25/09/2026
We wish to alert our members to a recent fraud incident involving a sophisticated social engineering attack targeting another Credit Unions members online banking account.
Their Member received a text message yesterday evening claiming to be from their Credit Union, advising that their account had been suspended due to suspicious activity. The Member reported that the message appeared genuine and closely resembled similar texts received in the past.
The Member subsequently received telephone calls from individuals claiming to be from the credit union. The callers were polite, spoke with Irish accents and appeared credible. The fraudsters informed the Member that they were investigating suspicious activity on the account and directed them through a process which ultimately resulted in the Member providing online banking credentials and a one-time passcode.
Using this information, the fraudsters were able to gain access to the Member's online banking profile, establish a new payee and initiate unauthorised payments from the account. The activity was subsequently detected through transaction monitoring controls in their Credit Union.
Observations from the Incident
β’ The attack involved a combination of text messages, telephone calls, and the capture of a one-time passcode.
β’ The member described the text messages and website as appearing genuine and similar to legitimate credit union communications.
β’ The fraudsters-maintained contact with the member over a number of hours, reinforcing the impression that they were dealing with a genuine account security issue.
β’ The callers appeared professional, had Irish accents, were not aggressive, and sought to build trust by presenting themselves as assisting the member.
β’ The Member believed they were taking steps to protect their account rather than facilitating unauthorised access.
At Mallow Credit Union we may message you from time to time, but we will never ask for a PIN code or passcodes.
If in doubt, pause, hang up and ring us on the land line number listed on our website.