We have been made aware of an active phishing text campaign in which you may receive a text message from an international number that mentions a disbursement from your account. It then asks you to click on a link to log into your account to verify the transaction. If you receive a similar text message, please take extra caution and do NOT respond or click any links.
Below are the red flags to keep an eye out for to help identify this scam:
- The texts are coming from different international phone numbers.
- The texts notify that an ACH was debited from your account, typically in the thousands of dollars.
- The text then instructs the client to cancel the disbursement if they did not request it, by replying “Y” and clicking on the link provided.
- The link’s URL is often a variation of a spoofed Schwab domain but could be ANY financial institution’s domain.
Be aware:
- Schwab and Fidelity do not notify clients about completed transactions via text message.
- Schwab and Fidelity do not send out text messages from international numbers.
- Keep in mind: Unlike many other attacks, smishing isn’t necessarily an indication that you have been compromised—the attackers send a message to a large number of randomly chosen phone numbers, hoping some of those people will respond.
Steps to follow if you suspect smishing:
- Do not click on any links or respond to the message.
- Take a screenshot of the text message and report it to the financial institution the scammers are claiming to be.
- Delete the text message.
- Add security measures to your financial accounts, such as two-factor authentication and verbal passwords.
- Report suspicious or fraudulent activity as soon as possible, including if you entered your credentials into a fake website.
- Note: If you click on the phishing link, run an anti-virus and anti-malware scan on your device immediately.
A couple more reminders:
- Do not click on links or attachments included in a text message.
- Slow down if a message is urgent. Urgent account updates and limited-time offers are red flags of possible smishing. Remain skeptical and proceed with caution.
- Avoid using links or contact information from the message. Go directly to the official channels/websites.
- Double-check the phone number. International numbers or odd-looking numbers, such as 4-digit phone numbers, are tactics that scammers use to mask their true phone numbers.
- Do not enter your Schwab credentials or other personal information via an unverified link. Instead, enter the address you are familiar with directly into your browser to visit the trusted website to log in as usual.
- Double-check that the URL is not a subtle variation of the real one.
- Do not call phone numbers received through unsolicited messages. Always use a verified number that you have used in the past or is found on your account statement.
We’re here to help. If you’re skeptical that a message may be a scam, please feel free to reach out to us. We’ll look into it on your behalf to help keep your accounts safe. Don’t forget to forward this email to your family, friends, or anyone who you think could benefit from its information!