Member Guide for Online Banking

Online Banking Enrollment Instructions

Home Banking Policy

• Introduction

   
  The credit union’s authentication process should be consistent and support ENERGY PEOPLE’S overall security and risk assessment programs. Further, the implementation of appropriate authentication methodologies starts with an assessment of the risk posed by ENERGY PEOPLE’S electronic banking systems.
  
  Energy People needs to utilize reliable methods to verify the identity of members during the account origination process, as well as authenticating members before granting them access to on-line banking systems.
  
  A sound authentication system should include audit and monitoring features that can assist in detecting fraud, unusual activities, compromised passwords, or other unauthorized activities.
  
  The Energy People FCU authentication process should be received periodically to assess the adequacy of existing authentication techniques in light of changing or new risks.

• Purpose

   
  This interagency guidance focuses on the risks and risk management controls related to authentication in an electronic banking environment. It reviews the risks and risk management control of a number of existing and emerging authentication tools necessary to initially verify the identity of new customers and authenticate existing customers that access electronic banking services. These functions are jointly referred to as “authentication” in this guidance.
  
  This guidance applies to both retail and commercial customers and is intended to be “technology neutral.” Energy People Federal Credit Union may use this guidance when evaluating and implementing authentication systems and practices where they are provided internally or by a third service provider. Furthermore, management should review this guidance in conjunction with other guidance to ensure that safety and soundness objective concerning confidentiality, data integrity, contract enforceability, and effective internal controls are adequately addressed.

• Background

   
  Reliable customer authentication is imperative for Energy People Federal Credit Union engaging in any form of electronic banking or commerce. An effective authentication system can help financial institutions reduce fraud and legal enforceability of their electronic agreements and transactions. Strong customer authentication practices also are necessary to enforce anti-money laundering measurers and help financial institutions detect and reduce identity theft. Customer interaction with financial institutions is migrating from physical recognition and paper-based documentation to remote electronic access and transaction initiation. The risks of doing business with unauthorized or incorrectly identified individuals in an electronic banking environment could result in financial loss and reputation damage through fraud disclosure of confidential information, corruption of data or unenforceable agreements.
  
  The method that Energy People Federal Credit Union to verify authentication tools and methodologies to authenticate customers. They include the use of passwords and personal account number. The level of risk protection afforded by each of these tools varies and is evolving as technology changes.
  
  Authentication methods that depend on more than one factor typically are more difficult to compromise than single factor systems. Accordingly, properly designed and implemented multi-factor authentication methods are more reliable indicators of authentication and stronger fraud deterrents. Energy People Federal Credit Union should be sensitive to the fact that proper implementation is key to the reliability and security of any authentication system. For example, a poorly implemented two-factor system may be less secure than a properly implemented single-factor system. Energy People Federal Credit Union has a two-factor security system in place.
  
  The success of a particular authentication method depends on more than the technology. It also depends on appropriate policies, procedures and controls. An effective authentication method should have customer acceptance, reliable performance, scalability to accommodate growth, and interoperability with existing systems and future plans.

• Risk Assessment

   
  An effective authentication program should be implemented on an enterprise-wide basis to ensure that controls and authentication tools are adequate among products, services, and lines of business. Authentication process should be designed to maximize interoperability and should be consistent with the Energy People Federal Credit Union overall strategy for electronic banking.
  
  The implementation of appropriate authentication methodologies starts with assessment of the risk posed by the institution’s electronic banking systems. The risk should be evaluated in light of the type of customer; the Energy People Federal Credit Union transactional capabilities; the sensitivity and value of the stored information to both the institution and the customer; the ease of using the method; and the size and volume of transactions.
  
  An enterprise-wide approach to authentication requires development of and adherence to corporate standards and architecture, integration of authentication process within the overall information security framework, risk assessments within lines of businesses supporting selection of authentication tools, and central authority for oversight and risk monitoring. This authentication process should be consistent and support the financial institution’s overall security and risk management programs.
  
  The method of authentication used in a specific electronic application should be appropriate and “commercially reasonable” in light of the reasonably foreseeable risks in that application. Because the standards for implementing a commercially reasonable system may change over time as technology and other procedures develop, financial institutions and service providers should periodically review authentication technology and ensure appropriate changes are implemented.
  
  Single factor authentication tools, including passwords and PINs, have been widely accepted as commercially reasonable for a variety of Credit Unions. However, financial institutions should assess the adequacy of existing authentication techniques in light of changing or new risks (e.g., increasing ability of hackers to compromise less robust single factor techniques). The agencies caution financial institutions that single factor authentication alone may not be commercially reasonable or adequate for high risk applications and transact5ions. Instead, multi-factor techniques may be necessary. Institutions should recognize that a single factor system may be “tiered” to enhance security without implementing a two-factor system. A tiered single factor authentication system would include the use of multiple levels of a single factor (e.g., the use of two or more passwords or PINs employed at different points in the authentication process).
  
  In addition to limiting unauthorized acce4ss, effective authentication also provides institutions with a foundation to enforce electronic transactions and agreements. First, effective authentication provides the basis for validation of parties to the transaction and their agreement to it terms. Second, it is a necessary element to establish the authenticity of the records evidencing the electronic transaction should there ever be a dispute. Third, it is a necessary element to establish the integrity of the records evidencing the electronic transaction. All of these elements promote the enforceability of electronic agreements.

• Account Origination and Customer Verification

   
  With the growth in electronic banking and commerce, financial institutions need to utilize reliable methods of originating new customer accounts online. Customer identity verification during account origination is important in reducing the risk of identity theft, fraudulent account applications, and unenforceable account agreements or transactions.

  The reliable method to verify a customer’s identity is a tangible proof of identity (e.g., driver’s license).

  • Positive verification to ensure that material information provided by an applicant matches information available. More specifically Energy People Federal Credit Union can verify a customer’s identity by comparing the applicant’s Member account number, Birthday, E-Mail Address and home phone number, against information in a trusted database. Correct comparing of database information by Energy People Federal Credit Union with an increasing level of confidence that the applicants are who they say they are
  • Logical verification to ensure that information provided is logically consistent (e.g., do the telephone area code, zip code, and street address match)
  • Negative verification to ensure that information provided has not previously been associated with fraudulent activity. For example, member information can be compared against fraud databases to determine whether any of the information is associated with known incidents of fraudulent behavior

• Transaction Initiation and Authentication of Established Customers

   
  Once Energy People Federal Credit Union has successfully verified a customer’s identity during the account origination process, it should authenticate customers who wish to gain access to the online banking system. Energy People Federal Credit Union uses methods such as User ID and confidence word.
  
  Prudent controls promote the integrity of the authentication method. In addition, Energy People Federal Credit Union can strengthen the reliability of the authentication methods by communicating customer responsibilities and recommended precautions. (Refer to the Appendix for a more detailed discussion on each of these authentication methods and prudent controls.)

• Monitoring and Reporting

   
  Monitoring systems can detect unauthorized access to computer systems and customer accounts. A sound authentication system should include audit features that can assist in the detection of fraud, unusual activities (e.gl., money laundering), comprised passwords or other unauthorized activities. The activation and maintenance of audit logs will be implemented to identify unauthorized activities, detect intrusions, reconstruct events, and promote employee and user accountability. In addition, financial institutions should report suspicious activities to appropriate regulatory and law enforcement agencies as required by 31 CFR 103.18.
  
  Energy People Federal Credit Union will rely on multiple layers of controls to prevent fraud and safeguard customer information. Many of these controls are based directly upon authentication. Energy People Federal Credit checks each Home Banking. The teller transaction detail is checked each day.
  
  Adequate reporting mechanisms are needed to promptly inform security administrators when users are no longer authorized to access particular systems and to permit the timely removal or suspension of user account access.

• Conclusion

   
  Reliable electronic customer authentication is imperative for financial institutions engaging any form of electronic banking or commerce. The success of a particular authentication tool or methodology depends on more than the technology; it depends on appropriate policies, procedures and controls. An effective authentication method should be implemented on an enterprise-wide basis, have customer acceptance, reliable performance, scalability to accommodate growth, and function with existing systems and future plans.