Active Phishing Scam Targeting Members with Fake “Past Due” Membership Emails
The National Coin & Bullion Association (NCBA) has received multiple reports of a sophisticated phishing scam impersonating the organization and attempting to steal financial information from members.
The fraudulent emails falsely claim that a member’s NCBA membership payment is “past due” and pressure recipients to reply directly with payment details or confirmation documents. These messages are NOT from NCBA and are part of an active criminal phishing campaign.
Key identifiers of the scam email:
What NCBA members should do:
Members with questions are urged to contact the association only through official channels found at www.ncbassoc.org.
The fraudulent emails falsely claim that a member’s NCBA membership payment is “past due” and pressure recipients to reply directly with payment details or confirmation documents. These messages are NOT from NCBA and are part of an active criminal phishing campaign.
Key identifiers of the scam email:
- Sent from: uscomms.memberservices@internet.ru (note the Russian “.ru” domain)
- Subject line: “Your NCBA membership” (marked High Importance)
- Uses urgent language about “past due” membership payments
- Requests recipients reply to the email and either attach payment confirmation or provide payment details directly
- Falsely signed from “Membership Team,” with a P.O. Box address in Dacula, GA
What NCBA members should do:
- Do NOT reply to the email.
- Do NOT click any links or attach documents.
- Delete and report the message immediately to your email provider.
- If you have already responded or provided information, contact your bank or credit card provider immediately and notify NCBA at ncba@ncbassoc.org.
- Forward the scam email (as an attachment, not forwarded inline) to ncba@ncbassoc.org so the association can track and report it. Members are also encouraged to forward the original message to reportphishing@apwg.org and report the incident to the FTC at ReportFraud.ftc.gov.
- NCBA will NEVER ask members to send payment information or confirmation simply by replying to an email.
- All legitimate payment requests are processed securely through the official website, www.ncbassoc.org.
- Authentic NCBA emails always come from addresses ending in @ncbassoc.org or @ictaonline.org.
- When in doubt, log in directly at www.ncbassoc.org or call the phone number listed on the official website—do not use contact information provided in unsolicited emails.
Members with questions are urged to contact the association only through official channels found at www.ncbassoc.org.
