How this E-Mail Scam Works
Oftentimes we discuss various scams, such as pig butchering, smishing, and phishing attempts going on in the industry since we believe this is good information for Credit Union staff to be aware of for their own personal work and for discussions to keep their members safe. We’ve heard reports of employees in the credit union industry receiving emails that look 100% legitimate. The “Handbook” Trap, as some call it is a sophisticated phish attempt where they appear to come from your company. They often use high-pressure tactics or routine administrative requests, such as:
- “Urgent: Updated Employee Handbook” (Requires a “login” to view).
- “Action Required: Mandatory Email Security Migration.”
- “Payroll Discrepancy: Please verify your details.”
What makes these dangerous is Header Spoofing. Hackers manipulate the email’s metadata to ensure the “From” line displays your credit union’s actual domain (e.g., ceo@yourcreditunion.org). Because the email looks like it’s coming from inside the house, many standard spam filters, and busy employees, let their guard down. The more you understand how such scams work, it makes you better prepared for when they change tactics or attempt to exploit new weaknesses.
Why Credit Unions?
Cybercriminals know that credit unions hold a treasure trove of member PII (Personally Identifiable Information). By infiltrating a single staff member’s workstation via a fake “handbook” link, a hacker can move laterally through your network, potentially reaching core processing systems or member databases. There is a long history now of hackers attempting (and succeeding) in their pursuits of getting into credit unions and hospitals as they find these are companies with access to a lot of money and a lot of infrastructure that might be at risk of being phished.
How They Bypass Your Filters
You might wonder: “How does an external email show up as an internal one?” Most email is sent via SMTP (Simple Mail Transfer Protocol), which was designed decades ago without built-in identity verification. Think of it like a physical envelope; a scammer can write any “Return Address” they want on the back.
Hackers use “open relays” or specialized scripts to:
- Forge the “Display Name”: Making it look like “HR Department.”
- Forge the “From” Header: Making it look like
internal-comms@yourcu.org. - Exploit Weak DNS: If a credit union hasn’t strictly configured its email authentication records, the receiving server has no way of knowing the email didn’t actually originate from your mail server.
How to Protect Your Credit Union
To stay ahead of these “nefarious” attempts, we recommend a three-pronged approach:
1. Technical “Hardening”
The best way to stop spoofing is to prove the email is a fake before it hits the inbox. Ensure your IT team has implemented:
- SPF (Sender Policy Framework): A list of IP addresses authorized to send email on your behalf.
- DKIM (DomainKeys Identified Mail): Adds a digital signature to your emails to prove they haven’t been tampered with.
- DMARC (Domain-based Message Authentication): The most critical step. Set your DMARC policy to
p=reject. This tells other mail servers to completely block any email claiming to be from you that doesn’t pass SPF/DKIM checks.
2. The “Hover & Verify” Culture
Encourage staff to use the “Hover Test.” Hovering the mouse over a link (without clicking!) reveals the true destination URL. If a “Handbook” link leads to security-update-cu.top instead of your internal SharePoint, it’s likely a scam. This is also good advice with phishing sites in your browser, hover the mouse over any link online and your browser should show where it is pointed to. You can also RIGHT-CLICK a link and use the “copy link address” selection. Then you can use a reliable link checker, like NordVPN or Bitdefender.
3. Out-of-Band Verification
If an employee receives an unexpected, urgent request—especially one involving credentials or sensitive data—they should verify it through a different channel. Call the person, send a message on Teams/Slack, or walk down the hall. Never be afraid to ask directly if you were expected to do something or if the email is authentic. They should recognize that you are taking the informational security serious.
Also, be sure to notify your chain of command and IT when such emails come in so the credit union can stay vigilant. If one is contacted by such emails, then it is possible others will too. These scam artists tend to “guess” the email formula, i.e. “Joe@CUNAME.com” and apply it to others.
In the credit union industry, our greatest asset is our people, but they are also the primary target for hackers. By combining robust technical filters with a culture of healthy skepticism, we can protect our institutions and, most importantly, our members’ data.
Is your credit union seeing a rise in these specific types of “internal” phish? We’d love to hear your experiences on our social media.
