WARNING: New Email Scam on USAA Members

345, 06 Nov 2011

From a USAA Notification:

USAA is investigating an e-mail phishing scam that attempts to collect users’ sensitive information.

Members have received a recent email claiming to be from USAA with the subject line: USAA Protection Alert. In an elaborate scheme, the email informs members about a failed usaa.com login attempt and to click on a link to update their identity. Clicking on the link directs the member first to a counterfeit website to log on. Logging on produces the second website, asking for a PIN. Clicking “Next” produces another website asking for the member to set up security questions and after clicking “Next” again, a final website opens, asking for the member’s sensitive information including:

Card Holder’s Name*
Card Number
Expire Date*
Card Verification Code*
Billing Address*
Billing Zip Code*
Billing Phone Number*
Email Address*
Email Password*

Although the e-mail includes a USAA logo and appears to be from USAA, it is not. USAA will not ask for any personal or account information, including PINs or passwords, in an e-mail.

Upon closer scrutiny, you will notice the Security Zone in the counterfeit email does not include the member’s name or the last four numbers of the member account number. Additionally, the salutation does not address the member by name.

If you are suspicious about any e-mails or websites claiming to be from USAA, please notify us immediately at abuse@usaa.com.

Valid USAA websites use Extended Validation (EV) certificates which are an authentication method that turns the Web address bar green, helping you to establish you are visiting a legitimate website. With EV certificates it’s more difficult for an imposter site to appear authentic. The address bar should be Yellow or Red if there is a problem validating the website. For more information, please visit the USAA Security Center to learn about Safe Site Entry.

(if you wish to post a comment on this bulletin, please log in)