Security Center

If you believe you have been a victim of financial fraud, we encourage you to contact specific product teams to expedite your request:

• Marcus US, including Online Savings Accounts, CDs, GM Rewards Card, GM Business Cards

• Marcus UK

• ​Private Wealth Management Clients  

From time to time, Goldman Sachs is made aware of websites, applications and other social media platforms created by people or groups who misrepresent themselves as being affiliated with Goldman Sachs and offering investment advice and soliciting money from the public. These scams are complex as the perpetrators often use actual employees’ names and replicate proprietary documentation.

Please be aware that Goldman Sachs does not accept deposits from, or offer financial services to, retail investors or individuals in India. If you think you or someone you know has been a victim of such fraud, please report the matter to the police or other relevant authorities.

Goldman Sachs takes online impersonation scams seriously. To report misuse and impersonations of the Goldman Sachs brand or employees, or potential phishing e-mails, please forward the information as an attachment to abuse@gs.com with any supporting materials, including: 

• Identifiable information about the scammer(s) such as phone numbers, usernames, email address, or social media usernames 

• Screenshots of messages or voicemail transcripts 

• Group messaging invitations

• Details on how you were contacted 

• Timeframe of incident

• Financial loss

• Any other relevant information you’d like to share 

If applicable, we recommend reporting this activity directly to the platform where the issue occurred. For scams on social media platforms, you can follow the official process to report groups, pages, or users:

• WhatsApp
• Facebook
• Instagram / Threads
• LinkedIn
• YouTube
• Viber
• TikTok
• X (formally Twitter)
• LINE

You can also report fraud  to the U.S. Federal Trade Commission or local law enforcement. 

Use Long, Unique Passwords

• Use passwords that are at least 8 characters, and preferably much longer 
• Choose unique passwords for each account
• Passphrases (multiple random words) are easier to remember and harder to guess 
• Avoid using personal information (names, birthdays, email addresses)

Use a Password Manager 

• Password managers help generate and store unique, strong passwords
• They reduce the risk of reuse across multiple sites 
• They lower the chance of phishing by autofilling only on correct sites

Enable Multi‑Factor Authentication (MFA)

• MFA adds a second factor (something you have or are) in addition to your password
• Examples include authenticator apps, hardware security keys, or built‑in device biometrics 
• MFA significantly reduces the risk of account takeover even if a password is stolen

Be Cautious with Security Questions 

• Don’t rely on knowledge‑based authentication (e.g., “mother’s maiden name”).
• Answers are often easy to guess or find online 
• If security questions are required, treat them like passwords
• Use random answers stored in a password manager rather than real information

Keep Recovery Options Up to Date

• Account recovery is part of the authentication process  
• Ensure your recovery e-mail and phone number are current
• Protect recovery accounts with strong passwords and MFA 
• Treat recovery links and codes as sensitive credentials

Reduce Your Public Online Footprint 

• Periodically review all your online accounts
• Reduce and/or obfuscate personal information on the internet, remove unnecessary data, delete unused accounts, and avoid sharing or reusing passwords across accounts to minimize exposure 

Protect Critical Data

• Know where all your sensitive personal information is stored 
• Ensure that your sensitive data is always stored in an encrypted format, to prevent someone from viewing it if your device gets lost or stolen
• Also consider having a second encrypted backup of your sensitive data, whether on a flash drive stored in a safety deposit box or in the cloud using a reputable service such as Dropbox, iCloud, or Google Drive 

Establish Secure E-mail Protocols

• E-mails continue to be a common entry point for hackers to perform online fraud
• Do not click on links or open attachments from suspicious-looking e-mails
• Expand your communication protocol to verify sensitive information, such as wiring instructions, in person or by telephone

Protect Your Personal Devices

• Configure devices securely, considering what your risks would be if your device were stolen
• Use a difficult to guess passcode as a backup to biometric security such as a thumb print or Face ID and be sure your device is encrypted

Guaranteed Returns

• No legitimate investment is risk free‑. Scammers often promise “guaranteed” or unusually high returns to lure victims into acting without proper due diligence.

False Urgency

• Pressure to “act now” is a classic manipulation tactic. Be cautious of limited time offers, countdowns, or claims that you’ll miss out if you don’t‑ respond quickly. Scammers rely on urgency to stop you from asking questions.

Vague Information

• Fraudsters frequently rely on unclear explanations, ambiguous product details, or complex jargon to obscure the truth. If the information seems confusing, or the provider avoids simple questions, treat it as a warning sign.

Unsolicited Outreach

• Unexpected calls, e-mails, texts, or social media‑ messages about investment opportunities should always raise suspicion. Legitimate opportunities rarely arrive unexpectedly.

“Too Good to Be True” Offers

• Scammers often promote premium access, extraordinary profits, or “special” programs that seem exciting and exclusive. Be cautious of offers tied to niche products, breakthrough tech claims, penny stocks, or incentives like free meals, travel, or seminars.

Phishing

• A technique that uses deceptive e-mails to trick individuals into providing sensitive information such as credentials or credit card numbers. They often contain links to websites that contain malicious software (malware) or that grant the fraudster access to your device.
• RED FLAGS: Unexpected invoices/payments, attachments or links, suspicious sender/URL mismatches

Business Email Compromise (BEC)

• A form of e-mail fraud where an attacker sends an email message that appears to come from a known source making a legitimate request.
• RED FLAGS: Unexpected requests to change payment instructions, e-mails from spoofed (falsified) domains, urgent or high-pressure language.

Executive Impersonation

• This scam is often used in tandem with other scams when an attacker misuses an executive’s identity (name, photo, e-mail, voice, or video) to pressure victims into completing fraudulent transactions or sharing sensitive information.
• RED FLAGS: Using unapproved channels. Goldman Sachs employees will never contact you via social media.

Vishing

• Voice phishing (vishing) involves a fraudulent call where the attacker poses as a representative from a trusted organization for financial gain or access to sensitive information.
• RED FLAGS: Generic greetings, unsolicited calls and receiving a call from a spoofed caller ID.

Smishing

• SMS phishing (smishing) involves a fraudulent text message where the attacker poses as a trusted organization or individual to trick the recipient into clicking a malicious link, sharing sensitive information, or taking an unauthorized action.
• RED FLAGS: Urgent or alarming language, unexpected texts requesting action or information, links to unfamiliar or shortened URLs, messages claiming the sender “can’t take a call,” grammatical errors, or texts that appear to come from senior leadership or GS

Pig Butchering

• This is a long-term social engineering scam where fraudsters build trust before stealing money. Fraudsters may initiate contact via texts, or social media, then move to private apps like WhatsApp/WeChat. After building trust over several weeks or months, scammers often promote fraudulent crypto-investment schemes. Victims are advised to convert cash to crypto using legitimate services, then transfer it to fraudulent platforms. Fake platforms show fabricated “profits” to encourage larger investments. When victims try to withdraw funds, they face excuses, fees, or total loss of access.
• RED FLAGS: Unsolicited outreach, attempts to quickly move communication off a public platform, promises of “guaranteed” high returns, and pressure to add funds before allowing withdrawals.

Romance Scams

• A form of fraud in which a criminal creates a fake online persona to build a romantic or emotionally intimate relationship with a victim. The scammer uses prolonged trust building and emotional manipulation to steal money or sensitive information from the target.
• RED FLAGS: Refusal to meet live, request for help to pay medical expenses (for them or a family member), request to purchase a ticket to visit you, or help them pay fees to get them out of trouble. They may even offer to help you get started in cryptocurrency investing.

Additional resources from the FBI can be found here: FBI Common Frauds and Scams