TAMPA—There’s a misperception among credit union members—and even some credit unions themselves—that payments aren’t secure on devices using the “Internet of things,” according to one credit union service organization official. That same person also has a list of 10 things a credit union should do to keep its member data safe, as well as steps a credit union can take to educate members.
True, there have been some scary stories about payment insecurity on the Internet of Things, acknowledged Lou Grilli, director of payment services strategy at CSCU. For this story, Grilli defines the “Internet of things” as “devices that communicate with each other and act on input from each other.”
But he believes electronic payments on these devices are safer than cards swiped at the point of sale, he says, pointing to malware that recently swiped card numbers at Arby’s and Wendy’s as examples.
Grilli’s observations are part of a series in CUToday.info examining “Fake News” in credit unions; that is, misconceptions and myths that may affect CUs’ ability to serve members.
Educating members on how to keep device payments safe will lead to more members using credit union credit or debit cards when they are making these cutting-edge transactions. And once they have chosen a card to be used, the evidence is that credit union card will remain on file, he said.
“These devices are slowly creeping into our lives,” he said.
Member Misconceptions
Examples of IoT transactions? Devices on refrigerators that can place food delivery orders for members using a stored card. Smart water pitchers that can order replacement filters. Devices that can detect when new laundry detergent needs to be ordered.
Some credit union members have “a misconception due to scary stories that the Internet of Things is the Wild, Wild West,” he said.
“There are safeguards that should be used,” he noted.
So, the stored card that gets charged when the smart fridge places an order should be “tokenized,” Grilli advised. In those transactions, the actual card number is replaced with a token that would be useless to a hacker if stolen. The tokens are stored in the cloud and the card does not need to be reissued nor the account closed should a breach occur.
Lou Grilli
Credit union, especially those larger in assets, have been steadily moving forward in adopting tokenization, according to Grilli. He pointed to the number of credit unions enrolled in Apple Pay, which requires tokenization, as an example. While the 823 credit unions enrolled in Apple Pay as of a 2016 report represent just 14% of credit unions by number, they represent 60% of industry assets.
Seventy-six percent of credit unions with assets above $1 billion are in Apple Pay, according to his analysis. Just 23 of the 2,527 credit unions with assets of less $20 million are similarly enrolled. That’s less than 1%.
A Top 10 List
Grilli has a list of 10 things a credit union should do to keep its member data safe, as well as steps a credit union can take to educate members. His Top 10 List:
- Enroll your BINs in tokenization programs with the CU’s processor.
- Enroll in Visa Checkout or MasterPass.
- Implement mobile alerts.
- Enroll BINS in Apple/Samsung/Android Pay and other tokenized wallets.
- Establish daily parameter controls with the processor, such as daily limits, etc.
- Monitor closely for patterns.
- Make sure all vendors and suppliers are PCI DSS compliant.
- Raise fraud awareness among staff and double down on fraud training.
- Encryption. Credit unions should go above and beyond minimum requirements for PCI data security.
- Educate members to avoid clicking on suspicious links in emails, tweets, posts, or anywhere else. Never download third party apps unless they are vetted and certified by Google or Apple and come directly from the Apple App Store or Google Play. Protect passwords, use strong passwords; don’t re-use the same password across multiple sites and apps.
Moreover, Grilli said credit unions should encourage members to avoid using public Wi-Fi for banking or shopping, and should also pull a free credit report once a year. By staggering the three credit bureaus, a member or CU could pull a free report every four months.
Grilli further said members should be urged to turn on mobile credit card alerts, and to choose signature when using their debit card, or use a Visa or MasterCard-branded chip credit card.
CSCU has 2,000 member credit unions.
—Mark Fogarty