Active Phishing Scam Targeting Members with Fake “Past Due” Membership Emails
Thursday, December 4, 2025
Section: Association




The National Coin & Bullion Association (NCBA) has received multiple reports of a sophisticated phishing scam impersonating the organization and attempting to steal financial information from members.

The fraudulent emails falsely claim that a member’s NCBA membership payment is “past due” and pressure recipients to reply directly with payment details or confirmation documents. These messages are NOT from NCBA and are part of an active criminal phishing campaign.

Key identifiers of the scam email:
  • Sent from: uscomms.memberservices@internet.ru (note the Russian “.ru” domain)
  • Subject line: “Your NCBA membership” (marked High Importance)
  • Uses urgent language about “past due” membership payments
  • Requests recipients reply to the email and either attach payment confirmation or provide payment details directly
  • Falsely signed from “Membership Team,” with a P.O. Box address in Dacula, GA
This is a scam. No legitimate NCBA membership is currently past due. All 2025 memberships remain paid through December 31, 2025. Official lapsed-membership reminders for 2026 will begin in January and will only be sent through verified NCBA channels.

What NCBA members should do:
  1. Do NOT reply to the email.
  2. Do NOT click any links or attach documents.
  3. Delete and report the message immediately to your email provider.
  4. If you have already responded or provided information, contact your bank or credit card provider immediately and notify NCBA at ncba@ncbassoc.org.
  5. Forward the scam email (as an attachment, not forwarded inline) to ncba@ncbassoc.org so the association can track and report it. Members are also encouraged to forward the original message to reportphishing@apwg.org and report the incident to the FTC at ReportFraud.ftc.gov.
Official NCBA communication practices (for reference):
  • NCBA will NEVER ask members to send payment information or confirmation simply by replying to an email.
  • All legitimate payment requests are processed securely through the official website, www.ncbassoc.org.
  • Authentic NCBA emails always come from addresses ending in @ncbassoc.org or @ictaonline.org.
  • When in doubt, log in directly at www.ncbassoc.org or call the phone number listed on the official website—do not use contact information provided in unsolicited emails.
NCBA is working with law enforcement and cybersecurity partners to shut down this campaign and protect the numismatic community.

Members with questions are urged to contact the association only through official channels found at www.ncbassoc.org.