Please be vigilant and act with caution should you receive an email alerting that your automatic ACH payment failed, or that your ACH details must be updated. This could be a ploy to steal your bank account details. Many people schedule their monthly utility bills, subscriptions and other services to automatically pay from a bank account each month. These automatic withdrawals from your checking or savings account are called Automated Clearing House (ACH) payments. Your service provider must store your bank account details on their internal computer system to withdraw these monthly payments. Hackers understand this process and attempt to exploit weaknesses in the process to commit cybercrime. The most common method hackers use is to send forged emails that redirect victims to fake websites that steal payment information. 

First, the hacker creates a website that mimics your utility company or service provider’s website. The counterfeit website may even have a login page and branding like the service provider. The website will also have a web page that collects ACH or credit card information. After the counterfeit website is up and running, the hacker sends forged emails to victims that impersonate the service provider warning of issues with ACH processing. The forged emails include a button or link that victims click on which takes them to the counterfeit website. After victims arrive at the website, they enter their banking details falsely believing that they’re on the service provider’s website. The victims may also leak their login credentials on the counterfeit website login page. This terrible cybercrime is a very deceptive practice that leads to millions of dollars in financial losses because this crime is often successful. 

How to Avoid Getting Duped?

• Carefully inspect ACH notifications that you receive and verify that they are authentic and from your service provider
• Never click on buttons or links in any ACH notification email
• Go directly to your service provider’s website by typing their website address into a web browser or use a saved bookmark to review and update your account details
• Never initiate login or account updates from a button or link in an email
• Report the email to your email provider as a “Phishing” email if you believe it is a fake or forged email

Lastly, if you believe your online account was compromised, immediately contact the service provider and request they open a fraud investigation.