Child’s Identity In Today's World 


Child identity theft isn’t something we often think about. However, it occurs more often than you might expect. According to Javelin’s Child Identity Fraud Report, child identity theft affects 1.25 million kids every year, which translates to about one in 50 children in America. When you see those numbers, it becomes apparent that we must act now to protect the children in our lives.

 

What Is Child Identity Theft? 

According to the Federal Trade Commission, “Child identity theft happens when someone takes a child’s sensitive personal information and uses it to get services or benefits or to commit fraud. They might use your child’s Social Security number, name and address, or date of birth.” 


Child identity theft happens for a multitude of reasons. The perpetrator could use this information to open a bank or credit card account, apply for government benefits, or even sign up for a utility service or rent a place to live. Much like other types of identity theft, it can be easy for this type of identity theft to remain undetected for months or even years. 

 

How It Happens

As with adults, identity theft against children can be perpetrated through a variety of sources. Below we have listed some ways that children's personally identifiable information (PII) could be exposed and then potentially used for fraudulent purposes.

§   Data Breaches. Kids’ personal identifying information is in so many places, and nothing is completely secure. Schools, doctors’ offices, and your home can all experience security breaches. After a child's confidential information or PII is exposed, whether the data breach incident is accidental or with malicious intent, the security breach cannot be undone. Often, criminals will wait to utilize the confiscated information for their own purposes. 

§   Familial Fraud. Three out of four cases of child identity theft come from those close to the victim, in what is known as familial fraud, and often occur in correlation with other forms of abuse, according to Javelin's Child Identity Fraud Report. Kids are often more trusting than adults, especially when they know the person who is asking for their information. Unscrupulous individuals at times utilize the PII of their own children, or children they know through family or friends, for their own benefit.

§   Phishing. These scams don’t just target adults. Children that use the internet without parental supervision have a higher chance of giving their sensitive information to a scammer, not realizing that they are being tricked. Kids don’t always know not to share their birth date, place of birth, and passwords with strangers or online “friends.” 

§   Hacking. As more children have their own devices, and often multiple devices (computers, tablets, and phones), hacking becomes more common. Hackers can gain access to the information stored on these devices and can also log in to social media accounts, which they could use to attempt to defraud friends and family, acting as your child.

 

Warning Signs Of Child Identity Theft

Regardless of the way the information makes it into the hands of identity thieves, below are some warning signs that your child's identity may have been stolen:

§   Unexpected Mail. Your child begins receiving credit card offers, collection notices, or bills under their name.

§   Collection Calls. You or your family members begin to receive calls from collection agencies for unpaid bills in your child's name.

§   Government Benefits Denials. Your child is denied government benefits because they are already being claimed, when this is not the case.

§   IRS Notifications. The IRS contacts you or your child about your child owing taxes or indicates that their SSN was used on another tax return.

 

How You Can Help Protect Your Children 

The best way to help protect your family from identity theft is to be proactive in helping to prevent it. The most effective preventative measure is education. This type of education will not only help protect them now, but it is information that will benefit them as adults. 


Keep Important Documents in a Secure Location. Keep your family’s personal identifying information in a secure place in your home, be selective about what services you sign up for, and don’t give your information out unless it is absolutely necessary. Make sure that any important documents in your home, such as Social Security cards, birth certificates, or other legal documents, are stored securely to avoid compromise.

 

Share Personal Information with Caution. Assess the need before listing your child’s Social Security number (SSN) on forms. Schools and school break camps shouldn’t be using it as the only unique ID for each child. If an SSN is required, don't be afraid to ask if it's ok to share only the last 4 digits of your child's SSN.

 

Educate Your Child. Talk to your child about the importance of privacy and the dangers of sharing personal information online and offline. Ensure that your child isn't sharing personal information like their birthdate, address, or school on social media, other online platforms, or with other individuals without your permission.


Secure Your Mail. If you're sending or receiving mail with personal details, especially if those personal details pertain to your children, consider using a mailbox that locks or opt for electronic delivery. Retrieve your mail daily as soon after delivery as possible. Consider opting into the U.S. Postal Service’s “Informed Delivery” service. It’s free to sign up, and it will provide a Daily Digest email that will preview your mail and packages scheduled to arrive soon, along with an image of each of your incoming letter-sized mail pieces. This will help you stay vigilant if any missing mail never arrives. 

 

Discard Unnecessary Documents with Care. If you have postal mail or other important documents that you no longer need to keep on file, make sure that you use a cross-cut shredder to securely destroy the paperwork. Criminals can engage in "dumpster diving" to retrieve discarded paperwork with personal information, potentially compromising you and your family.

 

Have you set up your internal Code Word to be used when you call the Credit Union?

We are advising all members to do so. A CODE WORD is something you and only you will know. When you call the NH Postal Credit Union for account information, we will ask you this code word for verification. Call and speak to a Member Service Representative today!

What are some classic warning signs of possible fraud and scams? *

There are several signs that indicate you might be dealing with a scammer, and several steps you can take to protect yourself and others.

Criminals and con artists use many scams to target unsuspecting people—of all ages—who have access to money. Consumer scams happen on the phone, through the mail, e-mail, or over the internet. They can occur in person, at home, or at a business.

Warning signs include contact from someone:

  • Claiming to be from the government, a bank, a business, or a family member, and asking you to pay money.

  • Asking you to pay money or taxes upfront to receive a prize or a gift.

  • Asking you to wire them money, send cryptocurrency, send money by courier, send money over a payment app, or put money on a prepaid card or gift card and send it to them or give them the numbers on the card.

  • Asking for access to your money-such as your ATM cards, bank accounts, credit cards, cryptocurrency wallet keys or access codes, or investment accounts.

  • Pressuring you to "act now" or else the deal will go away, or trying hard to give you a "great deal" without time to answer your questions.

  • Creating a sense of urgency or emergency to play on your emotions.

 

Here are some tips to protect yourself from scams:

  • Don’t share numbers or passwords for accounts, credit cards, or Social Security.

  • Never pay up front for a promised prize. It’s a scam if you are told that you must pay fees or taxes to receive a prize or other financial windfall.

  • After hearing a sales pitch, take time to compare prices. Ask for information in writing and read it carefully.

  • Too good to be true? Ask yourself why someone is trying so hard to give you a “great deal.” If it sounds too good to be true, it probably is.

  • Watch out for deals that are only “good today” and that pressure you to act quickly. Walk away from high-pressure sales tactics that don’t allow you time to read a contract or get legal advice before signing. Also, don’t fall for the sales pitch that says you need to pay immediately, for example by wiring the money, sending it by courier or over a payment app, or by sending cryptocurrency.

  • Beware when someone plays on your emotions or claims there’s an urgent situation. Advances in artificial intelligence make it easier for scammers to clone voices and alter images to make it seem like someone you know needs help. Contact the person yourself to verify the story. Use contact information you know is theirs. If you can’t reach them, try to get in touch with them through another trusted person, like a family member or their friends.

  • Don’t click on links or scan QR codes. These can take you to scammers’ malicious websites or give them access to your device.

  • Put your number on the National Do Not Call Registry. Go to www.donotcall.gov or call (888) 382-1222.

 * Consumer Financial Protection Bureau

 Report Fraud:

In October 2020 the FTC launched ReportFraud.ftc.gov a site for people to report fraud and other illegal business practices. Reports from consumers are stored in the Consumer Sentinel Network, a secure online database available only to law enforcement.

IRS Identity Theft Awareness

The IRS Identity Theft Awareness

The Internal Revenue Service (IRS) has launched its “Identity Theft Central” webpage to provide 24/7 access to online information regarding tax-related identity theft and data security protection. Tax-related identity theft occurs when someone steals personal information to commit tax fraud.

StayConnectedNH ! Sponsored by NH Credit Unions/ Better Values - Better Banking  

Isolated and vulnerable, more than 3 million older Americans are victims of financial abuse every single year.  

Today, a new tool is added to the arsenal to protect New Hampshire’s vulnerable populations by raising awareness of financial exploitation in the Granite State: StayConnectedNH.org.