Access Credit Union and lack of 2fa | Hubert Financial | Discussion forum

notsavvy said
Hope that is a better explanation.  

If it's an option, try to keep as little money as possible liquid.

I don't keep money in HISA in multiple institutions, only one.

All others I only have GICs and no lines of credit.

It's sort of like having a mortgage or HELOC on your house to prevent someone from selling it fraudulently.

My point wasn't explained well either and that is that no form of protection is better than you monitoring yourself. I see a lot of people who are not like you and don't monitor because they put too much faith in security measures.

2FA (MFA), if provided for in multiple ways that everybody can use, is of course highly advisable. However with the lack of thinking a few of the banks, insurance companies, governments and (gasp of all people) telecoms put into it, it can easily turn into a disaster that permanently locks a good percentage of people out of essential services.

So petitioning etc. should not happen until first those Companies demanding it have to make it work, with all possible multiple options for everybody.

PayPal does it best by starting with a choice of SMS, or an automated phone call to your Home phone, or a code sent to the e-mail they have on file. The latter two are time limited, commonly with Companies I've noticed 10 minutes but some are shorter. This is the proper way to do it, providing for those who can't receive SMS (about 10% of the population), people who are traveling with a laptop as opposed to a desktop computer at home for example.

On the complete opposite side of the spectrum, we have Rogers that seems intent on, for no known reason, intentionally causing great stress on customers even as competitors are pushing hard to get Rogers customers to leave them.

Rogers instituted MFA with this prior promise in its Q&A.:
" I don’t have a mobile number to use for MFA, will I lose access to my email?
- You’ll still be able to access your email and skip adding a wireless recovery number for now. When skipping is no longer available, we’ll let you know how to set up a different verification method, or you can contact us for help updating your account security. "

Then, (with the kind of hair brained advanced thinking and planning that also resulted in a 3 day complete outage a few years ago, due to not thinking through the 'obvious' regarding a workaround to a key router problem), they instituted MFA without notice and still refuse to set up a "different verification method", and contacting them repeatedly gets nowhere. Ie; there are NO MFA options as promised in writing, still!.

Most of the others requiring MFA do it with e-mail. Some with an automated phone call with code. Nobody that I know of except Rogers has a problem with technology to the extent that they can't figure out how to provide any MFA options!

notsavvy said

Basically since they don't offer 2fa, are there any other security options I can use to prevent unauthorized access to my account? Text and email alerts for withdrawals are fine. But if a third party compromised my account and email money transfer out. That money is gone and nothing I can do to get it back.

Should have moved money out and setup new tfsa elsewhere two months ago. But kept putting it off.  

The best security option would be to move funds to other FIs, those that offers better security options.
As for TFSA/RRSP/RRIF, where moving funds might not be easy or convenient, park these funds at non-redeemable GICs.

I do check my accounts on a regular basis, but if account is compromised, which often includes notifications disabled or redirected elsewhere, by the time I check next time money will be gone. Which means, checking balances regularly is good, but not enough.

People trying to hack into banking accounts usually don't bother with guessing passwords. Any modern banking system will lock account after 3-5 unsuccessful login attempts. Chances of getting password right so quickly as very low.

Bad actors go straight to "Forgot password" and this is how they get in.

A separate case is app such as keylogger on PC or smartphone. It'll record login and password credentials user entered. Having very strong password is of no use, as it will be recorded by keylogger as is, and transmitted to bad actor.

Yes, strong passwords are must, but just strong passwords alone are not enough.

.
Question . . .

While we're on the Password Security subject, what do you folks think about storing such critical information on Encrypted Memory Sticks (USB drives) ?

Dean

Alexandre said
People trying to hack into banking accounts usually don't bother with guessing passwords. Any modern banking system will lock account after 3-5 unsuccessful login attempts. Chances of getting password right so quickly as very low.

Bad actors go straight to "Forgot password" and this is how they get in.

A separate case is app such as keylogger on PC or smartphone. It'll record login and password credentials user entered. Having very strong password is of no use, as it will be recorded by keylogger as is, and transmitted to bad actor.

Yes, strong passwords are must, but just strong passwords alone are not enough.  

Totally agree. Password only as a protection measure is inadequate no matter how secure a password may be.
2FA is the minimum for any FI these days in my mind.
In this day and time, it does not make sense not to implement, and use some may not have phone data plan / email as an excuse.