Display Name Spoofing

The display name on an email is faked to mimic a person or company you trust — and if you don’t check the actual address behind it, it works.

• Even when a display name looks familiar, make a habit of checking the full email address. It takes seconds and can spare you real trouble.
• Don’t reply to any 10-digit text that appears to be from Exchange Bank — report it to us instead.
• Set your email to display both the sender’s name and full address.

Exchange Bank Text Spoof

A text arrives from what looks like Exchange Bank’s main number. But we don’t use 10-digit phone numbers for any text messages.

• Treat any 10-digit “Exchange Bank” text as suspect, and report it to us.

Reply-to Spoofing

The email’s reply-to address is swapped, so your response goes to the scammer rather than the real sender.

• Before replying to a sensitive request, start a fresh message to a known-good address rather than hitting “reply.”

Domain Spoofing

The domain in an email is forged to imitate a real one — through typosquatting (like exchangbank.com (notice the missing "e") instead of exchangebank.com) or a subtle tweak to the address (yourfaveshop.co instead of yourfaveshop.com).

• Read domain names carefully — the tiniest difference can spell big trouble.
• Look for “https://” to confirm a site is secure.
• Don’t click links or open attachments in unexpected emails.
• Hover over a link to reveal its true destination before you click.
• Be alert to phishing tells like urgent language and requests for personal information.
• Run antivirus software and keep it current.
• Consider a secure email gateway that filters incoming mail and blocks known malicious senders.

Business Email Compromise

A scammer poses as a senior leader at your company to pressure you into transferring money or sharing sensitive information.

• Verify any unusual money or data request through a second channel such as a phone call or in person.