MARIETTA, Ga. -
In fact, one member at Lockheed Georgia Employees FCU (LGE) here logged in from 19 different locations in just one month. A couple was logging in simultaneously from different parts of the country using the same ID.
LGE likes to know, in detail, how members are logging in to Internet banking: these behavior patterns are important to LGE because they help prove the multi-factor authentication (MFA) platform is easy for members to use, according to Laura King, VP-information technology at the $565-million CU.
King suspects if members are logging in from multiple locations or devices in one month, then they aren't having trouble using MFA.
"Our board was apprehensive that an MFA deployment would deter the membership from using e-services," King said. "And our peer credit unions are complaining about members dropping away like crazy from the online channel after MFA."
LGE's adoption rose 11% this year and volume rose 18%, according to Stanley Hixon, network security administrator at LGE.
"MFA just did not negatively impact our members," King added.
King said she has the statistical evidence to back her claim-and to "alleviate the board's fears." The risk analysis engine in LGE's authentication tool delivers daily and monthly reports that identify log-in patterns and reveal quite a bit about LGE member behavior online.
It seems that in May, although the one "very busy, traveling member" created 19 log-in profiles and eight other members created 11 each, about 65% of the LGE's 19,000 online members used two or fewer profiles each, Hixon said.
To King's surprise, that statistic is in keeping with the experience of most other financial institutions. "We thought our members moved around more than they do, but we're guessing most are just logging-in from home and work," she said.
Members at Delta Community CU in Atlanta are also logging-in with multiple devices from multiple places. Nearly 75% of online members are using multiple profiles, and nearly 5% have at least 10 profiles each, according to Bill Mesplay Sr., CIO at the $2.5-billion CU.
Both Delta Community and LGE use the Fraud Analyst authentication platform offered by Norcross, Ga.-based Digital Resolve. Fraud Analyst also alerted LGE to the fact that more members are logging in from what the Office of Foreign Assets Control deems high-risk countries, which means those members would have to pass additional authentication measures beyond the standard log-in, Hixon said. The statistics also serve as an early-warning system against phishing, he said.
"Phishers are getting very good at making a fraudulent site look legitimate, to where the URL is hidden and the site is dead spot-on to the original," he continued. "I'm watching Fraud Analyst to see if there are a lot of log-ins from a specific address indicating that a phisher is trying to get in with different IDs, or is using the same ID from different addresses. I'll expect to see that in Fraud Analyst before I hear any reports from members."
The Fraud Analyst reports also give LGE insight into what members think about the MFA process. "We can better understand members' behavior for marketing purposes and how much of an aggravation the log-in change is to them," King said. "The reports affect the way we implement the solution, for example, the number of failed log-ins we allow or challenge questions we require."
The number of invalid log-ins dropped from 14,000 in March to 2,000 in April, she continued. "Members seem to be understanding how to use the system."
The 90,000-member CU got more good news from Fraud Analyst when it learned many of the single-profile users were quickly creating multiple profiles. The increase in multiple profiles makes King think that, although the membership is not pure jet-set, there's a chunk of members who do move around. And that gets King to thinking about mobile banking services.
"The great thing about using Fraud Analyst and tracking these statistics over time is that we can use them to sell our board on other services down the line," King explained.
more
Read more about MFA and online fraud at cujournal.com and search the following bolded terms in the archive:
* Anti-Phishing Solution Will Dominate
* Tracking The Dark Side Of Web
* Beefing Up Security
For info on this story:
* www.lgefcu.org
* www.deltacommunitycu.ocom
* www.digital-resolve.net
