Skip to main content
Join | Promotions
Summit CREDIT UNION
Investment Services
Summit Realty
A couple reviewing account paperwork together at a laptop

Security Center

Most account takeovers begin with a convincing phone call, not a hacked server. Here is how to spot one.

Report fraud now Read the FAQ

Four things Summit will never ask you for

A one-time code we texted you. Never, for any reason →
Your full password, PIN, or the CVV printed on your card →
Money moved to a "safe account," gift cards, or crypto →

Hanging up on us is always the right move

Caller ID is trivially spoofed, so a call showing our number proves nothing at all. If anything feels off, end the call and dial 800.555.7846 yourself. When the first call was genuinely ours, the agent sees the note on your account and picks up right where the last one left off. No Summit employee will ever be annoyed that you verified.

Know the pattern

The six scams our fraud desk sees most

Each one works by manufacturing urgency so you skip a step you would normally take.

The spoofed fraud department Caller ID shows our number. They read off a fake charge, then ask you to confirm the code we just texted. That code is a password reset, and reading it aloud hands over your account.
Payment app reversal A stranger says they sent you money by mistake and asks you to send it back. The original payment was funded with a stolen card, so it gets clawed back and your refund leaves with it.
The overpaid check A buyer, employer, or landlord sends a check for more than owed and asks you to wire the difference. Funds availability is not the same as a good check; the forgery surfaces days later and you owe the full amount.
Romance and long-con investment Weeks of friendly contact, then a can't-miss trading platform that shows fake gains. Withdrawals require a "tax deposit" first. Our largest single member loss last year began this way.
Utility or tax shutoff threat A caller claims your power is being cut or a warrant issued unless you pay within the hour, usually by gift card or crypto. Real agencies bill by mail and never take payment in retail gift cards.
Card skimming at the pump A reader glued over the real slot copies your stripe while a pinhole camera records the PIN. Tug the reader before inserting, pay inside when you can, and prefer tap or chip over swipe.
What is running for you

Protection included with every account

None of this costs extra, and most of it takes under a minute to switch on.

Two-factor and passkeys Every new device has to prove itself before it reaches your accounts. Choose an authenticator app or a passkey over text codes, since a criminal who talks your carrier into a SIM swap can intercept a text.
Alerts you configure Set push or email alerts for any transaction over an amount you pick, for every card-not-present charge, and for password or address changes. Alerts are the cheapest fraud detection available to you.
Card controls in the app Freeze a card the moment you misplace it and unfreeze it when it turns up in a coat pocket. You can also block international use, online purchases, or ATM withdrawals per card.
Real-time authorization scoring Every card authorization is scored against your history before it posts. Out-of-pattern charges trigger a text you reply to. No reply means we decline and call the number on file.
Zero liability Report unauthorized card use promptly and you are not out the money. Provisional credit typically posts within two business days while the dispute is investigated.
Federal insurance Deposits are insured by the NCUA to at least $250,000 per depositor, per ownership category. That backing has been in place across every one of our years since 1948.

If it already happened, move in this order

Speed matters more than certainty, so call even when you are only half sure. First, freeze the card in the app; that takes ten seconds, stops new charges, and does not cancel the card. Second, call 800.555.7846, which is staffed for card and fraud reports 24 hours a day, and lead with whether money has already left so the agent can attempt a recall before the batch settles. Third, reset your digital banking password from a device you trust, turn on two-factor if it was off, and sign out every other session, then change the password on the email address tied to your account.

Fourth, file the written claim with us and watch the account. We open the dispute the same day and generally post provisional credit within two business days. Set a transaction alert at one dollar for the next sixty days so nothing slips past you while the investigation runs. If your identity rather than just a card was exposed, place a free fraud alert with all three credit bureaus and consider a full freeze; our financial education team runs a free identity recovery workshop every month. Full step-by-step instructions live on report lost or stolen.

Common questions

Security questions members ask

Am I liable if I gave a scammer my one-time code?

Usually not, but tell us immediately. Regulation E covers unauthorized electronic transfers, and reporting within two business days of learning about it keeps your exposure at the lowest tier. Waiting more than 60 days past the statement is where members get badly hurt.

Text codes or an authenticator app?

An authenticator app or a passkey. Text codes beat nothing, but SIM swap attacks are common enough that we no longer recommend them as a primary method. A passkey cannot be phished, forwarded, or read aloud to a caller.

How do I know a Summit email is genuine?

We never send a link that asks you to sign in. If an email wants your credentials, ignore the link and open the app or type our address yourself. Anything real is also waiting in your secure message inbox at member login.

Do you sell my information?

No. As a not-for-profit owned by its 412,000 members there is no shareholder to sell data for. The privacy notice lists everything we do share, which comes down to service providers and legally required reporting.

What if I lose the phone with my banking app on it?

Call us and we sign out every device on your profile. The app itself stores no account numbers and will not open without your device passcode, face, or fingerprint, so a thief holding the handset gains nothing.

Is public Wi-Fi safe for banking?

Our app and website use encrypted connections, so the traffic itself is protected. The real risk on shared networks is shoulder surfing and fake hotspot names. Use cellular data when you can, and never bank from a device you do not control.

This is a demonstration website; rates, products, and figures shown are illustrative only.

See something off? Call now

The card and fraud line at 800.555.7846 is staffed every hour of every day, holidays included. Nobody has ever been told they called too soon.

Report lost or stolen →
Contact us →
Privacy notice →
Money basics →

You are about to leave the Summit Credit Union website

The link you selected leads to a website that Summit Credit Union does not own or control. We offer it only as a convenience and for general information. Products, services, and information reached through this link are not provided or guaranteed by Summit Credit Union, and the site you visit may handle your personal information under a privacy policy that differs from ours. Please read their privacy policy before sharing anything. Summit Credit Union does not necessarily endorse the content of these sites or the organizations that publish them, and accepts no responsibility for that content.

Proceed To Website Close