Business Banking Customer Login Experience for Enhanced Login Security User credentials uniquely identify each person who uses the banking platform. The intent of authentication is unequivocal verification of the user s claimed identity. There are three main factors used for authentication; Something the user knows (passwords) Something the user has (physical token or one time passcode) Something the user is (biometrics) Through Enhanced MFA we can now offer out of band delivery options for added security though one time passcodes that can be received through voice or SMS text delivery channels. Challenge Questions and Answers will no longer be used and are in fact, something a user knows and NOT something a user has possession of. Similarly, the questions posed are typically out of wallet and easily answered by simple research through social websites or browsing the internet. The following is the first screen that company administrator / company user will see will upon being challenged through password reset or when a computer is not recognized. The company users will see all options that have been enabled and all others will be grayed out until they are setup or enabled. Take a look at the following screenshot. IMPORTANT: Company Administrators will need to update company users email addresses and phone numbers for EMAF enablement. 1
email Selected Experience A company administrator / company user will receive the following email with the security code if email is selected. Voice Selected Experience A company administrator / company user will receive a call to the telephone number selected. Please note that Mechanics Savings Bank name will be stated in the call as follows. Text Selected Experience - Once a company administrator/ company user logs in, they will be able to enable their cell phone number to receive the security code via text message with these two steps: 1. Admin> Login Credentials 2. Enhanced Login Security Following are two diagrams of how to add the text message feature. 2
NOTE: Company user will be able to update information once their phone has been activated by the Company Administrator. A. Please check off the Text box to enable the text feature for a particular phone number. B. Next please click on the Activate Text and an activation code will be sent to your hand held device. C. Enter the code that was sent to your hand held device in the Activation Code box and click on Submit D. Please update the screen by clicking on the Update tab at the bottom. This has completed your text feature enablement. 3
Enhanced Login Security FAQ Enhanced Login Security is a new online security feature that provides additional protection from fraud and identity theft. By recognizing your login identification and your computer, Enhanced Login Security verifies that you are authorized to have access to the online system. Am I required to use the Enhanced Login Security feature? Yes, once this feature is enabled for your business by your financial institution, you will be challenged at login if the system does not recognize your computer. Enhanced Login Security helps prevent unauthorized access to the online system, protecting the functions and financial information related to your banking accounts. What does challenge mean? If the system does not recognize your computer, or your password has been reset you will be challenged for additional authentication information known only by you. In the past you were challenged by responding to security questions. With Enhanced Login Security you will now be sent a security code. What is a security access code? A security access code is a temporary code provided by the system that is unique to you and is used in the process to authenticate your identity. When will I receive a security access code? When a Security Access Code feature is enabled, you will receive a security access code each time you re Company ID, User ID and User Password has been successfully authenticated from a computer that is not recognized. You may also receive a security access code when your User Password has been reset at your financial institution. Will my security code expire? Yes. Your security code will expire if your session times out or within 30 minutes, whichever is less. The expired security code entry will count as a bad login attempt. Can I reuse a security access code? No. Each security access code is unique and valid for a single use only. If a security access code has been used previously, a new security access code must be generated and entered to gain access to the system. Will I be required to provide a security access code the first time I am challenged? Yes. Once you have been challenged you will need to request a security access code to access the system. Can I still log into the online system from anywhere? Yes. This service does not prevent you from logging in from any computer. If we do not recognize the computer that you are using, then you will be challenged for a security access code before being allowed access. How does Enhanced Login Security work? Once you are challenged the system will give you the opportunity to enroll each computer that you use for online banking. Once you have added the extra login security to your computer, you will see no difference to the login functionality. However, if you login from a different computer than the one you have enrolled, you will be presented with the challenge in order to login. 4
We recommend that you only enroll computers that are secure and can only be accessed by authorized individuals. For example: you would not want to enroll a computer that was located within a public area, or used by many people. Please note that if you use multiple browsers within the same computer you will need to enroll each browser separately. What does it mean to enroll my computer? When you enroll your computer for this service, you allow the system to place a code, called a cookie, on your computer. The cookie contains a unique identifier that is used in combination with your login identification. At every subsequent login attempt after enrollment, the system will look for this cookie and validate that it matches the login identification that you entered. This cookie is used by the system only to validate your computer s identity and does not contain any personal information. What should I do if I want to unenroll a computer that I have previously enrolled? If you discontinue using a specific computer to access the system, we suggest that you unenroll that computer from this service. This can be done by logging into your account from the computer that you want to unenroll and selecting the Unenroll this Computer button on the Enhanced Login Security screen. This will remove the secure cookie from that browser. If an attempt is made to log into the system from the unenrolled computer, a challenge will be presented before access is granted. 5