Security alerts: Learn what to look for

How you can help protect yourself:

• Do not engage with unsolicited calls, emails or text messages. If you’re unfamiliar with the caller or sender, do not reply, respond or communicate at all.
• Don’t click on links from unknown or suspicious numbers.
• Never give out any personal information, especially non-publicly available information such as account numbers, passwords, PINs or bank card and credit card numbers.
• Slow down and avoid any “urgent” requests. Be mindful of responding too quickly with personal or financial information.
• Remember: BMO will never contact you via unsolicited email, text, or phone call to ask for sensitive information, passwords, PINs, or verification codes (one-time passcodes).
• Review emails and URLs carefully. Emails and websites can look like they are from trusted companies, but if you review the email and URL carefully, you’ll notice a small difference like one extra letter, a period, or a .net instead of .com.
• Do not provide or update personal information through links or URLs received via call, text message or email. Bookmark the login page of legitimate company sites you visit regularly, such as BMO’s Online Banking, rather than using a search engine to locate them.
• Enable multi-factor authentication (also known as two-factor authentication or two-step verification) for online accounts when available.
• Choose passwords that are unique and complex. Avoid common passwords like “123456” or passwords that include obvious personal info. Your password should be at least 8 characters long and combine upper and lowercase letters and special characters (numbers and symbols).
• Avoid using free Wi-Fi in public places, especially if you need to bank, shop or work online.

Things you can do to protect yourself:

• Say no to unsolicited calls or emails. If you’re unfamiliar with the caller or sender, proceed with caution or avoid it altogether, even if they have information to try to convince you of legitimacy. If something doesn’t feel right, hang up immediately and call the company using a trusted phone number, such as the number on a legitimate company website.
• Never give out any personal information on unsolicited contact, especially non-publicly available information such as account numbers, passwords, PINs or credit card numbers.
• If a deal sounds too good to be true, it probably is – be skeptical.
• Slow down and avoid any “urgent” requests. Be mindful of responding too quickly with personal or financial information.
• Review emails and URLs carefully. Emails and websites can look like they are from trusted companies, but if you review the email and URL carefully, you’ll notice a small difference like one extra letter, a period, or a .net instead of .com.
• Be extremely wary of anyone requesting gift cards, money orders, or wires, as telecommunication companies don’t accept those forms of payment.
• Never provide remote access to your computer or mobile device.

What to look out for:

• Requests for you to provide or confirm any kind of personal or financial information.
• Requests to complete web forms with your personal information or to provide your signature on an agreement or contract.
• Requests that involve visiting a website, downloading an app, or providing remote access to your device.
• Watch for emails/texts/phone calls:
  • With generic greetings.
  • From unfamiliar or suspicious sources with fake links (hover over them to ensure they are going to the legitimate website).
  • That contain grammar or spelling errors.

What to look out for:

• Calls from, or on behalf of, friends or family requesting money, usually via methods that make it difficult to get your money back, such as:
  • wire transfers
  • cryptocurrency
  • gift cards
  • money transfer apps
• The request involves excessive urgency or pressure from the caller to act quickly.
• Unexpected or out of character behaviors or requests.
• Abnormal speech patterns in comparison to how an individual normally speaks (e.g., may sound like reading, more formal, more precise), longer-than-usual pauses between words and sentences, or the person’s voice sounding flat and lifeless.
• If you have concerns during a call, ask the participant questions that only the real person should be able to answer and that cannot be answered based on the person’s online presence (e.g., when was the last time they saw a mutual friend).
• Watch out for strange shadows, unnatural body language or background sounds that don’t match the speaker’s location.

How you can help protect yourself

• Stay vigilant and always verify the source of information.
• If you receive a suspicious email, call, text or video, verify the authenticity through a different contact method before taking any action.
• Just like other types of social engineering, emotional and urgency tactics may be used. Take a moment, take a breath, use critical thinking and consider how you can confirm what you’re being asked or told.
• Do not trust the name or phone number listed on the caller ID. This information can be easily manipulated by fraudsters to make a call appear as if it is coming from a family member or other trusted party.
• As a general best practice, if you receive an urgent or unusual call from someone you trust:
  • hang up and call them back using a trusted number
  • develop a family password that is only known by you and your close family members, and ask the caller for the family password

How you can help protect your business:

• Watch out for requests to take actions that are not aligned with approved company procedures. Validate information with your manager or colleagues over trusted channels that you initiate (e.g., phone call, MS Teams chat).
• Never respond to emails, texts or calls from unfamiliar companies or individuals without verifying the source.
• Train your employees to recognize deepfakes, especially if they are involved with your business’s finances or assets.
• Use multi-factor authentication on all systems to help prevent fraudsters from using a deepfake to hack your accounts.
• For employees who work with payments or financial information, if you get a call from a client to wire money, change payment/account information or modify addresses on file, always verbally validate requests by calling a known contact on a tenured phone number on file.

How to protect your account:

• Know that BMO will never call you and ask for your digital banking credentials, password, PIN, or OTP over the phone. You may be asked for your OTP but only when you initiate the call or contact with BMO, not when someone contacts you. If you receive a call asking for this information, hang up.
• Never share any of your passwords or passcodes with anyone.

What to Do if You Become a Victim

• Contact BMO immediately at 1-877-225-5266
• File a police report

Things you can do to protect yourself

• Use digital payments whenever possible, including BMO’s online bill-payment platform. Digital payments are highly secure, particularly when you have added your payees and can send electronic payments directly to them.
• Safeguard your accounts and stay on top of your finances by signing up for alerts or notifications from your bank, such as BMO Alerts. These types of alerts help keep track of your account activity and monitor for suspicious transactions. Learn more about setting up BMO debit card alerts, credit card alerts or small business credit card alerts.
• For businesses, enroll in "Positive Pay" which compares the checks businesses issue with those that are presented to be cashed. If there’s a mismatch because the check has been altered, the problem may be caught.

If you must use a print check, follow these steps to protect yourself:

• When mailing the check, deposit it inside your local post office or hand directly to a postal carrier. If it’s a large payment, consider using certified mail or signature confirmation upon delivery. Never put a check in your mailbox with the raised flag.
• When writing the payee’s name, use the entire line or draw a line to the end so that fraudsters are not able to add a name or more information to the check. Do the same when you write the payment amount in words and numbers.
• Be sure to sign your checks the same way every time. If the handwriting looks suspicious, it may hold up your payment for some time.
• If you write a check to “cash,” anyone can use it – so proceed with caution or avoid doing it altogether. Consider a digital money transfer as a more secure alternative.
• Use a gel pen to write your check; gel pens penetrate the fiber of the paper making it difficult for fraudsters to remove the ink.
• If you write many checks, use a separate account just for checks to closely monitor transactions and limit any potential losses.
• When depositing a check, only sign the back just before you’re going to deposit it. If using mobile deposit, be sure to write “for mobile deposit only” below your signature.

What to do if you have fallen victim to check fraud:

• Report fraud incidents to the Federal Trade Commission, your local police department or state’s Attorney General.
• Set up fraud alerts on your accounts and monitor them closely.
• If you notice any unauthorized activity on your bank account, report it immediately.

What to look for:

• Unsolicited calls, emails, text messages, or social media messages claiming to be from the IRS.
• Demands for immediate payment through gift cards, wire transfers, or cryptocurrencies.
• Use of aggressive language or threats to instill fear and urgency.
• Requests for personal information such as Social Insurance Numbers, credit card numbers, bank account information, or passport numbers.

How to protect yourself:

• Verify the caller’s identity: The IRS will not typically initiate contact with taxpayers via phone calls, emails, text messages, or social media for personal or financial information. Before sharing any personal information, request and take note of the caller’s name, phone number and office location, then end the call and contact the IRS using the official numbers or through the IRS websites to verify the caller’s identity. If confirmed to be legitimate, call the IRS employee back to discuss the reason for their call.
• Don't be intimidated: Never respond to threatening callers or messages. Hang up and contact the IRS directly using official numbers.
• Guard personal information: Do not divulge personal or financial information over calls, especially to unsolicited callers.
• Remember:
  • Official communication from the IRS is typically initiated through mail, not by phone or email.
  • No government agency will demand immediate payment, threaten arrest, or ask for personal information over the phone.
  • Stay informed and cautious. If you receive a suspicious call, hang up immediately and report the incident to the IRS through their official contact channels or to a local law enforcement agency.
  • Visit the IRS website to learn more about IRS scams.

Things you can do to protect yourself:

• Only donate to charities or groups whose work you know and trust.
• Beware of groups with names similar to reputable, well-known charities.
• Avoid using gift cards, cryptocurrency, or wire transfers for donations as requests for these forms of donations are more likely to be scams.
• Be suspicious of high-pressure or urgent requests to donate money.
• Before donating, research the charity to ensure it is legitimate. Use resources such as BBB Wise Giving Alliance, Charity Navigator or CharityWatch for additional information about how a charity spends donations and conducts business.

Things you can do to protect yourself:

• Only use legitimate wireless networks. Fraudsters sometimes set up fake Wi-Fi sites that look similar to the network you may be searching for. Some public Wi-Fi areas in airports and public areas post signs and placards for the legitimate networks—look for these.
• Avoid using free Wi-Fi in public places, especially if you need to bank, shop or work online.
• Use your home wireless network for important and sensitive browsing after you leave an area with public Wi-Fi. It is private and can be securely managed.
• Most wireless networks at coffee shops and airports are public, putting you at increased risk of a cyberattack.
• When possible, use a virtual private network (VPN) on public Wi-Fi and ensure your network is encrypted. A VPN routes your activity through a secure server before reaching the destination server and an attacker will not be able to view or access your information. Research and install a reliable VPN.
• When browsing the internet, always look for the or tune icon in the browser to help ensure the connection is secure. You may click on the icon to get information regarding the connection and validity of the site’s security certificate.
• Keep to HTTPS sites. HTTPS is the secure version of HTTP in the website address you are visiting. The ‘s’ stands for ‘Secure’ and all communications between your browser and the website are encrypted.

Things you can do to protect yourself:

• If you receive an unsolicited phone call about a problem with your computer, hang up. Legitimate tech support providers will not call you unless you reach out to them first.
• Never click on a pop-up ad or call a phone number in a pop-up or website warning you of issues with your computer; close the pop-up or website immediately.
• Delete any emails claiming there is a problem with your computer, ensuring you do not click on links or open attachments.
• Slow down and avoid any urgent requests as this is a common tactic in most scams including tech support scams.
• If you think there is a problem with your computer:
  • Update your operating system.
  • Install a reputable antivirus security software and run a scan.
  • Consult a knowledgeable friend, family member or reputable computer repair shop.
• Never log into financial accounts when using screen sharing or online remote access programs.
• Do not pay for tech support services using gift cards, wire transfers or cryptocurrency as these are likely scams.
• Keep your antivirus, web browsers and browser extensions up to date.

Things you can do to protect yourself:

• Review all emails, including those with QR codes, for signs of phishing such as requests for personal information, being pressured to reply to an urgent request or spelling and grammar mistakes.
• Be suspicious if the QR code leads to a site asking for personal, financial, or login information such as usernames and passwords.
• Do not scan QR codes found in public areas such as transit stations, shopping malls, or events, or those found on advertising or marketing materials (e.g., letters, flyers).
• Restrict privacy and security permissions for QR code scanning apps on your device (e.g., QR code scanning apps do not need access to your location).
• Configure your mobile device to ask for permission before performing QR code actions such as launching websites or joining Wi-Fi networks.
• Put security before convenience – manually type a URL into your browser rather than scanning a QR code.

Things you can do to protect yourself:

• Stay vigilant and don’t approach strangers or anyone in vehicles requesting money.
• Do not let anyone borrow or use your debit or credit card.
• Do not provide your personal information.
• If entering your PIN for any payments, cover the payment machine and the digits with your other hand.
• Check your online bank statements frequently and look out for suspicious activity or withdrawals.
• Sign up for alerts to monitor your banking activity.

Things you can do to protect yourself:

• Know the source: When buying or reselling tickets, only use official companies, brokers, and accredited sellers that are reputable and secure.
• Buyer beware: Research the seller and view customer reviews if available.
• Understand the refund policy: Ensure stipulations are clearly stated, should the event get cancelled, you decide not to attend, or you want to transfer your tickets to another buyer.
• Use secure payment methods: Make purchases with secure methods such as credit cards, as such payments may be reversed by creditors in cases of fraud. Wires and e-transfers cannot be reversed.
• Exercise caution online shopping: When sourcing tickets online, look out for phony websites. A website’s URL can appear like a legitimate company by using similar characteristics and subtle differences as a way of luring victims. Look for minor spelling differences and typos.
• Be vigilant using social media: When purchasing tickets from third parties or social media posts and users, be extremely wary and use your best judgment. Do not click on suspicious links embedded in emails or social media posts.
• Stay safe: Always meet in a well-lit public space if you are purchasing tickets from someone in person.
• Go digital: Accessing venues via mobile entry using a downloaded digital ticket is the safest method, as ticket barcodes are unique and constantly refreshed for protection. Paper tickets can be photocopied and replicated.
• For extra assurance: Verify purchases with the event host or at the site directly.

Things you can do to protect yourself:

Keep your mail and personal information secure; make it difficult for your mail to be stolen or tampered with. If thieves can’t access your mail, they can’t steal it!

• Buy and install a secure (locking) mailbox
• Get a security camera or camera-equipped doorbell that monitors your mailbox
• Retrieve your mail regularly - daily if possible - or ask a trusted person to do so for you
• Know your billing cycles and watch for any missing mail. Follow up if bills or new cards do not arrive on time
• Do not leave any outgoing mail with a method of payment or personal information in your mailbox
• Take bills to a post office rather than leaving them in your mailbox or placing them in a drop box outside a Post Office
• Take bills to a post office rather than leaving them in your mailbox or placing them in a drop box outside a Post Office
• Make the switch to paperless billing so important bills are never in your mailbox
• If possible, opt for electronic payments instead of receiving payments via check
• When expecting payment by check, contact the issuer for an expected ETA to make it easier to track payments
• If you’ll be out of town for an extended time, submit a request to have the post office hold your mail delivery until you return
• Sign up for free Informed Delivery^® to see incoming mail in your email so you know what can be expected to arrive in that day's mail

What to do if you have fallen victim to mail theft:

• Report it to your mail provider
• Report any fraud incidents to your state’s Attorney General and the Federal Trade Commission
• Set up fraud alerts on your credit reports and monitor them closely
• If you notice any unauthorized activity on your bank account, report it immediately

Things you can do to protect yourself:

• Say no to unsolicited calls or emails. If something doesn’t feel right, hang up immediately and call the company using a trusted phone number, such as the number found on the back of your BMO debit or credit card or a legitimate company website.
• Never give out any personal information over the phone. Do not give credit card information, banking account details, passwords, PINs, or one-time passcodes – regardless of how convincing the request may sound. Government agencies, banks and other legitimate organizations will never contact you asking for this information.
• Slow down and avoid any ‘urgent’ requests. Be mindful of responding too quickly with personal or financial information.
• Remember: BMO will never contact you via unsolicited email, text, or phone call to ask for sensitive information, passwords, PINs or verification codes (one-time passcodes).
• If you get a call, voicemail, email, or text from someone claiming to be from BMO and you think it’s suspicious, hang up and contact us immediately using the information on the back of your card.
• Register your telephone number on the National Do Not Call List.
• Additional tip: Bookmark the login page of legitimate company sites you visit regularly, such as BMO’s Online Banking, rather than using a search engine to locate them.

What to look out for:

• If the job involves depositing checks or transferring funds.
• If the job is being offered over email or text, with little or no recruiting process.
• If the posting involves words like "guaranteed" or phrases like "easy money" and "limited-time offer".
• If the job or job offer seems too good to be true.

What to look out for:

• Requests for upfront fees for assistance in avoiding foreclosure or modifying your mortgage
• Requests to transfer the deed of your home - it is unlikely you will get the deed back
• Requests to make future mortgage payments to a third party, instead of directly to your lender
• Requests to not contact your current lender
• Offers that involve high-pressure decisions that need to be made immediately
• Refusal to provide a written plan or contract

Things you can do to protect yourself:

• Only make payments directly to your mortgage lender. Never trust a third party to make payments for you.
• Understand what you are signing. If a document is too complex to understand, consult a lawyer or financial advisor. Never sign documents with errors, false statements or blank spaces that can be filled in later.
• Research the company or individual. Before handing over money or providing personal information, utilize resources such as the Better Business Bureau or your state's consumer protection office to determine if the company or individual is legitimate.
• Contact your mortgage lender directly. If you're having trouble paying your mortgage, contact your lender to determine what assistance is available.
• Be wary of “loan modification” or “mortgage modification” offers. Although these can be appropriate options to avoid foreclosure in some cases, they should only be negotiated with your lender or a reputable counselling agency.

What to look out for:

• Calls from, or on behalf of, friends or family requesting money, usually via methods that make it difficult to get your money back, such as:
  

• Wire transfers
• Cryptocurrency
• Gift cards
• Money transfer apps

• The request involves excessive urgency or pressure from the caller to act quickly

Things you can do to protect yourself:

• Do not trust the name or phone number listed on the caller ID. This information can be easily manipulated by fraudsters to make a call appear as if it is coming from a family member or other trusted party.
• As a general best practice, if you receive an urgent or unusual call from someone you trust, either:

• Hang up and call them back using a trusted number
• Develop a family password that is only known by you and your close family members, and ask the caller for the family password

• If you receive a phone call from someone claiming to be law enforcement, ask what agency, location, or facility they are calling from. Politely tell them you are hanging up and that you will call them back using a publicly available phone number.

What to look out for:

• Requests for personal information
• Requests to complete web forms
• A sense of urgency or consequence if you don’t respond quickly
• Emails, texts, letters, or calls from unfamiliar or suspicious sources
• Fake links, which can be identified by hovering over them
• Email addresses with misspelled or added characters
• Generic greetings instead of your name

What to look out for:

• The request comes via a phone call from a customer service agent who alerts you something is wrong with your account; they indicate they need to help you.
• The request involves a sense of urgency or has consequences for not responding quickly.
• The request involves providing or confirming any kind of personal or financial information (including credit card information).
• The request involves persuasion, pressure, or manipulation.
• The request involves visiting a website, downloading an app, or providing remote access to your device.

Things you can do to protect yourself:

• Say no to unsolicited calls or emails. If you’re unfamiliar with the caller or sender, proceed with caution or avoid it altogether. If something doesn’t feel right, hang up immediately and call the company using a trusted phone number, such as the number found on the back of your BMO debit or credit card or a legitimate company website.
• Avoid giving out personal information. Especially non-publicly available information such as social insurance numbers, credit card numbers, and account numbers. Do not respond to unusual requests for your personal or banking information. Remember, BMO will never contact you to request this type of information.
• Slow down and avoid any ‘urgent’ requests. Be mindful of responding too quickly with personal or financial information.
• Review emails and URLs carefully. Emails and websites can look like they are from trusted companies, but if you review the email and URL carefully, you’ll notice a small difference like one extra letter, a period, or a .net instead of .com.
• Be wary of anyone requesting gift cards, money orders, cheques, or wires. If anyone is requesting these types of payments, the likelihood of fraud may be higher.

Things you can do to protect yourself:

• Do not use search engines to find the login page for BMO Online Banking. Instead, visit bmo.com, select SIGN IN, and choose the appropriate login page for your needs.
• Always verify links in search results – fraudsters will create malicious websites that appear to be legitimate but will change a single letter or use a different domain (e.g., xyzbank.org when it should be xyzbank.com).
• Bookmark important websites such as financial institutions to avoid the need to search for them.
• Install IBM^® Trusteer Rapport^®, free software that checks whether the website you’re using is legitimate.
• Keep your antivirus, web browsers, and browser extensions up to date.
• Enable multi-factor authentication (also known as two-factor authentication or two-step verification) for online accounts when available.
• Read through other alerts listed on this site to learn more about recent scams.

Tips to protect your business:

• Purchase domain protection services that notify you when domains with names similar to yours are registered so they can be shut down.
• Pre-emptively register variants of your domain name so fraudsters are unable to do so.
• Educate your customers about the importance of verifying a website's address before selecting on search results.
• Read through other alerts listed on this site to learn more about recent scams.

What to look out for:

Phishing:

• Requests for personal information
• Requests to complete web forms
• A sense of urgency or consequence if you don’t respond quickly
• Fake links, which can be identified by hovering over them
• Generic greetings instead of your name
• Emails, texts, or calls from unfamiliar or suspicious sources
• Email addresses that are inconsistent with the legitimate company’s email domain (e.g., john.smith@bmo.org when it should be john.smith@bmo.com) and email addresses with misspelled or added characters

Business Email Compromise:

• Requests that involve excessive urgency, persuasion, pressure, or manipulation
• Requests to change destination payment information, including account number, phone number, address, country
• Requests to send funds to a new/different account that does not match your existing records

Things you can do to protect yourself:

• Learn common social engineering ploys and methods of cyber and fraud attacks
• Slow down – don’t select links or respond to emails that appear suspicious or unusual
• Always verbally validate requests by calling a known contact on a tenured phone number on file; do not use the phone number provided in the email

What to look out for:

• Alerts from your bank through text message – do not open any links. If you receive an alert from BMO over text that does not match the above description, delete it and call BMO using the number on your card.
• Never select any links in a text from an unknown source.
• Never log in to a select website from a text or email.

See our full list of tips below for more ways to stay protected.

More information on BMO Alerts

Please note: You may receive SMS alerts from BMO if suspicious activity on your bank account or credit card is detected. These alerts will include the last four digits of your card number OR the last three digits of your bank account number and may provide the option to reply “Y” on recognizable transactions or “N” for transactions you do not recognize.

If you reply “Y”, you may receive a confirmation code or message from BMO. Note that we will never call to ask for the confirmation code. If anyone contacts you for the code, or you received a code you didn’t request, call us immediately at

. If you reply “N”, you’ll receive a follow-up message notifying you that your card is restricted; in this case, please call BMO at

.

You can update your BMO alerts settings and view a list of all alerts BMO has sent to you in the past 60 days on the BMO mobile app by signing in and going to More > Alerts.

Things you can do to protect yourself:

• If you get a call, voicemail, flyer, email or text from someone claiming to be from BMO and you think it’s suspicious, contact us immediately using the information on the back of your card. Please don’t share any personal information.
• Note that no employee or authorized agent of BMO or BMO Private Wealth, or any related entity, is in any way associated with the investment opportunities or products offered by these fraudsters.
• If you are contacted by fraudsters posing as financial advisors and offering you lucrative investment opportunities, you are encouraged to report it to:
  • Your financial institution
  • The Federal Trade Commission
  • local police authorities
• If an investment deal sounds too good to be true – it probably is – be skeptical.
• Research any investment opportunity as well as the individuals or companies involved. Check for official credentials and check email addresses carefully to ensure they are legitimate.
• Do not disclose personal information (over the phone, text or in a website) if you did not initiate the contact. Always remember that BMO will never contact you via unsolicited email, text or phone call asking for sensitive information, passwords, PINs or verification codes (one-time passcodes).

What to look out for:

• Requests for you to provide or confirm any kind of personal or financial information (including credit card or bank account information).
• Requests to send funds through an intermediary or to an account at an institution different than the one the ‘financial advisor’ works at.
• Requests to complete web forms with your personal information or your signature on an agreement or contract.
• Watch for emails/texts/phone calls:
  • With generic greetings.
  • From unfamiliar or suspicious sources with fake links (hover over them to ensure they are going to the correct website).
• Be on the lookout for email addresses that are inconsistent with the legitimate company’s email domain (i.e., john.smith@bmocanada.com vs. john.smith@bmo.com) and email addresses with misspelled or added characters.

Things you can do to protect yourself:

• Stay informed – stay informed of the current fraud threat landscape and trends.
• Have someone check on your property – appoint a trusted source to house-sit or frequently monitor your property if you will be away for a significant period.
• Get title insurance – acquire a property protection policy and make sure it reflects the current value of your home; a one-time premium safeguards homeowners and lenders from title or ownership losses in a fraudulent event.
• Protect your property if you decide to rent – If you rent out your property, do your due diligence when screening tenants.
• Get a secured line of credit – debt or a line of credit on a property deters fraudsters from committing title fraud, as it makes the transaction more complex and less profitable for them.
• Protect your personal information – properly shred unnecessary confidential and personal documents and store all essential contents in a safety deposit box or digitally secure, password-encrypted file. Do not respond to unusual requests for your personal or banking information.

• Limit your personal information sharing and be mindful of who you do share it with.
• Review your credit card and banking statements regularly. Always report any unusual activity to your bank immediately.
• Ensure confidential and sensitive personal documents are shredded before disposing of them.
• Frequently collect your mail from exterior mailboxes to decrease mail theft.
• Create complex passwords that identity thieves cannot guess. Change your passwords if a company that you do business with has a breach of its databases.

Things you can do to protect yourself:

• Look out for gift cards and/or gift card packaging that has been tampered with. Make sure the pin on the card has not been scratched off or the sticker to reveal the card number hasn’t been previously removed.
• If you must activate your gift card online, only do so using the exact website on the back of your card. Scammers can create similar activation sites to collect your gift card information and funds.
• Do not give information to anyone calling and asking for your gift card information or payment via gift card. Government agencies, banks, and other legitimate organizations will never contact you for this information.
• Do not share your gift card number and/or PIN aside from when redeeming at a legitimate company (in person or online).
• Ensure gift card details match the information reflected on the cashier’s terminal and receipt.

What to look out for:

• Be extremely wary of any unsolicited investment advice, particularly from someone you’ve only interacted with online.
• If someone you’ve been messaging with consistently declines to interact face-to-face in video chats, they likely aren’t the person from the profile photo.
• Be cautious if you are encouraged to download specific software to supposedly assist with transferring funds or purchasing crypto assets.
• Be wary of text messages or social media outreach from people you don’t know or have an in-person relationship with.
• Watch for emails/texts/phone calls:
  • With generic greetings.
  • From unfamiliar or suspicious sources with fake links (hover over them to ensure they are going to the correct website).

How you can help protect yourself

• Say no to unsolicited calls, emails or text messages. If you’re unfamiliar with the caller or sender, do not reply, respond or communicate at all.
• Never give out any personal information, especially non-publicly available information such as account numbers, passwords, PINs or credit card numbers.
• Slow down and avoid any “urgent” requests. Be mindful of responding too quickly with personal or financial information.
• Review emails and URLs carefully. Emails and websites can look like they are from trusted companies, but if you review the email and URL carefully, you’ll notice a small difference like one extra letter, a period, or a .net instead of .com.
• If an investment deal sounds too good to be true, it probably is.
• Research any investment opportunity as well as the individuals or companies involved. Check for official credentials and check email addresses carefully to ensure they are legitimate.
• Although the most prevalent form of this scam currently involves cryptocurrency, this type of fraud is evolving daily. Be aware that any situation involving unsolicited contact from strangers or requests to send money to people you don’t know could be a scam.

What to look out for:

• The request involves using electronic money transfer (EMT) to send money to yourself.
• The request involves excessive urgency, persuasion, pressure, or manipulation.
• The request involves sharing a one-time code.
• You are unable to validate the phone number that supposedly comes from your bank.

What to look out for:

• The request involves a sense of urgency or has consequences for not responding quickly.
• The request involves providing or confirming any kind of personal or financial information (incl. credit card information).
• The request contains fake links or spelling errors in the email address or content.

What to look out for:

• The request involves excessive urgency, persuasion, pressure, or manipulation.
• The request involves providing or confirming any kind of personal or financial information (incl. credit card information).
• The request involves visiting a website, downloading an app, or providing remote access to your device.
• You receive any unsolicited calls that require “urgent action,” hang up immediately and call the institution or company using information from their website.

What to look out for:

• If the request involves excessive urgency, persuasion, pressure, or manipulation.
• If the request involves an address or a bank account you’ve never used before.
• If the address or bank account details don’t match your existing records.

What to look out for:

• If you are unable to validate the investment firm’s reputation or the representative’s professional background by conducting independent research, checking additional sources, and looking at their history and track record.
• If the investment representative encourages you to download specific software to supposedly assist with transferring funds or purchasing crypto assets.
• If an advertisement contains language guaranteeing high returns on investments or offering free money, it’s likely not legitimate.
• If the cryptocurrency investment is heavily promoted on social media platforms and messaging apps, as fraudsters often use these platforms to advertise phony cryptocurrency investment opportunities.
• If a company offers to recover funds lost to cryptocurrency fraud; this is often a secondary scam.

What to look out for:

• If someone pays you more than the price that you agreed on.
• If they immediately request reimbursement for part of the payment.
• If the transaction involves unusual shipping, processing, or customs fees.

What to watch out for:

• Companies that ask you to prepay with a gift card or prepaid debit card.
• Deals or promotions that are too good to be true. If you’re suspicious about a deal or promotion, verify with the rental car company by visiting the official website and calling the number on the site.