Rest Confident, Your Money is Safe and Secure at Kirtland Credit Union, a message from our President & CEO. Learn More

We have engaged FORVIS, LLP (Attn: Jeff Rosno, 1801 California Street , Ste. 2900, Denver, CO 80202) to perform member verifications. Kindly compare the balance of your accounts on your December 2022 statement WITH YOUR RECORDS. If balances do not agree, please address your discrepancies directly to FORVIS, LLP. Include your name, truncated account number, and an explanation of the difference noted.  A reply is not considered necessary unless a difference is noted.

Kirtland CU branches and the Member Contact Center will be closed on Monday, February 19 in observance of Presidents’ Day.

Credit and debit card fraud is on the rise. Please monitor your account activity for any unusual transactions. >> Learn more

Kirtland Credit Union will never ask you to provide, update, or verify personal or account information through an unsolicited email, phone call, or text message. If you receive an unsolicited email, phone call, or text message, DO NOT RESPOND. Notify us at (505) 254-4369 or 1-800-880-5328.

If you may experience financial hardship related to the government shutdown, we’re here to help. Call 1.800.880.5328 or visit one of our branch locations for more information.

Welcome To The Insighter!

Explore the latest happenings at Kirtland CU and learn about important topics from around the financial world. Here’s your insight! To learn about retirements, investments and financial planning, check out Invested now.

Proof of the Spoof

By Ashleigh, K-Staff


We often write about the various methods that fraudsters and criminals use to steal info and money from victims. Sometimes, the attempt is relatively obvious. Other methods, like a well-done spoof, are more difficult to detect.

In late February, a local New Mexico school district warned parents about a spoofed website, built to look virtually identical to the real school district website. The website was well done, the fake good enough to not be obvious at first glance. But it held many of the hallmarks of a spoofed website—if you knew where to look.

What’s a spoofed website?

A spoofed website is a site built to mimic a legitimate website for malicious purposes. A spoofed bank site, for example, could fool customers and members into entering their banking login information, exposing it to the criminals. Another high-profile example of spoofing occurred in November 2020. The FBI issued a warning that several spoofed websites mimicking the federal agency’s official site. According to the FBI:

“Adversaries can use spoofed domains and email accounts to disseminate false information; gather valid usernames, passwords, and email addresses; collect personally identifiable information; and spread malware, leading to further compromises and potential financial losses.”

Some of the spoofed domains are highly suspicious; but others could easily be mistaking for an official FBI page.

A domain that is similar to a legitimate domain but not identical is a hallmark of a spoofed website. For example, our website domain is A hypothetical spoofed domain could be close to the original ( or add a subdomain ( to fool you into thinking it’s the real Kirtland FCU site.

In the school district incident, the spoofed domain had a single extra letter: vs.

With a spoofed domain, a fraudster can also create email addresses with that domain in order to extend the deceit to inboxes. So be sure to check any domain of an email address before you decide to open it or interact with it.

How to spot a spoof

A good spoof can look identical to the legitimate site it’s purporting to be. But there are signs that you aren’t looking at the real website. Here is what the FBI says you can do to spot a spoof and keep yourself safe:

  • Verify the spelling of web addresses, websites, and email addresses that look trustworthy but may be imitations of legitimate election websites.
  • Ensure operating systems and applications are updated to the most current versions.
  • Update anti-malware and anti-virus software and conduct regular network scans.
  • Do not enable macros on documents downloaded from an email unless absolutely necessary, and after ensuring the file is not malicious.
  • Do not open emails or attachments from unknown individuals. Do not communicate with unsolicited email senders.
  • Never provide personal information of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate.
  • Use strong two-factor authentication if possible, using biometrics, hardware tokens, or authentication apps when available.
  • Use domain whitelisting to allow outgoing network traffic to websites that are deemed safe.
  • Disable or remove unneeded software applications.
  • Verify that the website you visit has a Secure Sockets Layer (SSL) certificate. In other words, check to make sure the address has https, not just http at the beginning of the URL.
Think you spotted a spoofed website? Report it to the FBI.

Don't Be a Victim!

You need to know about credit union impersonation scams so you can avoid becoming a victim of these nefarious tactics.

Online, Mobile, and Telephone Banking will be unavailable on Sunday, December 17 from 12:00-5:00 a.m. MST.