What's the Dilly-o with authentication: a buyer's guide for credit unions

The Dilly-o

The FFIEC authentication guidance sets no blanket multi-factor authentication (MFA) mandate.³ It treats phishing-resistant authenticators as the strongest option.⁴ It also expects you to cover the call center and help desk as well as online banking.⁵ We'd move members toward passkeys or similar phishing-resistant sign-in now, and keep text codes only as a fallback. Then we'd give the phone channel the same care, because a moat around online banking does no good if the drawbridge is down.

How we'd size up a vendor

1. Phishing resistance: which sign-in methods do you offer that a scammer cannot relay or talk a member out of, and which still rely on codes?
2. Channel coverage: does the same check protect online banking, mobile and the contact center, or only one of them? A strong app login does little if a caller can reset the password by answering a few questions.
3. Platform fit: is your product live with our digital banking platform and core today, and can you name a credit union running it?

What changed this year

Nacha's fraud monitoring rule reached its second phase in June 2026, with a practical start date of Monday, June 22.⁶ It covers fraud under false pretenses, such as credit-push fraud, payroll diversion and vendor impersonation.⁷ It also requires a review of your fraud processes at least annually.⁸⁹ Nacha says the rules are neutral on specific methods or technologies.¹⁰

The FFIEC Cybersecurity Assessment Tool was retired on August 31, 2025.¹¹

Will it work with your systems?

Jack Henry is building an identity service for staff on its platform, and it can integrate with an existing Entra ID identity provider.¹² Onfido (Entrust) is listed in the Jack Henry Fintech Integration Network for Symitar credit unions, under payments.^C Ask your digital banking provider which sign-in methods it already includes, and which outside vendors it has live with credit unions today.

What other credit unions did

Certified Federal Credit Union lets members sign in to mobile and online banking with passkeys.¹³ On the phone side, MSUFCU partnered with Pindrop to layer voice and call-risk intelligence into its authentication process.¹⁴ In a case study, a WyHy Federal Credit Union staff member said rolling out Illuma Shield took maybe an hour of call center training.¹⁵ A press release on FAST Federal Credit Union's rollout says IllumaSHIELD has been implemented in days.¹⁶

What your examiner will ask

The 2021 FFIEC authentication guidance replaced the 2005 and 2011 documents, and it counts credit union members as customers.¹⁷¹⁸ It does not impose new regulatory requirements, but it expects monitoring, logging and reporting to track unauthorized access.⁵¹⁹ NCUA's Part 748 requires each federally insured credit union to have a written security program.²⁰ Its guidelines say management should report to the board at least annually.²¹ NCUA also notes that some credit unions report service providers that skip basic practices like MFA.²²

What it costs

One MFA comparison puts business pricing at about $1.40 to $9 per user per month, as of October 2026.²³ Another source puts typical pricing at $3 to $5 per user per month.²⁴ Duo, Okta, Microsoft, RSA, LoginTC, Rublon and miniOrange all quote this way, and Okta, Microsoft and LoginTC bill the full year up front.²⁵²⁶ One vendor bills SMS separately at $2 per user per month, so watch minimum license counts, SMS fees and hardware tokens.²⁷²⁸ Pricing for member-facing sign-in is not public, so expect to get a quote for your member count. One credit union technology blog puts digital banking suite implementations at 6 to 12 months.²⁹ We'd ask each sign-in vendor for its own timeline in writing.

Food for thought

We'd add one more question to your list: how will you handle an AI agent that signs in for a member? We think it's worth deciding now what an agent may do with a member's account, before a vendor decides for you.