The combination of familiarity plus urgency is exactly what makes these scams effective. Below, we'll outline how these scams work, how to spot them, and what to do if you receive a similar call. 

Impersonation Scams, Defined

Impersonation scams are identity theft in reverse. Instead of stealing your identity, a criminal borrows ours. They pose as America’s Credit Union or any bank or credit union, hoping the borrowed credibility will lower your guard long enough to get what they want. This is typically your digital banking login credentials, a verification code, or a direct transfer of funds.

Scammers make this tactic convincing by doing their homework. They pull bits of real information from breaches, social media, or past attempts, so the call or text doesn’t feel random. It feels personal, which is exactly the goal.

The two most common channels are your phone (home or cell) and text messages to your mobile phone. 

Vishing Defined

The term blends "voice" and "phishing" and describes a live phone call where someone impersonates a credit union or bank representative, fraud investigator, or IT support. They are good at keeping a conversation going, which is their weapon. A skilled scammer will keep you talking, escalate your alarm, and steer you into reading off a code or confirming a "security question" before you have a chance to hang up and think.

Smishing Defined

Swap the phone call for a text message, and you've got smishing (SMS + phishing). These messages tend to be short and action-oriented: "Unusual activity detected - reply STOP to block" or "Your account has been paused, verify here [link]." The brevity is intentional; a text gives you less room to pause and question than a conversation does, and a rushed tap on a malicious link can land you on a cloned login page built to harvest your credentials.

So What Actually Separates the Two?

Same playbook, different delivery:

                                                                                      Vishing                                                                                             Smishing

Channel                                              Live phone call                                                               Text message

Main tactic                       Real-time conversational pressure                  A link or reply designed for a quick, unthinking tap

How to stop it          Hanging up and calling back independently        Never tapping the link, going to the site yourself instead

In practice, scammers frequently blend the two: a text pointing you to "verify" by phone, or a call following up on a text you never requested. Regardless of the sequence, the objective doesn't change. They want you to hand something over before logic catches up with adrenaline.

Can Scammers Really Make Their Number Show Up as Ours?

Yes, and this trips up even the most cautious people. Through a technique called caller ID spoofing, a scammer can program their outgoing call to display virtually any name or number, including our legitimate support line. No hacking of our systems is required; it's a manipulation of what your phone shows you, not proof of who's actually calling. In short: a familiar name on your screen tells you nothing about who's really on the other end.

So Would America’s Credit Union Actually Call Me?

It's possible. Legitimate fraud monitoring occasionally does involve an outbound call or text. But here's the line that never moves.  We will not ask you to read us your full password, your PIN, or a one-time passcode over the phone or via text message. Any request for that kind of information, dressed up as "verification," is the clearest signal you're not talking to us.

Confirming a Call Is Really From Us

Rather than trying to prove or disprove a caller's identity mid-conversation, take the decision out of that moment entirely:

  1. End the call. A genuine representative will never be offended by this.
  2. Dial us back yourself, using any number on our official website (AmericasCU.org) or  888.742.6551.  Do not use a callback number the caller provided.
  3. Skip links sent via text. Open our app or type our web address in manually instead of tapping through a text message that you received.
  4. Trust the pattern. If they're requesting a password, PIN, or one-time code, their script's sophistication doesn't matter. It's a scam.

This small delay, calling back on your own terms, is worth far more than any explanation the caller can offer you live.

Building Habits That Keep Scammers Out
  • Build in a pause. Urgency is a manufactured pressure tactic, not a legitimate reason to skip caution.
  • Treat caller ID as unreliable. It can be faked, so don't let it vouch for anyone.
  • Guard your codes fiercely. No legitimate party, us included, needs your password, PIN, or one-time code read aloud.
  • Turn on account activity alerts in your app or in online banking so you're the first to know about unusual activity, not the scammer.
  • Mind your digital footprint. Publicly shared details make impersonation attempts more convincing, so keep sensitive specifics off social media.
  • Loop in family, particularly anyone who might be an easier target, so the whole household recognizes these tactics.
If You've Been Targeted, Here's Where to Turn
  • Disengage immediately. Hang up the call or leave the text unanswered.
  • Contact us directly through a verified number or on our website.
  • File a report with the FTC at ReportFraud.ftc.gov.
  • Forward smishing texts to 7726 (SPAM) so carriers can track the source.
  • If you shared any sensitive details, reach out to us right away so we can help lock things down.
We're Here to Help

No one should feel foolish for almost falling for a scam that's engineered by professionals to fool smart, careful people. If something about a call or text ever feels off, trust that instinct and hang up. Reach out to us directly, and let's sort it out together. We'll always welcome the extra call to double-check.