Cybercriminals' growing sophistication and catalogue of stolenpersonally identifiable information challenges many credit unionsthat seek better, quicker authentication solutions for onlinelending and call centers without affecting member experience.

“Properly authenticating online loan applicants is becoming aserious issue for many credit unions. On one hand, we as anindustry recognize that consumers enjoy the speed and efficiency ofinternet-based lending. On the other, credit unions still have afiscal responsibility to their members to mitigate risk and complywith numerous privacy and security mandates,” Terrence Corrigan,loan operations manager for the $240 million, Cleveland-basedFirefighters Community Credit Union, said.

Corrigan noted this also places a significant burden ontechnology vendors, who must work with the credit unions to satisfythe typical dynamics associated with online lending.

The big question for credit unions is how to authenticate folksin a faceless environment.

“Credit unions want to be able to lend money online withoutcalling someone into a branch and have them fill out a paper app,”Barry Kirby II, vice president of the Islandia, N.Y.-based loanorigination provider Teledata Communications Inc., which providesFFCCU with a decision-lending platform, said.

“TCI finds itself in the middle of the need for credit unions tomake decisions faster but also properly identify the applicant andnot risk any fraud,” Kirby emphasized.

TCI's cloud-based DecisionLender process all loans, exceptmortgages. That includes credit cards and personal, automobile andmotorcycle loans. DecisionLender comes into play during theunderwriting process. When a member clicks on an apply button itserves up an online application. After the member selects the loantype, the system dynamically changes to capture the appropriateinformation depending on the loan category. Members receive adecision within five to eight seconds after clicking submit.

TCI provides ID verification through off the shelfauthentication interfaces to services such TransUnion's IdentityManager. TCI can provide additional verification before signing thecontract through a four-digit PIN via text or robo-call that needsentering by the applicant.

The $284 million Portland (Mich.) Federal Credit Union also usesTCI for indirect car loan applications through dealerships; andonline applications for signature loans, credit cards and allsecured loans, other than mortgages.

“When an application is submitted to us from a dealership or anonline member or non-member they submit everything through theapplication portal. They go through a security piece on theapplication side that makes sure they are not a robot,” indirectlending relationships manager for PFCU LeAnne Hixson explained. Themember application information travels though TCI to the creditunion. “When we receive that application, credit has already beenpulled,” she said. However, the credit union does not fund anythinguntil it verifies all submitted information.

Dealers, through a contract with the credit union, areresponsible for providing a driver's license on every application,a signed loan application, plus any other required signeddocuments. If applicants are nonmembers, they also must join PFCU,which the dealer can also have them sign for. The credit union thenverifies the applicant's information such as the driver's licenseand address and that the Social Security number on the creditreport matches the application. This all takes place prior tofunding the loan.

“We are seeing a lot more members using our online application,”Hixson said. While they do have the ability to provide instantonline approval to applicants who meet specific criteria, PFCU ismore conservative than some online lenders. Right now, that instantapproval ratio is about 4% of applications.

The Michigan credit union, however, also seeks to provide thehuman touch. Hixson said, “It's more than making sure they are whothey say they are, it is also making sure we're talking with themabout their entire financial picture. That's huge for PFCU.”

Another venue subject to authentication issues is the callcenter where agents aim to provide exceptional experiences bylistening carefully and reacting promptly to requests. The system'sweakness is it does not always recognize spoofed calls fromever-sophisticated defrauders.

The Atlanta-based voice security/authentication firm PindropLabs in its annual Call Center Fraud Report revealed a significantincrease in the fraud rate, a jump of 113% year-over-year. Fraudrates in 2016 were one in 937 calls across the board, compared toone in 2,000 calls in 2015, according to Pindrop's 2016 report. Forfinancial institutions, the rates were one in every 895 calls.

Pindrop suggested a big objective of scammers is accounttakeover. This can involve fraudsters calling in multiple times totouch an account with nonmonetary transactions. They might includeseemingly innocuous information such as updates to their phonenumber, password or PIN. Fraudsters also get into email accounts tochange the login/password. In reality, they are setting the stagefor a complete takeover of the account.

“The more [credit unions] become more of a traditional financialinstitution the more risk they are exposing financially tofraudsters,” Pindrop VP of Americas Michael Hughes said.

Hughes added fraudsters have the ability to spoof a call fromanywhere in the world, or come in from a regular gateway number. Hesaid it then comes down to what the caller can explain about theaccount and themselves, such as confirming an account or SocialSecurity number, or answering knowledge based authenticationquestions. Hughes pointed out all of that information is readilyavailable through social media, data breaches, and genuine andillegitimate services that collect information.

Call center agents are at a disadvantage. “The customerexperience demands don't allow for a lengthy authenticationprocess,” Hughes said.

The St. Petersburg, Fla.-based CUSO PSCU, which provides callcenter services for well over 800 member credit unions, also offersrisk and fraud management, including Pindrop's phone printingtechnology, as part of its layered security.

“We've tried to tackle all those areas behind the memberexperience as it pertains to mobile, card, call center, cyber andrewards, an upcoming fraud trend,” Jack Lynch, chief risk officerat PSCU, stated.

The test becomes how to engage members while combating fraud.“In the past year, we've tried to focus on a 360-degree view of themember and how are they going through the authentication process inpayments,” Lynch maintained.

Making it even more problematic is how impostors can completelyseize personally identifiable information. “We're seeing thefraudster starting to piece together identities,” Lynch said. “Theyget a piece from us, a piece from public records, and create thatstory.”

Fraudsters essentially become the member, which is making theauthentication process much more difficult when somebody calls in.“You have to be careful when you're dealing with member experiencebecause you can't have your reps turn into CSI investigators. Theyare also not trained to detect fraudsters, they are trained to behelpful,” Lynch said.

That is why PSCU is looking to bring more anti-fraud instrumentssuch as geolocation and biometrics into the equation to help. “So,authentication becomes much more than answering questions. It's howdo I get a full story and understanding where the call is comingfrom, who the member is, and using all these new tools in order tosecure the member,” Lynch explained.

A new fraud target is account rewards. “Fraudsters are figuringout this is a rich target environment. It's not likemembers/consumers are looking at their rewards points very often,”Lynch suggested. So once fraudsters obtain the account piece theycan drain the rewards points to order gift cards, merchandise orTVs.

To combat reward point theft PSCU started an outbound program toverify when accountholders use a significant amount of points.“We've already been able to save about two million points withthese pilots. We feel by the end of 2017 this is going to make abig dent in fraudsters stealing rewards points,” Lynch said. “PSCUfelt that fraud was a threat to not only the credit union industrybut to our members so we set out to drive down fraud and protectthe members.”