Be on alert for account takeovers and other fraud schemes during the holidays, FBI warns
The FBI is telling us to be vigilant during the holidays as scammers are impersonating financial institutions to steal money or take over accounts.
It’s that time of year when we want to surprise our loved ones, overwhelming them with kindness, season’s greetings, and thoughtful presents.
It’s also that time of year when scammers and cybercriminals try to swindle gullible and unsuspecting victims with fake phone calls, fraudulent text messages, or counterfeit websites, causing hundreds or sometimes thousands of dollars in damages.
Since January 2025, the FBI’s Internet Crime Complaint Center (IC3) has received over 5,100 complaints regarding online fraud schemes, with losses exceeding $262,000.
The crime-fighting agency is warning people, businesses, and organizations that cybercriminals are impersonating accredited financial institutions across sectors to steal money or information in account takeover fraud schemes.
“The cybercriminal impersonates the financial institution’s staff or website to obtain access to the account. Cybercriminals usually gain access to accounts through social engineering techniques, including texts, calls, and emails, or through fraudulent websites,” IC3 says in a public service announcement.
For example, scammers pretend to be customer support or technical support personnel to manipulate an account owner into giving their login credentials, multi-factor authentication (MFA) code, or one-time passcode (OTP). The scammers then use these login credentials to log into a legitimate institution’s website and initiate a password reset, gaining full control of the account.
Another often-used tactic to trick victims into handing over their login credentials is phishing. Scammers send a fake URL to victims, redirecting them to a malicious website that looks like the legitimate one. But as soon as victims enter their login credentials, this information ends up in the hands of cybercriminals.
Lastly, the IC3 notifies Americans to be cautious of Search Engine Optimization (SEO) poisoning. Cybercriminals buy ads in search engines to increase the prominence of legitimate businesses to fool customers into thinking they’re actually visiting the official website. Instead, victims are redirected to a fraudulent phishing site that mimics the real website, tricking them into providing their login information.
The Internet Crime Complaint Center recommends being careful about what information you share about yourself online or on social media. In addition, monitor your financial accounts regularly and always use unique and complex passwords. Lastly, use bookmarks to log into websites and stay vigilant for any phishing attempts.
If you do get fooled and hand over your login credentials, contact the business or online platform to report what happened. Furthermore, reset your password and file a complaint with the IC3 and the impersonated company.