BE ON ALERT: There is a new Abandoned and Unclaimed Property (AUP) scam. Criminal actors are contacting AUP holders and requesting that historical reports be emailed to them in an unencrypted format. These requests are not coming from states.

WHAT TO LOOK FOR:

• Requests to email unencrypted reports
• Report or data requests from states marked “urgent”
• Email addresses that are similar but not actual state employee email addresses

WHAT YOU CAN DO:

• Get the word out internally to not send any reports requested by email without verification
• Continue to follow state-specific reporting requirements and guidelines, such as uploading reports to the state website
• Alert the state and verify directly with it to ensure any requests are legitimate
• lock the email address to stop any further inquiries (if this is in step with your institution’s protocols)
• Forward any fraud information to the state; this enables a state to conduct its own investigations

Controls can help provide reasonable assurance operations, compliance, and business objectives are being met. The complete approach of incorporating directive, preventive, and detective controls is optimal. For the most robust approach, multiple types of controls should be implemented and built into policies, procedures, practices, and systems.

State contact information can be found on a state’s website and a list from the National Association of Unclaimed Property Administrators (NAUPA) can be found here: https://unclaimed.org/state-reporting/