Internet & Mobile Security

While a username and password alone are not enough to safeguard your online experience, they are still essential to protecting your identity and information online. We encourage you to create a unique username and password for your account and not share it with others—not even friends, family members or business associates. Here are some tips for creating and using a strong username and password:

• Create a long password of at least 14 characters. Instead of using a single word, use multiple words or a complete sentence. Passwords like these are known as “passphrases.”
• Make sure your username and password are difficult to guess. Use a combination of uppercase and lowercase letters, numbers and special characters.
• Never use personal information for your username or password, such as birth dates, social security numbers, addresses, names or anything else that is easily obtainable via social media or Google.
• Use different usernames and passwords for different accounts. For example, never use the same login information for your VyStar accounts and your social media accounts.
• Consider the use of password manager software if you have too many passwords to remember.
• Change your password every three months. If you believe that your password has been compromised, change it immediately.
• Remember that no VyStar representative will ever ask you for your VyStar Internet Banking password.

Accessing your accounts with a username and password is known as single-factor authentication because it solely relies on something you know (your username and password combination). MFA or Multifactor Authentication relies on more than one of the three basic factors used to authenticate a user, making it a more secure process. The factors used today are:

• Something you know (e.g., password, PIN, etc.)
• Something you have (e.g., ATM card, smart card, computer, mobile phone, etc.)
• Something you are (e.g., biometric characteristics, fingerprints, etc.)

If you use an ATM or debit card, you are using MFA because you need two factors to complete the transaction: your ATM or debit card (something you have) and your PIN (something you know). VyStar’s Internet Banking uses a system called Intelligent Authentication™ (IA) to leverage the security of MFA.

Due to a variety of security threats such as Trojans, keystroke logging, phishing, etc., single-factor authentication (such as the combination of a username and password) to identify and authenticate a user has proven to be inadequate to secure user accounts on websites. IA is an enhanced security measure and a multifactor verification approach to authentication that augments the traditional username and password combination. IA tracks and examines members’ Internet & Mobile Banking usage behavior patterns and other nonpersonal information gathered from each request to access the login page. With this information, a user profile or “access signature” is built, which can be used to authenticate a user. Alternatively, this information can help determine when it is necessary to challenge a user or even block suspicious visitors from accessing Internet Banking.

As Intelligent Authentication^TM builds the access signature over time, various patterns and attributes are learned by the system. Just like it takes time for you to recognize another person’s face, IA also takes time to learn each user as they access their accounts on their computer. Until a reliable access signature can be built, any user will likely be challenged when they log in. Even then, a strong IA system will still occasionally challenge the user—especially if their behaviors, usage patterns or devices change or are updated. The challenge is typically a code sent via text or voice call to your mobile phone (something you have) and is the second factor in the MFA process, which helps us verify your identity. Other options are available, but this code is the most common method.

Encryption is a process used to scramble confidential data passed between two points so that it is not readable to others. VyStar uses 128-bit encryption technology where the "128" refers to the length of the encryption key used to scramble the data. The longer the key, the greater the security.

Absolutely all nonpublic information collected by or available on Internet Banking is protected through the use of the secure socket layer (SSL) protocol and 128-bit encryption. SSL is an encryption system that creates a secure environment for information that is passed between the member’s computer and VyStar Credit Union. Your information is completely secure when you are logging in to Internet Banking. Internet Banking browser requirements are listed here.

Each user session is set up to stay active for a specific period of time. If you do not interact with Internet Banking within that timeframe, the system will time out and automatically log out. If your session times out and you are not finished using VyStar Internet Banking, you will need to log in again. This security feature reduces the window of opportunity for an unauthorized user to access your account information if you walk away from a computer without logging out of VyStar Internet Banking.

VyStar is confident that we have taken the necessary security precautions to ensure our Internet account access service is secure and your account information remains confidential. However, it is also your responsibility to play an active role in protecting the security of your accounts. Here are some ways you can protect yourself:

• Use Multifactor Authentication, in addition to your unique username and password, to enhance access security to your Internet Banking account.
• Don’t walk away from your computer in the middle of an active VyStar Internet Banking session. If you are logged in and walk away, anyone can sit in front of your computer and have immediate access to your account. Always remember to log out when you are finished with your session.
• Use extra caution when using computers or free Wi-Fi access in public areas such as libraries, schools, hotels, restaurants, airports, etc. These computers are accessed by multiple individuals, and free Wi-Fi is inherently less secure in most cases.
• We also strongly recommend that you clear your browser’s cache before you leave the Internet Banking site. This prevents someone else from being able to view your account information, which is temporarily stored on your computer. Check browser options for automatic cache clearing upon program exit.
• Many mobile devices allow the use of a PIN to access the device. Use this feature to secure your phone and remember that the PIN is simply another password. The longer the mobile device’s PIN is, the more secure it is.
• For accounts that you no longer use, make sure to close, delete or disable these unused accounts.
• Be suspicious of any requests via text, phone, computer or email for your personal information. Remember that VyStar will never solicit personal or financial information unless you initiate the request. If you receive such a message when you have not initiated the request, do NOT respond to it. It is best to delete the text message, email or phone message.

Click on the “Forgot your Password?” link under the Internet Banking login screen. You can also call us at (904) 777-6000 or 1 (800) 445-6289, option 3.