Home Page Log-ins Sacrifice "Pharming" Security for Member Convenience

Asking members to log on to an unprotected Web site is like sending unwary sheep on a route that winds through a valley occupied by mountain lions. Some who take that route may come out unscathed, but it’s likely that at least a few will get fleeced. Logging on to an unprotected site is unsafe due to the growing problem of domain name service (DNS) spoofing. Several terms have been applied to this problem. Some technology writers like to use the term “pharming” to describe it, while others claim it’s a variant of “phishing.” Some like the term “spoofing” to acknowledge its use of fake Web sites that create an illusion of security for users, while others prefer DNS “poisoning” to describe its impact on account holders. Whatever name is used, security experts can attest that it is a serious and growing problem. Unfortunately, many credit unions fail to recognize that their own practices are increasing risk for their members. DNS spoofing can occur when a member opens an e-mail containing a virus that alters the host file on his or her computer, or when an Internet Service Provider (ISP) alters the DNS record for a domain. As a result, when the member opens the browser and types in the name of the credit union – or another financial institution site – the member is redirected to a fake site that mimics the original in appearance and functionality. That site collects the member’s user identification and password, which criminals can then use to gain access to accounts online. A variant on this practice is a virus that records keystrokes, such as account log-ins and passwords, and then transmits the information to the criminal. DNS spoofing is often ignored by credit unions that rank member convenience higher than security. They believe that placing the log-in on the home page offers the most convenient route for members. Proponents of this practice may be found on the board of directors, in the marketing department, or among executive leadership. These misguided proponents of member convenience argue that reducing the number of steps required to perform online banking functions makes it more likely that members will return more frequently to perform transactions and sign up for additional products and services. However, offering log-ins from a site that does not use Secure Socket Layer (SSL) technology makes it easier for hackers to steal user identification information and passwords that typically protect accounts online. Without SSL, members can easily be fooled when phishing or pharming schemes misdirect them to sites created solely to persuade them to hand over private information. To protect members, credit unions should abandon home page log-ins in favor of placing a button on the home page. Clicking on this button would link the member to a Web site protected by SSL technology. Encrypting information while it is transported from the Web server to the Web browser protects both the authentication method and account information. Even more important, SSL authenticates the server. (This is why Web sites must go through the process of obtaining certificates and proving that the holder of the certificate is authorized to use a specific domain name.) When the log-in form resides on a site that lacks authentication, users lack the means to determine what server they are connecting to. In other words, the door is wide open for pharmers to enter. Credit unions who refuse to add this step to protect members often justify it by pointing out that many regional and even national banks place their log-ins on the home page. In this instance they are following the wrong leader. They would be better advised to follow the example of financial organizations known for their security, such as Charles Schwab. Additional tools and tactics can also help prevent DNS spoofing. Educating members about phishing, pharming, and other fraudulent practices is essential. Members need to know how to recognize the credit union’s site, and how to react when e-mail links or domain name spoofing leads them astray. The credit union can also take advantage of additional tools to reinforce members’ safety and security. A “security key” is one option. By displaying specific information provided by the member in a special box on every page, the security key visually verifies that members are on the credit union’s site. The ability to recognize the security key is enhanced when members can select background colors and display fonts to easily personalize the credit union site to their specifications. This personalization is combined with the security key to make their “personal” site easily recognizable. Credit unions who see these extra steps as making the site less convenient are missing the point. Nothing is more inconvenient to members than having their identity stolen or having their assets disappear. Web sites that place log-in forms on the home page may have a slight advantage in short-term marketing impact, but in the long run, members are more likely to remember that superior credit unions create the extra steps required to protect their members.