Avoiding Business Email Compromise Schemes

Business email compromise has become a pervasive threat.

Credit unions are very familiar with information security. Since 2001, the federal Gramm-Leach-Bliley Act has required credit unions to establish and maintain various safeguards to protect “nonpublic personal information” (NPI) of its members. Credit unions must establish administrative, technical and physical safeguards for NPI in order to: 1) Insure the security and confidentiality of NPI, 2) Protect against anticipated threats or hazards to the security or integrity of NPI, and 3) Protect against unauthorized access to or use of NPI that would result in substantial harm or inconvenience to a member.

And while requirements of the GLBA have not changed, the way consumers and credit unions communicate and transact business is quite different than in 2001. Most (if not all) business transactions are now conducted using digital technology and electronic communications, and as a result are subject to a host of cyber-threats. And these transactions utilize not just the networks and communications of credit unions, but also those of their members and vendors.