Security on steroids

Users get our ironclad guarantee against fraud

[July 29, 2010]

A new security feature is coming August 24 to STCU online banking, and we’re so confident of its power to protect your accounts that we’re boldly making this guarantee:

Use it, and STCU will assume all liability for any online fraud that should ever happen to your account.

That’s right, your liability is zero, as long as you protect the privacy of your password and take advantage of the full strength of our easy-to-use “multifactor authentication” (MFA).

As you know, we rolled out a new online banking system in June and July, offering services like account alerts, and making it easier than ever to make online transactions.

That new system already is secure, requiring longer, more complex passwords, for instance. MFA is an added safeguard – kind of like locking the doors on a car while it sits in a padlocked garage protected by guard dogs.

The new security features differ from those that are familiar to longtime users of online banking. Members will no longer install or renew digital certificates on their computers, or be asked to remember the answers to secret questions. (Did I say my favorite vacation was Disneyland or Yellowstone?)

Your first login on any computer starting August 24 will take a few extra steps. You’ll want to be near your phone or have access to your e-mail account.

When you logon that first time, you’ll be prompted to choose from the delivery options you’ve previously listed in online banking – phone numbers and e-mail addresses – for delivery of a six-digit secure access code. (Don’t bother memorizing that code; it’s only valid for 30 minutes.)

You’ll be prompted to enter that code within online banking. Then, you’ll have some new options. You can:

Choose to use a secure access code every time you logon with that particular computer or browser.
Use this option with “public” computers, such as those at libraries or internet cafes. Or, use it with all computers if you are especially concerned about security.
Permanently register your private computer at home and work.
Thereafter, you’ll need only your member ID and password to access online banking from those computers.
Note: Don’t use this option with public computers.

“For folks willing to commit to these highest levels of security, we have their backs, financially,” with our ironclad guarantee against fraud losses, said Dale Davaz, STCU director of e-business.

But, there is a third option, for members who are more concerned about convenience and flexibility.

After using MFA once to access online banking using either of the two options above, you can quickly set up a four- to 10-character “challenge code.” That code, along with your member ID and password, can be used to logon from any computer at any time.

The challenge code is a bit less secure than the other options, so you’ll want to use a bit of caution to assure your computer is protected from malware and viruses. And some features of online banking won’t be accessible when using a challenge code.

“Given this variety, we hope that everyone finds an option that matches their preferences for extra security or greater convenience, whichever is most important to them,” Davaz said.

Establishing a challenge code

After logging on to online banking using a secure access code, you can establish a challenge code that will allow you limited access from any unregistered computer. That's particularly useful when you don’t have access to your phone or e-mail account for receiving a secure access code. Setting up and sharing a challenge code will also be a requirement for certain personal financial management tools like Yodlee that log into online banking on your behalf to get your transactions and balances, once they've updated their scripts for doing so.

Keep in mind that using a challenge code is slightly less secure than using a secure access code. We can't extend our normal security guarantee when you share your challenge code along with your member ID and password to third-party services. And you won’t be allowed to register computers or manage your secure delivery contacts when using a challenge code during the login process.

Here’s how to do it:

In STCU online banking, click on the Security link found under Preferences in the left-hand column.
Click the Challenge Code tab.
In the “My Code” box, enter a challenge code of between four and 10 characters. It must contain at least one number and at least one letter.
The next time you logon from an unregistered computer, you will be presented with your secure access code delivery options, plus a new option of entering your challenge code for one-time access.

Members needing extra assistance logging on starting August 24 are encouraged to call the credit union at (509) 326-1954 in Washington; (208) 619-4000 in Idaho, or (800) 858-3750 toll-free, or use LiveChat.

Getting started

Starting August 24, there will be some security changes at STCU online banking. Here’s the procedure for your first logon with any computer:

Log on to online banking at http://www.stcu.org./
Obtain a secure access code by selecting one of the phone numbers or e-mail addresses you have previously provided to STCU. Within minutes, you will receive a six-digit secure access code that’s valid for 30 minutes.
Enter that access code where indicated.
Choose one of two options:
- Activate this computer for later use. The next time you logon with this computer, you will need only to enter your User ID and password.
- Give me one-time access only (do not activate this computer). This is your most secure option, particularly for public computers, such as those at libraries.
Click “Continue,” and you will be sent to your Account Overview page.

Note: To register your computer, it must be configured to accept “cookies” from our site.

Add contact options

After logging on to online banking using a secure access code, you can manage your trusted phone numbers and e-mail addresses used for receiving secure access codes.

It’s good to load those other phone numbers and e-mail addresses we may not already have on file for you. You can even load your mobile phone number to receive SMS text messages.