Loading story…
Credit unions and financial institutions are facing a surge in sophisticated fraud schemes that leverage social engineering and AI-driven tactics to compromise payment security. Attackers are increasingly using phishing, vishing, and smishing to harvest credentials and one-time passcodes, enabling account takeover and card-not-present fraud. Imposter scams, such as fraudulent calls and urgent messages, pressure victims into making instant, irreversible transfers through crypto ATMs or quick-pay apps. Security leaders emphasize the importance of real-time monitoring, member education, and advanced authentication methods—including tokenization and biometrics—to counter these evolving threats and protect members without degrading user experience.
Criminal organizations, including groups operating out of China, have orchestrated large-scale scams by sending deceptive texts about overdue tolls or postal fees to trick individuals into divulging credit card details. Stolen card numbers are then installed in digital wallets like Google and Apple Wallets in Asia and shared with U.S.-based accomplices to make fraudulent purchases. These operations have resulted in over $1 billion in losses over three years, highlighting the global scale and technical ingenuity of modern payment fraud. Early reporting by victims and rapid response by financial institutions are critical to stopping fraudulent transfers and involving law enforcement to mitigate losses.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
References published on October 28-29, 2025 discuss social engineering used to obtain people's credit card details and emphasize that earlier reporting can help credit unions stop fraudulent transfers more quickly. The provided content does not include enough detail to identify any earlier discrete incident, victim, or remediation event beyond these published discussions.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A dramatic increase in banking and financial scams has been observed globally, with a 65% rise in scam activity over the past year, according to data from BioCatch. Financial institutions serving nearly 350 million consumers across five continents have reported explosive growth in various scam types, including a tenfold increase in SMS-based phishing (smishing) attacks. Voice phishing (vishing) attempts have doubled, romance scams have risen by 63%, and investment scams have climbed by 42%. Purchase scams remain the most common form of fraud, with a 14% increase in attempts. The Global Anti-Scam Alliance estimates that consumers now lose over $1 trillion annually to scams, a figure that continues to escalate. Much of this surge is attributed to organized criminal operations exploiting the financial system, as noted by the U.S. Department of the Treasury. Scammers are leveraging current events and government programs, such as New York State’s inflation refund initiative, to launch targeted phishing campaigns. These campaigns often impersonate official agencies, urging recipients to provide sensitive payment information under the threat of losing their refunds. The phishing messages typically originate from foreign numbers and direct victims to fake websites designed to harvest personal data, including Social Security Numbers and bank account details. In the private sector, attackers are targeting users of popular financial platforms like Robinhood, sending convincing text messages that warn of suspicious account activity and prompt users to log in via fraudulent links. These fake login pages are crafted to closely mimic legitimate sites, and after stealing credentials, some even redirect victims to the real site to avoid suspicion. Additionally, credential phishing campaigns are evolving rapidly, with scammers impersonating Google Careers to target Google Workspace and Microsoft 365 users. These emails, sent in multiple languages and using frequently changing sender details, lure recipients into multi-step traps involving fake verification pages and credential harvesting sites. Attackers abuse legitimate services such as Salesforce and Recruitee to distribute these phishing emails, and the malicious domains are often newly registered to evade detection. The sophistication and adaptability of these scams make them increasingly difficult for both individuals and organizations to detect and prevent. Financial institutions and cybersecurity experts emphasize the need for heightened vigilance, robust anti-phishing training, and advanced fraud detection technologies to combat this growing threat. The widespread nature of these scams underscores the importance of cross-sector collaboration and public awareness to mitigate financial losses and protect sensitive information. As scammers continue to refine their tactics, the risk to consumers and businesses remains high, necessitating ongoing adaptation of security measures. The convergence of social engineering, technical deception, and exploitation of current events highlights the evolving landscape of financial cybercrime. Authorities and industry leaders are calling for increased investment in behavioral biometrics and real-time fraud monitoring to stay ahead of these sophisticated threats. The ongoing battle against banking and financial phishing scams is expected to intensify as attackers leverage new technologies and social trends to expand their reach.
Jun 29, 2026
Multiple reports describe **social-engineering scams** that impersonate trusted brands and payment providers to drive victims into credential theft or direct monetary loss. A “crypto compensation” lure abuses a legitimate-looking *Yandex* poll as an entry point, then redirects victims to a fake Bitcoin payout page claiming an approved `0.943 BTC` transaction and imposes a small “commission”/fee to withdraw funds—classic advance-fee fraud wrapped in a polished, multi-step funnel (including a fake chat “support agent”). Separately, Japanese-language phishing emails impersonating **ANA**, **DHL**, and **myTOKYOGAS** show consistent infrastructure patterns (notably `.cn` domains in sender and landing-page URLs), suggesting a single operator or shared kit targeting Japanese-speaking recipients. Several consumer scam advisories highlight **SMS-based fraud alerts** that push targets to call attacker-controlled phone numbers, where scammers pose as “support” to steal **Apple ID/2FA codes** or payment details, or to coerce victims into moving money. One PayPal-themed case escalated to cash withdrawals handed to a courier after a victim called a number from an unsolicited text, illustrating how “fraud department” pretexts can transition from phishing to **cash-out theft**. Additional warnings cover lookalike payment sites (e.g., `payyourbill.aps medical.com`) and generic guidance on what to do after clicking a phishing link; these are broadly consistent with the same theme (phishing/payment fraud) but are not tied to a single, specific campaign or actor across all items.
Jul 2, 2026
Security researchers have observed a significant evolution in digital identity fraud, with threat actors increasingly leveraging automation, AI, and coordinated infrastructures to perpetrate large-scale attacks. Fraudulent activities now include the use of synthetic personas, credential replay, and high-speed onboarding attempts, all orchestrated through systems that learn and adapt over time. Deepfake experimentation and document spoofing have become part of connected ecosystems, where machine-driven agents iterate on attack methods using feedback from failed attempts. This shift means that fraud is less reliant on skilled human operators and more on scalable, automated workflows, making detection and prevention more challenging for security teams. In parallel, the 2025 holiday shopping season has seen a surge in industrialized online retail fraud, with threat actors registering hundreds of fake domains to impersonate major brands and deceive consumers. These campaigns utilize automated tools to mass-produce convincing counterfeit websites, often promoted via social media, to harvest sensitive financial data and distribute malware. The infrastructure supporting these attacks is highly organized, allowing rapid deployment and evasion as domains are taken down. The convergence of these trends highlights the growing sophistication and scale of automated fraud, posing significant risks to both organizations and individuals.
Jun 30, 2026