Fraud detection is so slow at credit unions that thieves are often willing to pay more for stolen card numbers and other data involving credit union issuers, according to Canh Tran, co-founder and CEO of Chicago-based fraud analytics firm Rippleshot.

In fact, credit unions and even community banks are bigger targets than megabanks such as Citibank, Bank of America and Capital One, Tran noted, and the looming EMV conversion could make things worse before making them better.

"Citibank and Bank of America have 60 to 100 people in their fraud reduction department," he explained. "Eventually, using their own analytics and a lot more resources, they'll be able to identify that fraudulent card sooner. The thieves know that, so they'd rather buy the cards from the credit union and the community bank because they know that card will not be detected for quite a while, so more fraud will be perpetrated on those cards."