Person-to-person payments. What's the trend and what are the security issues? Hi, this is Tom Field, Editorial Director with Information Security Media Group. We're talking about the P2P trend today and we're talking with Howie Wu, Vice President of Virtual Banking with Boeing Employees' Credit Union.
Howie, thanks so much for taking time to talk with me. Yeah, absolutely. My pleasure. And just to get us started here, why don't you tell us a little bit about yourself and your institution?
Yeah, definitely. So, Vice President of Virtual Banking is a bit of a unique title. But basically, to sum it up, I am the one responsible for all of the remote delivery channels within the organization. So, my area oversees, you know, ATMs, online, telephone banking, you name it.
So anything that our members touch that's not face-to-face or call center. And then as far as our institution goes, you know, BECU, we've been around for almost 75 years now. We originally started as, obviously, part of Boeing company and their employees' need for a credit union. At this point, you know, we obviously are not, no longer, you know, as heavily affiliated with them.
We are, at this point, have no affiliation with them. We do somewhat still carry the name, but really we have come to be known as more BECU rather than Boeing Employees' Credit Union. We're an $8.5 billion financial institution with approximately 640,000 members. Very good.
Now, my understanding is you've just launched Popmoney initiative, which just briefly allows members the ability to send money to friends and family just by sending an email or a text message. Am I right? That is correct. So tell us about this initiative.
What exactly is it beyond the bare bones description I've just given? Well, for us, it was really kind of our first, I guess, phase into what we call the payments evolution. You know, we're an organization that's always been fairly remote from an operating model perspective. And so, what we wanted to ensure is, you know, making our members' lives as easy as possible to conduct transactions, whether it's within the organization or outside the organization.
Give me a sense, Howie, how this works. Say I want to send money to a friend, a family member, a business associate. How would Popmoney work for me? Yeah, so if you're a BECU member, you basically log into online banking and there is a link for Popmoney.
And the interface basically allows you to, essentially, like you said, pay anybody from that portal, either using their email address or a text message. What that'll do is, for the receiving party, will either get an email or a text message that basically tells them how to fulfill or obtain the funds that the person is paying them with. So it would be similar to PayPal, for instance, except it's going through your institution. Yes, absolutely.
And it's very easy. The transaction is fulfilled through the ACH network, so the Automated Clearinghouse. The beauty of it, again, is the sender of the funds or the receiver, neither one of them have to actually share financial credentials with each other. And so that, from a security perspective, makes it very easy for people to pay other people that they may not necessarily know very well or want to potentially share their financial information with.
I presume this is really appealing to people that are operating their lives off of their smartphones. Yeah, absolutely. Absolutely. Howie, what was the business case that you used to kick off this project?
And I know in tough times the business case is certainly very important. Well, for us, again, you know, our operating model as an organization is, again, remote. So we want our members to use our remote channels, you know, so that would include, obviously, the ATMs and online banking and the mobile interfaces as much as possible to do business. And for us, really, again, it came down to just ease of use and functionality.
And one of the biggest things that our members, you know, like to do, obviously, is, you know, transact with, you know, friends and family. And it's one of those things that this product really made it easy for them to do so without having to get into all the details of the inner workings of, you know, financial data and getting accounts set up and, you know, and the transit routing and all that other stuff. So it just made it much simpler for them to make those payments without having to deal, obviously, with check, debit, and those types of channels. Now give us a sense of what the challenges you faced in deploying the service.
You know, for us, it was very straightforward. I mean, we have generally over the years we've been implementing, you know, obviously making changes to our online channel pretty much on a regularly quarterly basis. This was a part of one of our quarterly releases. You know, really the only challenges in deploying is obviously determining the amount of risk we're willing to take.
You know, so setting the limits in terms of transaction volume and then implementing, obviously, kind of multi-factor and third out-of-wallet type questions to really ensure that from a security perspective, we're also protecting our members as well as those that are potentially receiving the funds. Well, that's a huge issue, of course. And you used the three deadly letters a few minutes ago, ACH, which has become one of the bigger stories of the year. Let me ask you, what were your biggest security considerations with this project and how have you addressed them?
Biggest ones, again, I think is the amount of money we're willing to, you know, obviously members to move at one time. So setting up one-time limits, setting up daily limits, setting up monthly limits. Really, again, it's looking at, you know, what's the potential of a fraudster, let's say, setting up an account or hijacking an existing member's account and conducting those types of transactions. It was probably our biggest security concern from the get-go.
Now, do you set limits based upon someone's profile or do you have sort of uniform limits that you impose? It is based on somebody's profile. It also is based on their usage. So the way that the product works is if there are a new enrollee, they're set up with much lower limits to begin with.
And then after essentially a 90-day kind of, you know, you know, demo period, I guess you want to call it, then basically they, we open up the limits to the maximum for them, assuming all activity within that 90 days is good and legit. And what would be examples of the type of authentication you're asking your members to go through to use the service? One of the things that we implemented within the product is a product provided by a company called VeriID. It essentially is out-of-wallet type questions.
By out-of-wallet, it basically asks questions that generally, if you're a fraudulent person, you're not going to have on an individual. These are questions that are probably obtained off credit reports and credit history. Some unique questions would be, you know, what was, you know, they're all multiple choice questions, and it basically would ask them, you know, let's say, for example, what was the street address of the home that you lived in 15 years ago? And give them a list of four options.
So that's just an example. Again, out-of-wallet questions that are much more difficult for a fraudster to obtain out in the general public. How are we getting a sense of timing? When did you deploy Popmoney and what would the results be that you've seen since then?
Yeah, so we deployed it on March 20th, so approximately two and a half weeks ago. And at this point, the results have been fantastic. We're actually rather a little surprised at how quickly adoption has picked up. Right now we have over 2,000 members enrolled in the product, and we're moving on average about over $200,000 a day.
Now, who do you expect your demographic is chiefly going to be for Popmoney? I think, again, the younger generations, the much more tech-savvy people, like you said, the mobile, the people who kind of live and breathe on their mobile device. And those that really don't want to conduct transactions, you know, via the paper check, you know, channel going forward. So those are really kind of the demographic I think that we'll be hitting going forward.
You know, Kirsten, a question I need to ask, did you do this in-house or did you do this with partners? We did this with partners. Our partner is CashEdge. It is a CashEdge product.
Now, I know it's early. You've only been at this for a couple of weeks, but given your experience so far in development and deployment, what advice would you offer to other financial institutions going down the same path? And I think we can expect there'll be a lot of institutions going down this path. Yeah, I think, again, just, you know, really making sure you have a good business case that your members or customers of your organization really want, you know, this feature and product.
Obviously, it's not, you know, it's not something that is free. There's nothing really out there that's free. It is free to our members, but obviously as an organization, we do pay for the service. And again, really just, like I said earlier, just figuring out what are your requirements from a security perspective and how do you control that and manage that at the same time, obviously, offering something that is definitely of value and ease of use to your customer or member.
Well, Howie, I look forward to talking with you again down the road to get a sense maybe six months, a year from now, how this has worked and what your next steps will be. Yeah,