CCCSMD strives to protect consumers from becoming victims of scams, and awareness is the first line of defense.  When people think of scams, they most often think of personal attacks to their identity or finances.  However, as fraudulent activity increases, so do the attack methods and individuals are not the only demographic being targeted.  Business, including nonprofit and volunteer organizations, are also targeted by scammers and can result in substantial financial harm.  One of the groups recently targeted are fire departments and the community members who support them.

Like nonprofits and small businesses, most volunteer fire departments work hard for the funding necessary to purchase and upkeep expensive equipment. With fire departments, the equipment is critical to fighting fires and keeping the firefighters safe. Scammers are also working hard to take that crucial cash away from them. Here are three examples of recent scam attempts to be aware of so you and your community can stay safe.

MALWARE AND OVERPAYMENT PHISHING SCAM

An afternoon in early July 2022, Phil Saxton, Treasurer for the Fleetville Volunteer Fire Department in Northeastern PA, was completing some of his monthly duties when he received an email purportedly from PayPal.  The email stated the fire company had a $278 of charge to the company’s PayPal account for Bitcoin purchases.

“We would not be buying Bitcoin at all,” said Phil. “And our PayPal account is used to bring money in, not pay money out.”

Following contact information provided in the email, Phil soon was talking to someone over the phone who told him there were two separate transactions on the account for Bitcoin, totaling $800.  In order to fix the wrongful charge, Phil was instructed to fill out a digital form where he only had to enter the amount to be returned.

“My suspicion really started to peak when I tried to enter $800 on the form provided, it would fill in at $80,000 and the computer locked up,” said Phil.  “The scammer stated he is working with someone at “World Bank” to fix the issue with the amount on the form.”

The man on the phone was attempting to keep Phil calm and patient on the phone but Phil was suspicious and suggested other measures should also be taken to refund the money, such as contacting the company’s bank.

“When the scammer stated to not contact our bank about it, that was the last straw.  I said I’m calling the police and hung up.  I immediately called our bank and froze all accounts,” added Phil.

Phil spent 4 hours with the bank clearing everything up. The bank confirmed that someone moved $80,000 from the fire company’s savings account to its checking account. The scammers intentionally rigged the form to show $80,000 regardless of the amount Phil entered so that the amount on the form would reconcile to the bank transaction. The scammers likely gained access to Phil’s computer while he was filling out the form, allowing them to move money between the bank accounts.

“The banker told me they [the scammers] would have likely tried to get us to send them a check or transfer for the difference, [$79,200] for what they made look like a gross overpayment, but it was all the fire company’s money the whole time,” said Phil.

Although no money was successfully taken by the scammers, the ordeal cost a dozen volunteer hours to work through bank and accounting issues and about $300 to get a company to clean the computer, to remove any malware that could have been installed by the scammer.

Although this incident occurred in Pennsylvania, it is not isolated. The Howard County Office of Consumer Protection in Maryland advises consumers, nonprofits and the business community to be wary of unsolicited emails. Criminals are great at creating realistic looking emails and websites.  You can hover over the sender’s email and if it doesn’t exactly match your bank or financial account holder, then it’s a scam. If after reading an unsolicited email you are concerned that there may truly be account fraud, contact your bank at a phone number you already had. As in this example, scammers give their own phone number in phishing emails.

POLITICAL ACTION COMMITTEE (PAC) SCAM

In Montgomery County, MD an alarm went off in 2019 for a scam that has since gone national.  People received calls from someone claiming to call on behalf of the local Volunteer Firefighters Association and raising money for the local fire department. The scammer appeared legitimate as they knew the name, number and address of the person they were calling, some details about their local fire department and the call was spoofed to appear to be coming from a local phone number.

The Montgomery County Office of Consumer Protection (OCP) research showed that this fraudulent business model has been, and is currently being, duplicated by other political action committees and telemarketing businesses nationwide. The OCP stated that when you answer the phone you really don’t know who is on the other line and you cannot trust caller ID. They added that you should not act right away, take time to do research, and if it sounds legit then call back.

The County acted against the fraudulent PAC through a settlement agreement which barred the PAC from soliciting in the county and to offer a full refund to consumers who fell victim to this scam. However, scams like this continue throughout the country.

Volunteer Fire Companies do need financial support from their communities. If you are unsure of how legitimate a fundraiser may be, call your local fire company directly or check their website to be sure.  You can also contact your local government office as they will often know what fundraisers are ongoing with the fire company.

SMISHING SCAM (PHISHING through SMS)

In August 2022, some residents in Pennsylvania started receiving text messages with a link. In Schuykill County, the text message read “Shenandoah Heights Fire Co. shirt $10 OFF ready to order now” with a link that followed. Although the fire company recently had conducted a shirt sale, Shenandoah Heights Fire Co. Chief Steven Quinn told local media that sales were not made digitally, and these texts did not originate from or were endorsed by his fire company.

This same scam has been repeated in many other states.  Not only did this scam use other fire companies but many other organizations as well, to include military units.

The Howard County Office of Consumer Protection advises that if you get a text message from an unknown source, even if it names an organization you support or are a part of, you should not click on or open any links.  As with the above phone scams, contact your organization directly to check the legitimacy of unsolicited text messages.  Also, forward the smishing attempt to the Federal Trade Commission by forwarding the text to 7726 (SPAM).