Credit Unions Can Bolster Member Security with Passkey Technology
Credit unions and other financial institutions count cybersecurity among their top business concerns amid an ever-changing technology landscape. Not only is cybersecurity foundational to operations, but it is also critical to maintaining customer trust. Traditional two-factor authentication methods (2FA), like one-time passcodes delivered via email or SMS, offer a layer of protection, but they have growing vulnerabilities. Phishing attacks can trick users into revealing these codes, and outdated technology can be susceptible to interception.
Enter passkeys, a new security frontier for credit unions. Google introduced passkeys to its users in 2022, and to date, more than 400 million Google users have adopted them. Passkeys are a powerful alternative to traditional two-factor authentication, eliminating the need for codes while offering credit union members a more secure and user-friendly login experience.
How Passkeys Work and the Advantages
Passkeys use public-key cryptography, which uses a pair of keys—a public key and a private key—to encrypt and decrypt data. Instead of using a password for an app or website, passkeys create a unique key pair for each user and device. A device creates a kind of secure keycard, except it is digital. Once a device is unlocked, it sends the passkey to the app or website in a way that verifies identity without the app or website being able to keep a copy of the passkey. This significantly reduces the risk of interception or social engineering scams.
Simply, passkeys offer better security and user experience. They provide a frictionless login process, fostering trust and satisfaction as well as greater adoption. When security measures are simple and quick, they can be offered on every login instead of just “high-risk scenarios,” thereby protecting against the many forms of fraud.
There are clear operational and financial benefits for credit unions, chiefly reduced fraud losses. More robust security translates to fewer fraudulent transactions, protecting credit unions and members. They can also reduce the headache of other 2FA methods. Logins are faster and simpler—no more waiting for codes or remembering complex passwords, which can be an extra headache if a user doesn’t have immediate access to their email provider.
Passkeys for Financial Institutions
Large tech companies, from Amazon to PayPal to WhatsApp, have made them available, but banks and credit unions are often at the mercy of their digital banking providers to make new authentication technologies available. Credit unions should seek out fintech partners that prioritize leading technology and advance security experiences for their members to help set themselves apart from their competitors.
Adoption Strategies for Credit Unions
Recognizing that not everyone will readily adopt every improved multi-factor authentication mechanism, credit unions should consider a phased rollout to encourage adoption. Start by making passkeys available, promoting their benefits, and considering offering early adopter incentives. Then, gradually depreciate less secure options.
Start with early adopters. Remove less secure, one-time passcode emails or SMS options when users register a passkey on their account. Meanwhile, continue guiding members toward passkeys with messaging and reminders on your credit union’s website or app. As mobile devices, web browsers, and password managers continue to improve their seamless passkey experiences, consider turning off the ability for new user registrations with one-time passcodes.
This sets up members for a more robust default security posture from their first digital banking logins. Finally, address late adopters by requiring passkey enrollment on a capable browser and device as an interstitial prompt on the next login.
The Future of Authentication
Passkey technology is evolving, but its advantages are undeniable. By offering a more secure and user-friendly login experience, passkeys can significantly enhance protection for credit unions and their members. As mobile technology advances and passkey adoption continues to grow, this approach holds the potential to become the new standard for secure online interactions.
Credit unions have a responsibility to safeguard member data. By embracing innovative solutions like passkeys, credit unions can take a proactive approach to security, building trust and fostering a secure digital banking environment for their members.
About Author:
Sean McElroy has built engaging financial services companies and products throughout his 23 year software engineering and cybersecurity career. At Lumin Digital, Sean is the Chief Risk Officer (also serving as the Chief Security Officer), responsible for cybersecurity, risk management, and privacy programs to scale the next generation of cloud-based digital banking securely across global data centers. In 2009 he co-founded Alkami Technology (NASDAQ: ALKT), where he served in roles ranging from CTO to CISO to build innovative solutions. Prior to Alkami, at Computer Services, Inc. he led all software development teams to create patented, first-to-market SaaS solutions for online banking document delivery, remote deposit capture, check item processing, and expedited payments. Sean earned a Master of Science in Information Security Engineering from the SANS Technology Institute, and holds a BBA in Management and in Management Information Systems from the University of Oklahoma.