Security researchers have documented a rise in a fraud technique targeting credit union members: instead of hacking into banking systems, criminals gather personal information from data breaches, social media, and public records — then use that information to impersonate real members and take out loans in their names. Victims often find out months later when a debt collection notice arrives or their credit score drops unexpectedly.
Credit unions are popular targets because they tend to have strong member trust and sometimes rely on older identity-verification models. The fraudsters are not stealing your password — they are piecing together enough details (name, address, date of birth, the last four digits of your Social Security number) to convince a loan officer that they are you. The best defense is monitoring your credit before a loan shows up on your record.
How to check if you’re affected
- Pull your free credit report: Visit
annualcreditreport.comand download your report from all three bureaus (Equifax, Experian, TransUnion). Look for any loan accounts or hard inquiries you do not recognize. This is available free once per week. - Freeze your credit: A credit freeze is the single most effective defense against new accounts being opened in your name. Freeze your credit on all three bureau websites — it is free and can be unfrozen in minutes when you need a loan yourself.
- Check your credit union’s mobile app or online portal: Log in on your device and look at your accounts section. If you see a loan you never applied for, call the credit union immediately using the number on the back of your card.
- Set up alerts: Most banks and credit unions let you enable text or email alerts for new account applications. Enable them in your online banking settings or on your device’s banking app.
- Check data-breach exposure: Visit
haveibeenpwned.comand enter your email address to see if your personal details have appeared in known breaches that fraudsters may be using.