Multi-factor authentication (MFA) is no cure-all, especially now that phishers are using MFA as a ploy to trick members (see related story, page 1), making member education all the more important.
"If we're talking about perceived risk and better aligning ourselves and our members' efforts to be more secure, then MFA alone isn't even close to addressing the current level of fraud," said Ray Rounds, vice president, information services at $485-million Credit Union of Southern California.
That said, credit unions told The Credit Union Journal that they go beyond MFA technology with what most believe is the strongest layer of security: education.
"Member and staff education is an important component of the NCUA guidance beyond the MFA efforts," said Rounds. "IT staff should be aware of up and coming threats, as well as ensure credit union operations are audited regularly."
Clearview Federal Credit Union in Moon Township, Penn., frequently talks about fraud with members via e-mail, postal mail and its website and with staff in training sessions, said Ed Wood, director, network services, at the $550-million credit union.
The NCUA is of the same opinion. "Member education is a key to deter fraud," said the NCUA. "Methods to evaluate a (member education) program can include tracing the number of members who report fraud, the number of clicks on information security links on the web site, the number of statement stuffers or other direct mail communications, (and) the dollar amount of losses related to identify theft ..."
Even MFA vendors agree that education is the best bet.
"Credit unions should be doing more to educate their members," said Jim Stickley, chief technology officer at TraceSecurity, the Baton Rouge, La.-based security compliance software provider. "The best defense is a blitz of education to the members as soon as possible."
Stickley also likes the idea of "after-hours training," he said.
"The credit union invites their members to come for an evening where they learn how to protect themselves both online and at home from identity theft. This is a great value-add to the member and can reduce the amount of fraud the credit union will face."
