What is Multi-Factor Authentication (MFA)?
MFA stands for Multi-Factor Authentication. It’s a new security system that adds
an extra layer of protection to your Online Banking account(s) by letting you
know you’re at our legitimate Online Banking site, and letting us know it’s you
accessing your account.
Letting you know you’re at our legitimate
Online Banking site
Multi-Factor Authentication will help you distinguish our Online Banking
site from a look-a-like. Upon registering for this new security feature, you
will have a personal image and phrase, which will become a shared secret
between you and us. When you see the image and phrase displayed on the
screen, you can be confident that you are at our Online Banking site and
that it is safe to enter your password. It is important to make sure you
NEVER enter your password without seeing your personal image and phrase.
Letting us know it’s you accessing your account
If the security system does not recognize the computer being used when you
login to our Online Banking site, it will ask you to verify your identity by
prompting you to either answer a security question (determined by you during
set-up) or enter a one-time password that would be sent to your personal
email address.
When you login to our Online Banking site from a different computer, you are
asked to answer a security question or enter a one-time password to protect
your account. You can choose to register your computer so the system will
remember it in the future, in which case it will not ask you to answer a
security question or enter a one-time password the next time you login from
that computer. It will show you your personal image and phrase.
Why do I need this new security system?
The increase in threats to the security of personal financial information and
funds is causing concern among members, credit unions, and regulators. To
address these concerns and adhere to the Federal Financial Institutions
Examination Council’s suggestion, we added an extra layer of security to
our Online Banking site. This new level of security helps you guard against
fraudulent online activities like “Phishing”
(malicious requests for your personal information) and
identity theft.
What is Phishing?
Phishing, pronounced fishing, is the act of sending an email to a user falsely
claiming to be a legitimate enterprise in an effort to scam the user into
surrendering private information. The phishing email asks the user to visit a
website where they are asked to update personal information, such as: passwords
and credit card, social security, and financial institution account numbers that
the legitimate enterprise already has. The website is designed to steal the
user’s information, which is often used for identity theft. The email may state
something like, “Your account will expire if you do not login and update your
profile.”
How does the new security system work?
When you visit your branch office, you know our faces and we know yours. Our new
security feature does the same thing over the Internet. When you enroll, you
will receive a secret image and create a phrase known only to you. Whenever you
login to your Online Banking account, the system will display this image and
phrase so you can feel confident you are accessing our legitimate Online Banking
site. Remember: Never enter your password without seeing your personal
image and phrase.
The security system also checks the computer you’re using to access your Online
Banking account. Typically, you’ll access your account from one or two
computers, such as from work or home. You can choose to register your computer
so the system remembers your computer(s). If you login from a computer that has
not been registered, the system will take additional steps to verify your
identity, such as asking you to provide the answer to your own personalized
security questions or asking you to enter a one-time password that would be sent
to your email address.
When will I be asked for more information?
When you first enroll in the new security feature, you’ll receive a randomly
assigned image and choose your personal phrase. You will also be asked to:
answer some questions, provide an email address, and decide whether to register
your computer. You can choose to change or update the: image, phrase, email
address, questions and answers at any time. You’ll only be prompted to enter
additional information when you use a computer that is not registered.
When should I register my computer?
When you initially enroll, or anytime you successfully login to an unregistered
computer, you can choose to register the computer you are using.
If you choose to register that computer: You will not need
to answer a security question or enter a one-time password the next time you
login from that computer. You may want to choose this option if you are
using a personal home or work computer.
If you choose NOT to register that computer: The system will
prompt you to answer a security question or enter a one-time password that
would be sent to your email address to validate your identity the next time
you login to your account. You should choose this option if you are using a
public terminal.
How am I more secure with the new security system?
The new security system displays a secret image and phrase to protect you from
accidentally logging on to a phony Online Banking site. In addition, if your
user name and password are stolen, the third party will still not be able to
access your account because he/she is not at your registered computer. And since
the computer is not registered, the system will either prompt you to answer a
security question, to which only you know the answer, or email a one-time
password to your personal email address.
How do I sign-up for the new security system?
Once you enroll for FREE Online Banking, you will be prompted to complete the
MFA enrollment process. At this time, the system will randomly assign you with a secret
image, which you can change after you login to your account. You’ll also select
a phrase that will appear under the image on the Online Banking site. The
combination of the image and phrase is only known to you and the system. When
you see your personalized image and phrase, you can be assured you’re logging on
to your actual Online Banking site.
You will also be asked to: provide a personal email address, select security
questions to which only you know the answers, and choose whether or not to
register your computer. Once this occurs, you have added a layer of protection
to your account.
How do I know if the new security system is working?
You only need to complete the enrollment process once. Afterwards, it will work
automatically. That means you’re being protected 24/7 — when you’re online and
when you’re not.
Can I upload my own secret image?
To keep the enrollment as simple as possible, you cannot upload your own image.
However, the security system offers a variety of images you can choose from.
Can I change my secret image and phrase?
Yes, you can change your secret image and phrase at any time. To make the
change, go to the Multi-Factor Authentication Preferences Screen (found under
the Menu on the left; click on “Profile,” and then on “MFA Preferences”) after
you login to your account. Your secret phrase must be between 3 – 16 characters
long.
Can I change my security questions/answers or
email address?
Yes, you can change your security questions/answers or email address at any
time. To make the change, go to the Multi-Factor Authentication Preferences
Screen (found under the Menu on the left; click on “Profile,” and then on “MFA
Preferences”) after you login to your account. There is a total of three
questions; each numbered question has 10 different options to choose. You must
answer three different questions.
Is the email address required to enroll?
Yes. If the system does not recognize your computer during a future login
attempt, you may be asked to enter a one-time password that will be sent to the
email address you provide. You should provide an email address that only you can
access. Since an unauthorized user will not have access to your email to obtain
the one-time password, they will be unable to login to your account.
Can I enter more than one email address?
No. The email address provides you with a one-time password that is needed to
access your account. To keep this information secure, it will only be sent to
one address.
Is the one-time password provided for the email
challenge case sensitive?
Yes, it is. The one-time password that is sent to your email address will be
displayed in the cases you should use.
Are the answers to the challenge questions case
sensitive?
No. In an effort to make the challenge questions easy for you to remember, they
are not case sensitive.
What keeps somebody from stealing my secret image and
phrase?
The system only shows your secret image and phrase: if you login from a computer
you have registered, if you correctly answer a security question, or if you
enter a one-time password from your email. So, an unauthorized person cannot
access your image and phrase.
Why am I being asked to answer a question or enter
another password when I try to login?
The system asks you a security question or sends you an email with a one-time
password when you login from a computer it doesn’t recognize. This is to prevent
someone with stolen passwords from logging in to your account from a remote
location. Since only you know the answer to the security questions, and only you
can retrieve the password from your email, the system will know whether it’s
really you.
Generally you’ll be asked to answer a security question or enter a one-time
password only when you login for the first time from a new computer. After you
answer the question or enter the one-time password, you will be asked if you
would like to register this computer for future logins. If you’re using a
personal computer and plan to use it again to access your account, you can
answer yes. If you are using a public terminal, you will want to answer no.
Can I access my account from multiple computers?
Yes. There is no limit to the number of different computers you can use or
register to login to your Online Banking account. However, if you login from a
new computer or a public terminal, you’ll need to go through one extra step of
identification validation. This helps protect you by keeping an unauthorized
person from accessing your valuable information.
I am not an Internet expert. How easy is it to use the
new security system?
It is extremely simple. You don’t need to memorize anything new—just use the
site as usual and look for your personal image and phrase at login.
I share my computer with someone who has their own credit
union account. Can both of us still login from the same computer?
Yes, you can both use the same computer to login to your individual accounts.
There is no limit to how many people can login to the Online Banking site from
the same computer.
What happens if someone steals my password? How
will the new security system keep them from accessing my account?
When someone tries to login using your username and password, the system will
recognize that they are logging on from a different computer. It will either ask
them a security question or send them an email containing a one-time password
they will need to enter. Since only you know the answer to your security
questions, and only you can access your email account to obtain the one-time
password, they will not be able to login.
I am trying to login from my own computer, but the
Online Banking site is not showing me my
secret image and phrase. Instead, it is asking me to choose another form of
authentication to validate my identity. What is happening?
This might happen in rare cases if you have deleted all cookies on your computer
or if you have not registered that computer with the new security system. The
additional authentication is a way to validate your identity. The system is
allowing you to choose whether you want to answer a security question or enter a
one-time password that the system will send to the email address you provided at
enrollment. Before answering a security question or entering your password, make
sure you are going to the legitimate credit union website. The easiest way to
ensure this is by typing our credit union’s URL directly into your web browser’s
address area and clicking on the link to access your Online Banking account.
Then, after you correctly answer the security question or enter the password,
you should see your secret image and phrase. If your secret image and phrase is
there, you can be confident you are at our legitimate Online Banking site and
can enter your password.
I already have anti-virus software and a personal
firewall installed on my computer. Why do I need this?
It’s good that you use anti-virus software and a personal firewall. Be sure you
keep both software programs up-to-date for the best possible protection against:
viruses, Trojans, and hackers. This new security feature protects against other
threats, such as a stolen username and password. It works with your other
personal security programs, but it does not replace them.
If I enter an invalid User ID, why will the system
still prompt me to answer a question or enter another password?
When logging in to your Online Banking site, a secure multi-factor
authentication system is working in the background to verify your identity. The
system will prompt you to answer a question or enter another password to prevent
User ID harvesting; which is a type of phishing. If you enter an invalid User
ID, you should return to the login screen and re-enter the correct information.
Is my personal information still safe?
Yes. In fact, your personal information is safer than ever before because the
security system is making sure it is really you and not an unauthorized user
trying to access your information.
