Text Message Phishing: The Fake Credit Union Alert

A text said "verify your account," and the link led to a copy of a credit union's site. The Alabama case shows what happens once you enter a PIN.

By Siddharth ShankarUpdated October 11, 2026

Phishing by text message is often called smishing. It works because a text feels personal and urgent, and the link opens in a mobile browser where it is harder to inspect. A 2019 Alabama case is a clear example of how it can be turned into cash.

What happened

The Justice Department says Iosif Florea, 42, of Phoenix, pleaded guilty to bank fraud and aggravated identity theft and was sentenced to 32 months plus three years of supervised release. He was ordered to pay $17,786.50 in restitution. The scheme took place in March and June of 2015, and the sentence was announced in February 2019. The Alabama Attorney General's Office and the FBI investigated.

How the scheme worked

Text messages went to nearly 500,000 people in Alabama. They linked to a fake website that claimed to be the Alabama State Employees Credit Union and asked recipients to "verify account information." The site asked for names, debit card numbers, expiration dates, security codes and PINs.

The stolen data was then loaded onto blank cards. The release says videos showed the man withdrawing cash from ATMs in Phoenix, Los Angeles and Las Vegas, using cards tied to about 30 accounts.

Why a text can be so convincing

A text that names a real local credit union does not need to be sophisticated. Many recipients are members, and some will be worried by an alert about their account. The mass send also means that even a very low response rate produces a number of victims. At this scale, nearly 500,000 messages need only a tiny fraction of replies to be profitable.

What was exposed

The exposure was complete card data: number, expiry date, security code and PIN. That is everything needed to make a copy and use it at an ATM. The page does not give the total number of victims or the full amount stolen, only the restitution ordered.

How it ended

The case ended in a conviction, a prison term and a restitution order. The outcome is mixed. The sentence addressed the person who cashed out, and the restitution amount is modest next to the size of the mass text campaign. We do not know from the release whether others were involved.

A timeline of the case

The scheme took place in March and June of 2015. The sentence was announced in February 2019, nearly four years later. During that period, the cards cloned from the stolen details could be used at ATMs in several cities, as the release's mention of Phoenix, Los Angeles and Las Vegas shows.

The gap is a reminder to act fast. If you ever enter card details on a page you doubt, call your bank right away. The sooner a card is blocked, the less time a cloned copy has to be used.

Key facts at a glance

• Sentence: 32 months plus three years of supervised release
• Restitution: $17,786.50
• Texts sent to: nearly 500,000 people in Alabama
• Data requested: names, card numbers, expiry dates, security codes and PINs
• Cash-out: ATMs in Phoenix, Los Angeles and Las Vegas
• Accounts used: about 30

What to do with a bank text

What the release does not say

The release does not say how many people entered details or how the numbers were chosen. For a UK case involving fake text messages, read our report on the fake Covid tax-refund texts.

Your own exposure is the part you can still change. These guides cover how to tell a real breach notice from a phishing message, how credential stuffing works and what to do after your email appears in a breach. You can also try our free email exposure check.