(a) types of information that can be seen about the member should an unauthorized person gain access to a member account via cu*@home

It’s Me 247 Risk Assessment: Product Feature Matrix
Revised June 21, 2011
Legend:
(A) Types of information that can be seen about the member should an unauthorized person gain access to a member account via It’s Me 247.
(B) Actions that can be taken with the member’s information or money should an unauthorized person gain access to a member account via It’s Me 247.
(C) Marked if the feature is considered a special security feature of the home banking software to help prevent unauthorized access or alert member of
unauthorized activity.
(B)
(A)
Actions That Can
(C)
Member
Be Taken with
Considered a
Information That
Member Money /
Special Security
Feature
Feature Overview
Can Be Seen
Info
Feature
• Brand It’s Me 247 login screen with your credit union
• Context-sensitive help from any screen describing It’s
Me 247 features, options and answering frequently-
asked questions
• Stand-in processing makes home banking services available even during nightly and monthly CU*BASE processing • Includes all standard features (not VMS) • Defined by member in It’s Me 247
• Select from four default options for new members (last four of SSN, first four of SSN and first two letters of first name –all caps, birth year and first 2 letters of last name – all caps, last four of SSN and birth year • Member is required to change the password immediately on the first access (not allowed to set a new • CU can allow MSR to set a “custom” password in • Member is only allowed 3 tries before the password is disabled, to prevent someone from trying to “guess” a member’s password • CU can reset a disabled password to the default (see Custom Password options above); member is required X:\Writing Team\Private\Misc Booklets\Audio-PC Bank Books\Risk Assessment\CHRiskAssessment-FeatureMatrix.doc (B)
(A)
Actions That Can
(C)
Member
Be Taken with
Considered a
Information That
Member Money /
Special Security
Feature
Feature Overview
Can Be Seen
Info
Feature
• Controls for number of days that a new member is able to access online banking if enrolled at membership open, after that require CU reset • Retricts access to 24 hours after password reset, after • CU can set an amount of days for “expiration of password” – if member not log into online banking in this time period, require CU reset • Members are required to accept the “It’s Me 247 PC
Home Banking Use Agreement” the first time they
access It’s Me 247
• Acceptance date is recorded in credit union files • Message appears on the Login History page indicating the date and time when a member last accessed It’s Me
• Helps provide security against unauthorized access • Details link shows individual session date and time; lists sessions abandoned vs. timed-out vs. logged out • Data shown for current and previous two months • Supports your CU’s home banking fee strategy and encourages members to see the value of these services • Displayed via CU*BASE Inquiry, Phone Op and Teller • Shows minutes used current and previous month and other self service status (bill pay, e-statements) • Time limits are CU-defined based on screen category • Message displayed when It’s Me 247 services are
temporarily unavailable, asking the member to try later • Choose from 22 standard messages, such as “Your members via It’s Me 247
checks have arrived.” or “Your loan has been approved.” etc., or define a personalized, free-form text • Members can submit requests via It’s Me 247 for a
(B)
(A)
Actions That Can
(C)
Member
Be Taken with
Considered a
Information That
Member Money /
Special Security
Feature
Feature Overview
Can Be Seen
Info
Feature
credit union representative to contact them • Members can choose from multiple “skins” to view It’s
Me 247 the way they prefer
• Features work the same in all skins • CU can control which skins are available • Features grouped under a “Personal Preferences” link to emphasize a member’s sense of control over the banking experience • Includes site styles, personal information update, password changes, and e-statement options • Renewal option • Last renewal/rollover date (B)
(A)
Actions That Can
(C)
Member
Be Taken with
Considered a
Information That
Member Money /
Special Security
Feature
Feature Overview
Can Be Seen
Info
Feature
• Delinquency status • Last statement balance (online CCs) • Last transaction date (online CCs) • Last payment amount (online CCs) • View a list of all transactions on any account; shows secondary transaction description (ATM location, • Choose number of transactions to display; select • Sort the list by date (ascending or descending) • Withdrawals only • Cleared checks only • ACH and Payroll transactions only • ATM/Debit card transactions only • See if a specific check number has cleared plus: • Acct suffix • Acct description • Transfer funds to and from savings and checking accounts, with withdrawal controls by share dividend • Transfer funds to make payments on loan accounts, with • Transfer funds from open-credit loans, with • View total reported dividends/interest for all accounts (B)
(A)
Actions That Can
(C)
Member
Be Taken with
Considered a
Information That
Member Money /
Special Security
Feature
Feature Overview
Can Be Seen
Info
Feature
• View current YTD paid dividend and interest totals for plus: • Acct suffix • Acct description • Download a customized file format (QIF) for use by the Quicken financial management software (2004 or • Download a customized file format for use by the Microsoft Money financial management software • CU-defined general sales information about savings, certificate and loan products; enabled even if you elect not to use VMS features (see below) • Estimate a loan term or loan payment • For CUs using CU*BASE Tiered Service levels, can display on the It’s Me 247 main menu the same
marketing messages that appear on statements • Waivers for age and aggregate balance; specify number • Set separate waivers and free minutes for participating members using Tiered Services and Marketing Clubs • Allow members to view up to a year’s worth of statements on line through It’s Me 247 using the
(B)
(A)
Actions That Can
(C)
Member
Be Taken with
Considered a
Information That
Member Money /
Special Security
Feature
Feature Overview
Can Be Seen
Info
Feature
CU*SPY browser-based retrieval software (no additional • View/print statement in both HTML and PDF formats (PDF format includes CU logo and “back page” text from • Fee structure allows for members to receive only e- statements or e-statements plus mailed statements for an introductory period; fee (debit) or rebate (credit) can • Enrollment through It’s Me 247 or CU*BASE
• “Consolidated logon” - member only needs to log in to It’s Me 247, making bill payment a credit union service
“Good funds” processing means funds must be available for payments to post, eliminating risk for CU; true “electronic checks” system – available through EasyPay by iPay, EasyPay by Fiserv does not follow the Good • Monthly CU-defined fee structure includes age and aggregate balance waivers, excessive activity fees information on all member-designated payees • For CU*3 Item Processing clients, can activate the CU*CheckViewer image retrieval system for your members through It’s Me 247
• Members can view and print cleared checks using buttons on the Account Detail and Cleared Checks • No special fee will be charged to your CU or to your • For online or self processing credit unions who do not • Can be live interface to image database from your check including: processor, or can set up method for regular uploads and (B)
(A)
Actions That Can
(C)
Member
Be Taken with
Considered a
Information That
Member Money /
Special Security
Feature
Feature Overview
Can Be Seen
Info
Feature
storage of check images from your check processor • Uses the same buttons in It’s Me 247; no fee will be
• Can activate the ability to transfer money from the member’s account to another member’s account (requires password access on the “from” account only) It’s Me 247)
• Optional Transfer Control can be used to limit the member accounts to which funds can be transferred Risk is reduced if Transfer Control lists are configured, then the TO account base is not needed/shown • Members can request a check drawn on any of their It’s Me 247)
• Can specify minimum and maximum check amount No special fees will be charged to members for this • Checks are printed by CU on a daily basis in a batch using the CU*BASE Auto/Mail Check feature • Members can place a stop pay order on a check drawn It’s Me 247)
• Uses your normal stop pay fees; alerts member to fee • Members can update existing auto transfers from their • Transfer Control can be used to limit the member accounts to which funds can be transferred; intra- member transfers must be enabled to modify transfers • Can activate just AFT maintenance, just CFT (B)
(A)
Actions That Can
(C)
Member
Be Taken with
Considered a
Information That
Member Money /
Special Security
Feature
Feature Overview
Can Be Seen
Info
Feature
• Define links to any URL, including your credit union’s web site (for product information, disclosures, eligibility rules, etc.), or to third-party vendors for credit card info, check re-orders, etc. • Allow non-members to submit membership applications from your web site or from the It’s Me 247 login page
• Data is delivered directly to CU*BASE and can be • After reviewing the application, the membership can be approved and created with the click of a button • Allow members to update address, phone, fax, and email address through It’s Me 247; special helps for
• Can configure for “direct” update of credit union files, or “reviewed” update (requires credit union employee to review and approve before updating files) • Display your credit union’s savings and checking products in It’s Me 247
• Shows a description, current rate, annual yield, and • Configure custom sales message with competitive market statement, instructions, and other disclosure information; include links to your web site (B)
(A)
Actions That Can
(C)
Member
Be Taken with
Considered a
Information That
Member Money /
Special Security
Feature
Feature Overview
Can Be Seen
Info
Feature
• Allow members to open select savings accounts through • Member Name It’s Me 247
• Optional configuration features include a minimum required deposit to open account (transferred from an existing account) and optional overdraft protection (using select savings or LOC accounts) when opening • Account is opened immediately with no CU intervention; use daily New Account reports for follow-up • Display your credit union’s certificate products in It’s Me
• Shows a description, current rate, term, annual yield, • Configure custom sales message with competitive market statement, instructions, and other disclosure information; include links to your web site • Allow members to purchase certificate accounts in It’s
Me 247 using funds from their existing savings accounts • Acct base
• Optional configuration features include default dividend disbursement code, payment frequency, and renewal • Account is opened immediately with no CU intervention; use daily New Account reports for follow-up protection (using accts under same mbrship) Loan “Rate Board” and product • Display your credit union’s loan products in It’s Me 247
• Shows product name, “teaser” description, and APR • Configure custom sales message with competitive market statement, instructions, and other disclosure information; include links to your web site (B)
(A)
Actions That Can
(C)
Member
Be Taken with
Considered a
Information That
Member Money /
Special Security
Feature
Feature Overview
Can Be Seen
Info
Feature
• Allow members to submit loan requests and complete loan applications in It’s Me 247
• Requests are delivered directly to CU*BASE and can be • Street address, worked by loan underwriters along with other CU*BASE • CU can elect to activate It’s Me 247 automatically for
new members, or require member to request access before manually activating • Set a minimum number of characters (6 -10) • Can implement complex passwords – requires two of the following: numeric, alphabetic, and special characters, and capital letter “Non-use” password expiration • Can set password to “expire” automatically after a • Member must contact CU to have password reactivated (can retain same password or reset to default) • Can set the number of days after which the password of a new member will expire if the member does not log into online banking • Can deactivate a member’s password altogether so that • CU defines whether home banking transactions are • Define whether par value should be deducted when (B)
(A)
Actions That Can
(C)
Member
Be Taken with
Considered a
Information That
Member Money /
Special Security
Feature
Feature Overview
Can Be Seen
Info
Feature
calculating available balance for share/checking accounts • Define whether uncollected funds (check holds) should be deducted when calculating available balance for share/checking accounts • Define whether CD penalty should be deducted when calculating available balance for certificate accounts • By share dividend application, can define whether or not withdrawals are allowed via home banking • Can also define a minimum and maximum withdrawal • By loan category, can define whether or not to allow • Can also define a min. and max. withdrawal amount • Can define whether or not to allow loan payments via • Can define controls to prevent partial payments, payments prior to first payment date, and payments on mortgage loans prior to accrual date • CU can elect to allow members to subscribe for e-Alerts online through It’s Me 247 (CU*BASE feature also available for staff to maintain for members and view alerts sent) • Member receives the alert via the It’s Me 247 Secure • Member can optionally select to also receive email notification alerting them that an alert has been send (no account details included in the email – short option) or a “long” email containing more detailed information • e-Alerts email notification is sent within 30 minutes of • Account Balance above or below specified amount • ACH Deposit and/or Withdrawal posted to account (B)
(A)
Actions That Can
(C)
Member
Be Taken with
Considered a
Information That
Member Money /
Special Security
Feature
Feature Overview
Can Be Seen
Info
Feature
• Loan Payment coming due within specified # of days • Allow the credit union to send an electronic version of a • Members can view their e-Notices in their Secure • Content of e-Notice is the same as printed notice, except that member’s private information is masked in the e-Notice for additional security • Members can select to have an additional email notification sent when the e-Notice is sent • Members can quickly access other online banking pages via helpful links directly in their e-Notices, for example to access the tranfer screen to pay on a delinquent account (from a delinquency e-Notice) or to change the renewal options (from a CD Maturity e-Notice) • e-Notices email notifications are sent within 30 minutes • Allow a member to make incoming and outgoing transfers to an account at another financial institution • Member Service representative must set up relationship with other account in CU*BASE. Member cannot do this online • Credit union allowance of incoming and outgoing transfers are set up separately with separate fee structures to give credit union flexibility • Fees are tied to Tiered Services and Marketing clubs to allow credit union to waive fees for valued members

Source: http://cuanswers.com/pdf/security/CHRiskAssessment-FeatureMatrix.pdf