By Ray Birch
TAMPA, Fla.—The growth of Internet-connected devices is leaving credit unions no choice: their members must become better managers of their online banking passwords.
That is advice from Tom Davis, CSCU’s senior vice president of finance and technology, who said it’s clear that online banking passwords are at greater risk of theft today due to the growth of the Internet of Things (IoT).
“This year all the talk is about Alexa and Google Home and connected devices. But how do we protect the payments products once they get into an IoT device?” said Davis, adding that concerns should be even more widespread.
The real issue, Davis explained, is not that IoT is giving hackers different and new avenues to exploit, but that there are simply now more doors for them to walk through.
“Adding in all these Internet-connected devices, how many user names and passwords do you have now? What do you do with all those passwords—write them down on a piece of paper, place them on a spreadsheet?” asked Davis. “And what’s the chance that one of these passwords for an IoT device is also your online banking password?”
Educate Members Regularly
Davis advised credit unions to regularly reach out to their online banking users to educate them about the importance of managing all of their passwords, and to also take proactive steps to help members protect themselves.
“Once a Yahoo data breach or something like that happens, you need to go to your user community and say we will change your password if you have not changed it in the last 90 days,” said Davis. “Do some things like that. It’s almost like a reissue of a plastic card. You need to make your members more aware of what is happening today. So does a Yahoo breach matter? Yes, because of the likelihood of a Yahoo password being the same as some members’ online banking passwords is great.”
Tom Davis
While IoT devices open more doors for crooks to steal payment data, they also are very “sticky” payment mechanisms, asserted Davis.
“They have some very significant advantages,” said Davis. “Once you put that payment card into the refrigerator are you going to go back through all those screens and menus to rip that card out and put a new one in? Probably not. Another good thing is that the credit union does not have to do anything else to get the card working. You don’t have to enroll or pay for enablement like you did with Apple Pay and Samsung Pay. This is passive. I call it the perfect API—the payment card account number—everything can plug into that and ride on top of it. It’s almost like the developers of IoT devices even code to it, because they realize they can’t do payments easier than the credit or debit card.”
All the issues surrounding emerging payments is also driving a greater need for outsourcing certain payments tasks at the credit union, asserted Davis.
“The list of payments-related tasks at the credit union is getting much longer, but the number of people doing payments jobs is likely not growing,” said Davis. “Things like Apple Pay, Samsung Pay, EMV and tokenization add complexity and more to-do’s for employees, and they still have to do all they did before these things came along—like running penetration, activation and usage campaigns.”
Outsourcing Interest Is Up
Davis said that has increased credit union interest in CSCU’s Optimize consulting/outsourcing service.
“Optimize has become even more relevant today,” said Davis. “The credit union’s payments staff can’t do everything anymore, they don’t have the time. With Optimize we take care of the new tasks brought about by the new payments frontier, and we do them well so the credit union can focus on growing the portfolio.”
Optimize has been out for 18 months and Davis said clients using the service, on average, show card outstandings growth 20% higher than those that don’t use the service.
“The program is very successful,” said Davis.