Fraudsters continue to target members in social engineering attacks to scam them into providing their online banking login credentials. There is some confusion in the industry about how these scams should be treated, since the members voluntarily provided their credentials. TruStage sheds light on how Reg E should be applied in these instances.

Several of these attacks were large scale in nature with over 1,000 members impacted resulting in seven-figure fraud losses. Some credit unions may be reluctant to recredit members under Reg E because the members voluntarily provided their login credentials to the fraudsters. Refusing to recredit members victimized in this scam violates Reg E.

The CFPB issued Electronic Fund Transfers FAQs in 2021 which clearly indicates that members victimized in this scam are entitled to Reg E protection and should be re-credited.

For more information and risk mitigation tips, read the full alert at: Trustage.com (Password and log-in required)