Account-to-Account Transfer Services Risk

Transcription

1 Account-to-Account Transfer Services Risk This white paper is part of the Risk Management White Paper Series, which CUNA Mutual Group provides exclusively to its Bond policyholders.

2 TABLE OF CONTENTS Table of Contents Introduction... 2 The ACH Network... 2 Risks... 3 Third-Party Service Providers... 5 Appendix: Risk Matrix... 7 CUNA Mutual Group Account-to-Account Transfer Service February

3 INTRODUCTION Introduction Online account-to-account (A2A) transfer service is emerging as a must offer transactional service for credit unions as it positions the credit union at the center of the member s transactional needs. A2A electronic funds transfer offers self-service ACH capability to credit union members. A2A transfer service allows a member to transfer funds between his or her credit-union account as well as accounts at other financial institutions. It also allows transfers between accounts at different financial institutions with different owners. A2A has gone by the following different names over the last few years: Self-directed ACH (or member-directed ACH) Inter-institutional transfers Me-to-me transfers Person-to-person (P2P) transfers A2A is a member-directed service that ties into an automated processing system. Credit unions offer A2A through online banking systems. Prior to A2A, a member who wanted to transfer funds between his or her credit union account and his or her account at another financial institution had to arrange for a wire transfer with the credit union to send the funds. Alternately, the member would have to physically travel to the credit union to make a withdrawal and then travel to the other financial institution to make the deposit. A2A transfer service allows consumers the opportunity to transfer funds between their accounts at different institutions from the comfort of their homes or offices at any time. Most credit unions offer A2A transfer service through a third-party service provider. Many vendors that offer A2A solutions also include P2P capabilities as part of the package. The credit union s employees are almost entirely removed from the process. The ACH Network Most A2A transactions are conducted through the Automated Clearinghouse House (ACH) network. The ACH network provides inter-bank clearing of electronic funds transfers initiated by participating depository institutions. It follows rules developed by the National Automated Clearing House Association CUNA Mutual Group Account-to-Account Transfer Service February

4 THE ACH NETWORK NACHA). Under NACHA rules, online A2A transfers are coded as Standard Entry Class Code WEB for transactions initiated over the internet. Risks There are a number of risks associated with A2A transfer service. The following is a summary of the risks along with risk mitigation strategies. Security Risk Security is a primary concern for credit unions offering A2A service. Credit unions have the fiduciary responsibility and bear the liability for transactions flowing through their institutions. A2A service has the potential to significantly increase not only the volume of transactions flowing through member accounts, but also the dollar amount of the transactions. Since A2A transfer service is usually offered by credit unions through online banking systems, member authentication becomes critical. The Federal Financial Institutions Examination Council (FFIEC) issued Guidance on Authentication in an Internet Banking Environment in 2005 along with an update in The NCUA issued Letter Nos. 05-CU-18 and 06-CU-13 summarizing the FFIEC s rules. The regulation requires credit unions to perform a risk assessment to determine if the transactional services offered via the online banking systems are high-risk. If so, the credit union is required to implement multifactor authentication measures. A high-risk system is any system that allows funds to be transferred to third parties. Account Authorization Risk This risk exists when the account is otherwise not valid or when access is not authorized. Credit unions can mitigate these risks by implementing procedures to confirm external account ownership. One of the largest risks associated with A2A is where the user pulls funds from an account at another financial institution for deposit to his/her credit union account (ACH debit). If the user does not own the account at the other financial institution or is otherwise not authorized to conduct transactions on the account, the credit union could incur a significant loss. The other financial institution has 60 days to return an unauthorized ACH debit to the credit union. This type of credit risk is uninsurable. CUNA Mutual Group Account-to-Account Transfer Service February

5 RISKS To mitigate this type of credit risk, credit unions should implement procedures to validate account ownership of the linked account. This can be accomplished in a number of ways: Trial Deposits: Account ownership of the linked account is confirmed by processing small debits (less than $1) to the linked account. The member is required to confirm the debits with the credit union. Provide Account Information: This is similar to account aggregation and provides the fastest verification of a linked account. The member provides his or her account information along with information about the other financial institution. The member also provides the credit union with a username and password to access that account through the other institution s online banking system. Database Verification: This method of account verification checks the account against third-party industry databases that may help to quickly verify the validity of the account. Paper Verification: This is probably the most secure method of account ownership verification. It typically requires members to complete an application for the A2A service and provide a voided check or a monthly statement to verify ownership of the linked account. Transaction Risk Transaction risk occurs when the transactions are denied for reasons such as NSF. The ACH network is not a real-time network. Therefore, ACH transactions settle three to four days later. The linked account may have insufficient funds to cover the ACH debit, which could be returned as NSF. The credit union may incur a loss if the member withdraws the funds prior to the settlement date. Credit unions should not offer this service to members without performing a risk assessment. Due to the potential risk involved in offering A2A transfer service, credit unions should qualify members for the service. An excellent method of qualifying members for the service is to evaluate creditworthiness by pulling a credit report. Another risk mitigation strategy is to establish monetary and frequency limits for the A2A service. Credit unions may want to implement lower limits for new members and allow higher limits for their best members. CUNA Mutual Group Account-to-Account Transfer Service February

6 RISKS Fraud Risk Fraud is a concern for every credit union that offers transactional services through its online banking system. A number of credit unions have experienced losses due to member account compromises through online banking systems where the members provided usernames and passwords in phishing attacks. Fraudsters have also obtained usernames and passwords through malicious malware (e.g., keyloggers) infecting member home personal computers. Keyloggers capture keystrokes and return the captured data to the fraudster. A key risk-mitigation strategy is not to make this transactional service available to members automatically upon initial set-up to the online banking system. Some members may never use the A2A transfer feature, which increases fraud risk. Rather, have the members enroll for this service. This same risk mitigation strategy applies to other transactional services offered through online banking systems. Member education is another important risk mitigation tool. Credit unions should post articles on the website, as well as in quarterly newsletters, on how members can protect themselves online. Another helpful educational tool it to post a warning to the online banking login page alerting members to the importance of using antivirus and anti-spyware programs to protect their personal computers. These security programs will help reduce the risk of member home computers from being infected with viruses and other malicious software, such as Trojans and keyloggers. Credit unions should also warn members of the dangers of accessing their accounts using personal computers that are accessible to the public. Libraries and cyber café s offer personal computers for public use. Such computers could be infected with malicious software. Third-Party Service Providers Credit unions contemplating this service often work with a third-party vendor specializing in A2A service. This allows credit unions to offer the A2A transfer service under its own label. More importantly, third-party vendors can help mitigate the risk to credit unions by verifying account ownership of linked accounts, handling all aspects of ACH processing, ensuring compliance with applicable rules and regulations, and providing risk-management tools. Some third-party A2A service providers may even assume some of the risks. CUNA Mutual Group Account-to-Account Transfer Service February

7 THIRD-PARTY SERVICE PROVIDERS Although third-party vendors may provide risk management services to credit unions for the A2A transfer service, credit unions are ultimately responsible for the transactions processed. Therefore, credit unions should perform their due diligence in understanding the various risks involved in offering A2A transfer service as well as investigating potential third-party providers of A2A transfer service. CUNA Mutual Group Account-to-Account Transfer Service February

8 APPENDIX: RISK MATRIX Appendix: Quick-Reference Risk Matrix Exposure 1. Unauthorized user gets into member s account through the online banking system and, using the A2A feature, transfers funds out of the member s account (ACH credit) into an account at another financial institution. 2. An accountholder at another financial institution uses the other institution s A2A feature and creates an unauthorized ACH debit pulling funds out of the member s credit union account. 3. Using the A2A feature, a member initiates a transfer from an account at another financial institution (ACH debit) into the member s credit union account. The member then withdraws the funds from his/her credit union account. Within the next 60 days, the owner of the account at the other institution claims the transfer was unauthorized and the other institution returns the unauthorized debit to the credit union. Loss Controls Implement multifactor authentication. Implement monetary and frequency limits. Ensure the member notified the credit union within the period allowed by the Regulation E disclosure. Timely return the unauthorized ACH debit to the originating financial institution under the ACH rules. This requires obtaining a signed affidavit from the member stating the ACH debit was not authorized Possible loss controls include verifying the member is the owner of the account at the other institution or is otherwise authorized to conduct transactions on the other account. Use the services of a third-party vendor to verify ownership of the account at the other financial institution. Some vendors may assume some or all of the liability. Review a voided check or statement from the account at the other financial institution to verify account ownership. Initiate small debits (less than $1) to the account at the other financial institution. The member must then confirm the date and amount of the transactions to prove they have access to the account. Qualify members for the A2A transfer service. This may include performing a risk assessment or offering the service only to members with accounts in good standing. Implement monetary and frequency limits. CUNA Mutual Group Account-to-Account Transfer Service February

9 CUNA Mutual Group is a leading provider of financial services to credit unions, their members, and valued customers worldwide. With more than 75 years of market commitment, CUNA Mutual s vision is unwavering: to be a trusted business partner who delivers service excellence with customer-focused, best-in-class products and market-driven innovation. Visit or call for more information. CUNA Mutual Group Proprietary and Confidential. Further Reproduction, Adaptation, or Distribution Prohibited. Insurance products offered to credit unions are underwritten by CUMIS Insurance Society, Inc., a member of the CUNA Mutual Group. CUNA Mutual Insurance Agency, Inc., an affiliate within CUNA Mutual Group, is the marketing agent licensed to broker Property and Casualty coverages. P.O. Box Mineral Point Road Madison, WI CUNA Mutual Group, 2011 All Rights Reserved.