Talking at cross purposes: Where credit union cybersecurity goes awry

by Robert McGarvey

For years I have pondered a puzzle: why do financial institutions spend so much on cybersecurity and employ wonderfully smart and talented people – but the results are not as good as one would hope.

Frequently financial institutions simply are whipped by their criminal opponents.

Just look back on how DDOS – distributed denial of service – brought innumerable institutions to their knees a few years ago.  It took months for credit unions to get it together to repel the attack.

Then look at ATM jackpotting. New account opening fraud. ATM skimming. The list could go on and on but you get the message: criminals often outwit credit unions and banks and that is despite the money spent and the talent employed.

Why don’t credit unions gain the upperhand?

Hear the related podcast with Authentic8 CEO Scott Petry here.

A new report, sponsored by cybersecurity firm Authentic8, involves a survey of 163 financial services professionals, and it tackles just that question: why do financial services firms so often fall victim to cyberattacks?

Here’s a hint at the reason: “Financial firms have some of the best-funded IT departments of any industry, that’s no secret,” said Scott Petry, CEO of Authentic8. “What’s perplexing to me, with data breaches and privacy violations at an all-time high, is how deep the divide still runs between IT, compliance and legal professionals in many firms.”

The report’s title spells out the problem: “Surprising Disconnect Over Compliance and Secure Web Use at Financial Firms.”

Keep reading at CUInsight

Would You Cruise Today? The Coronavirus Files

by Robert McGarvey

You know the hideous story of the Diamond Princess and the equally grim tale of the Westerdam, a Flying Dutchman vessel that sailed from Asian port to port trying to find a place that would let its passengers disembark. This is the worst of times for the cruise industry, with many experts saying booking are down 15% and more – and nobody is saying how many passengers have tried to cancel their reservations.

And then there is this Pollyanna moment from WHO, the World Health Organization, which wants you to know that cruising is safe. Mike Ryan, executive director of WHO’s Health Emergencies Program said in a press briefing: “People who say we should steer clear of cruise ships or steer clear of airports or steer clear of certain ethnic groups and steer clear of other things, we have to be really careful here. We need an approach to managing risk that allows us to continue to operate as a society while minimizing the risks.”

He added: “These are manageable risks and again we need to reflect on the fact that the vast majority of these cases are within China.”

I am sure the Diamond Princess passengers are relieved to hear Ryan’s assurances. Not.

Thousands of them spent two weeks in their cabins, by order of the Japanese government. The US government then flew home hundreds of them – but on arrival on US soil they are required to spend two weeks in a government mandated quarantine.

How would you like to spend a month of your life that way?

The Diamond Princess had 500+ cases of coronavirus.

I have written about cruising for maybe 20 years. I have been on many cruises. Generally I am a big fan of cruises – for some destinations a cruise is the ultimate travel modality. The Greek isles, for instance. Ditto Alaska.

Generally, too, I believe cruising on today’s modern ships is quite safe.

But I have also studied exactly how fast – and how virulently – norovirus has spread on cruise ships and this has happened often in the past 20 years. Globally, there are an estimated 685 million cases of the disease annually, with around 200,000 deaths.

Cruise ships have been particular targets. A ship is a contained environment, many thousands of people are in close quarters, and the disease spreads. As recently as this month a ship was denied docking in Gibraltar and forced to return to England where it had sailed from, after some 89 cases were diagnosed.

Here’s the deal however. Cruise ships have become adept at implementing sanitary protocols to limit the spread of norovirus. Sure, there still are epidemics on ships – but cruise lines are a lot more successful in containing the disease than they were a quarter century ago.

You can’t say similar about coronavirus. In a month, maybe, and I for one definitely hope so. But not today when our ignorance abounds.

Nobody knows how to fight coronavirus, least of all on board a cruise ship and its contained environment.

Does that mean just don’t cruise?

Here’s a more precise question: Would I do a Greek cruise today? A Pacific cruise from Singapore to Hong Kong? A Norwegian fjord cruise?

Consider that an IQ test type odd man out test question because I would in fact do two of the three, but decline the third.

Am I afraid of coronavirus? Strangely perhaps, not so much. Early indications are that this coronavirus – specifically COVID-19 – is highly infectious. But its mortality rate appears to be much smaller than, say, SARS or MERS.

What scares the heck out of me are what I do not know about the disease – and neither do the researchers. We are still hunting for best treatment modalities, cures, vaccines, and so on.

What also scares me is the Diamond Princess story. Who wants a four-week quarantine to cap off a cruise?

My advice in regard to cruising is this: avoid Asia cruises. I would not take one. Six months from now, maybe, in fact I would love to – once the coronavirus episode is resolved.

What about other destinations? It’s up to you, not me, not a WHO expert, not your travel agent. Know the risks – and thus far I know of no coronovirus cases on cruise ships in Europe, say. And make your best decision.

In times of rampant norovirus outbreaks on cruise ships I knew dozens of people who refused to cruise because of it. That was their call and they were entitled to it.

The exact same is true today. I can tell you what I will or won’t do. I will not tell you what to do.

Neither should a WHO boffin.

CU 2.0 Podcast Episode 79 Dan Mayfield LeveragePoint on Cannabis and Credit Unions

Welcome to Up in Smoke, Part 4 – credit unions and weed.

Buckle up. Dan Mayfield, public affairs director at LeveragePoint, a strategic communications firm in Albuquerque NM, will be our guide in this podcast to the cannabis business in New Mexico. 

Cash, public safety, and a $130 million dollar annual business take. That’s legal marijuana in New Mexico — and right now credit unions are scrambling to help serve this market.

LeveragePoint has a ringside seat and that’s because it is wholly owned by the Credit Union Association of New Mexico.

You heard that right.

That also means it’s playing a key role in setting up the CU Cannabiz show in Chicago in April and Mayfield offers more details on that in this podcast.

Up in Smoke Part 1 here, Part 2 here, Part 3 here.

Part 3 is a podcast with Paul Stull, CEO of the Credit Union Association of New Mexico.

What’s important here is that cannabis is a potentially huge market for credit unions. It has risks, sure.

But it has a grand upside.

Here all about all sides in this podcast.  It’s a fast ride.

Listen here

Like what you are hearing? Find out how you can help sponsor this podcast here. Very affordable sponsorship packages are available. Email rjmcgarvey@gmail.com

Find out more about CU2.0 and the digital transformation of credit unions here. It’s a journey every credit union needs to take. Pronto

CU 2.0 Podcast Episode 78 Paul Stull on Cannabis and Credit Unions, Up in Smoke 3

Toke up – the CU2.0 Podcast is back with another look at cannabis and credit unions, a topic we last looked at a year ago in a two part podcast. Part 1 here, Part 2 here.

Welcome to Part 3, 2020 edition of Up in Smoke, credit union style.

Today’s guest is Paul Stull CEO of the Credit Union Association of New Mexico, which is sponsoring the Credit Union Cannabiz Conference, April 5-8 in Chicago.

What this is about is the business of banking cannabis companies, said Stull.  And he fervently believes that cannabis – so far an untouchable for the big national banks – is a prime opportunity for credit unions to build dynamic and profitable business account relationships that involve both deposits and lending.

And this is business that right now the national banks won’t take on.

About two in every three states presently has legal marijuana in some form (medical, recreational or both).

Said Stull: “Most credit unions are involved in banking marijuana money whether they know it or not.”

His argument: do this openly, consciously, charge accordingly and it’s a win win, for the credit union, also for the marijuana business.

In the podcast, Stull offers a deep dive into why cannabis banking also benefits local communities – meaning this is a solid credit union business direction.

The opportunities with cannabis for credit unions right now looks immense.

Stay tuned because in a few weeks another cannabis themed podcast will drop.

Listen here

Like what you are hearing? Find out how you can help sponsor this podcast here. Very affordable sponsorship packages are available. Email rjmcgarvey@gmail.com

Find out more about CU2.0 and the digital transformation of credit unions here. It’s a journey every credit union needs to take. Pronto

Coronavirus and Your Next Conference: To Go or Not?


By Robert McGarvey

I am getting a question I never thought I’d be asked: Is it safe to go to a conference- from a public health perspective? Sure, we have heard concerns about terrorism and criminality that sometimes prompt attendees to question when they want to go to another conference, trade show, or similar.

Now I am hearing: Is a public conference suddenly an unsafe place because of health concerns? Note the cancellation of Mobile World…in Barcelona!

Start here: just cross off any conferences you are slotted into in China.  Very probably the organizer will cancel anyway. Panic about Chinese meetings and shows, even ones in Beijing (around 600 miles from Wuhan, the apparent epicenter of the coronavirus) and Shanghai (maybe 450 miles distant), is feverish.  Air carriers are cancelling all flights to China and the whole country – which is about the same size as the United States – is becoming a giant no-go zone.

People are also telling me they won’t go to Bangkok or Singapore for conferences.  

Asia events are easy to figure: the answer is do not go.

It’s the rest of the world where there are questions – even events at home in the US, where there have been exactly zero deaths attributed to coronavirus as of this writing.

Yet panic is rising, at a level I do not recall ever seeing in the US or Europe.  Sure, there was anxiety around SARS in 2003, an epidemic that hopscotched globally, infected perhaps 8000 and killed maybe 800.

But coronavirus – right now, today – is terrifying a lot more people.  Surgical masks are selling out globally, even though the CDC advises not wearing them and evidence is scant that they do much to prevent spread of a disease like coronavirus.  People are stampeding to try to cancel cruise bookings, an industry that has had horrific quarantines of vessels.  Airline flight crews are threatening not to fly. And entire countries are blocking entry of people arriving from China and/or Chinese passport holders.

We haven’t seen exactly that, ever, in our lifetimes (the 1918 flu pandemic is one that rivals the current disease in terms of panic but it killed maybe 50 million in a much less populous world, compared to low five figures for coronavirus deaths – and experts say flu is presently killing more than is coronavirus).  

Right now what we have is ignorance that fuels hysteria.  We just do not know that much about coronavirus, China is typically opaque and it’s not clear what to do to avoid the disease (other than – obviously – don’t go to China).  

But CDC, WHO, and other world health organizations are on this.  I am optimistic that we will soon – probably within days – know how the disease spreads, maybe even what caused it in the first place. And then the search for cures commences.

That brings us back to our central question: events and us, what to do?

The answer depends upon your optimism regarding science and coronavirus. If, like me, you think researchers will get a tentative handle on it within weeks, go ahead and commit to conferences certainly in the spring.  You may want to hold off on attending big meetings this winter – again, we know little about the disease and that dictates caution in attending large gatherings and spending time in places with recycling air such as planes.

What if we don’t know what we need to about coronavirus within, say, a month? Then you know what hit the fan – in this case, raging fear – and it will get worse, more events will be canceled, and probably we will all sit home for many, many weeks to come.  Meaning more decisions will get made for us.

My advice: make flexible reservations with the right to cancel without penalty and, no, not many actual shows will allow that – airlines and hotels do of course, for a premium price; pay it – but my guess is that events sign ups will lag for months to come and many will be welcoming walk ins through this year. It is going to be a very slow year for meetings – use it to your advantage.

Me, I am still planning – happily – on several spring meetings. Have I booked anything yet? Nope.  No need to.

Hang loose. Now is the time to do it.

CU2.0 Podcast Episode 77 Shondell Varcianna on the Content You Need to Grow

Want to grow your member base? Want to target particular kinds of members?

Content is your friend, says Shondell Varcianna, a financial services veteran who nowadays focuses on providing select financial institutions with finely targeted digital content – blog posts – for distribution via the credit union website, also social media.

Her driving point: content works when it is written to meet the specific needs of a targeted group.  It can’t be all things to all people.

She especially recommends financial education content.  Millennials, for instance, want info on home buying.  Give it to them and you just may get the mortgage.

The key: have a strategy about what groups you want and what you want to sell them. The content will follow.

This is an informative podcast about a topic that usually is treated superficially. This is a deeper dive and it’s worth it because this is how to supercharge member growth.

Listen here

Like what you are hearing? Find out how you can help sponsor this podcast here. Very affordable sponsorship packages are available. Email rjmcgarvey@gmail.com

Find out more about CU2.0 and the digital transformation of credit unions here. It’s a journey every credit union needs to take. Pronto

Why Hoteliers Suck at Tech


by Robert McGarvey

Just one quotation in a Hotel Management “think” piece on hotels and tech (“HM roundtable takes look at transformative technology“) tells us all we need to know about why hotels so often fumble tech innovation and play catch up, perhaps for decades.

I give you in-room phones, in-room TVs with content to sell us, lame and unsafe hotel WiFi, unreliable room key cards, resistance to voice controls, and the list goes on and on.

Why is the question.

Mike Mueller, president of Wyndham’s Super 8 brand, pithily tells us exactly why: “Mike Mueller, president of franchised economy brand Super 8 by Wyndham, observed it’s often difficult to get buy-in from owners on new technology. ‘We have to prove out that the investment is going to have [a return on investment] before we ask somebody to make that investment. So, we spend a lot of time thinking about how do we introduce new opportunities at our hotels that guests are willing to pay more for? Because if they’re not willing to pay more for it than we shouldn’t really be doing it,’ said Mueller. “

That’s saying if we can’t monetize it we ain’t doing it.

I don’t mean to pick on Mueller. I’ve heard exactly the same from various senior hotel execs, generally off the record. Mueller is on the record so he gets the bullseye on his back. But know that he is just one of many singing the same sad song.

Here is how miserly hotels are regarding security: “Data from Statista presented to the Business Travel Association’s winter conference in London revealed food and hospitality companies had only invested an average £1,080 in internet security during 2019 – the least compared with 11 other sectors including construction and education.”

Dead last. How it did the industry get to this woeful state?

Because most hotel groups are “asset light” – meaning they manage but don’t own their properties – they must persuade the owners to spend on upgrades and owners, they say, don’t want to open their purses unless they are told the ROI. No ROI, no spend.

So it’s our fault hotel technology sucks because we won’t pony up for better. So they seem to say.

Let me ask you: are you willing to pay more for secure hotel computer technology so that your personal information is not feasted on by hackers – and hackers have been pillaging hotel data for years, including that of Wyndham’s guests?

Of course you aren’t willing to pay more because the safety and security of your data that is entrusted to a third party such as a hotel should be accepted as obligation on the part of that third party (a bank, a retailer, and of course a hotel).

Even giant Starwood suffered a breach of its guest reservations system that apparently began in 2014 and lasted at least into 2018.

And little operations too have been breached – the Trump hotels for instance suffered three breaches in as many years.

Let me ask you this: do you feel your data is safer today at a hotel than it was a half decade ago? I do not. Hotels simply do not have the appetite to aggressively spend on combating hackers – and we are the victims.

The hacks keep happening.

That’s not the only for instance. A few years ago I bluntly asked a very senior hotel executive – this was a personal conversation, not on the record – why his hotels’ wifi sucked. It was so bad I couldn’t imagine anyone using it. He agreed. But he added there was nothing that could be done because the owners were not willing to spend on upgrades.

I hear the same about the key cards that fail – not our fault, owners won’t pay for mobile door locks.

I have to wonder if part of the popularity of Airbnb with many consumers is that some of those owners are investing in 21st century technology.

The reality is that most of the tech investments I personally make don’t have a significant ROI. But they do make my life a bit easier. Do I need an Alexa or Google device in every room in my home? Nope. But they are there because I like the convenience of asking for a light to be turned on or for a weather report.

I’d like same in my hotel rooms but, no, I’m not willing to pay extra for it.

I invested in Google mesh to upgrade my home/office WiFi because I wanted the speed. Is there an ROI? Maybe, maybe not. But I sure do like the speed.

The bottomline for hoteliers is that technology nowadays is a necessity. In 1970 would a guest pay more for a room with AC? I doubt it. In 1950 maybe. In 1970, nope. He/she just wouldn’t book a room in a hot place that didn’t have it.

That’s the real message for hoteliers to smack owners with: spend on technology or lose guests. Deliver fast WiFi, strong cellular signals, mobile door locks, voice controlled lights and drapes, and all the rest of the cool stuff I have in my home.

Or I will go elsewhere for it.

I won’t pay more for it. I just won’t pay anything when it’s absent. I’ll stay elsewhere – and I believe so will increasing numbers of guests.

Upgrade or perish.

CU2.0 Podcast Episode 76 Matt Johnner BankLabs on Commercial Lending and Your Credit Union

It just may be topic one in credit union c suites – how do we make more profitable loans?

Matt Johnner of BankLabs – a developer of cloud based technology solutions for financial institutions – has a suggestion: Go after lending to two of the country’s biggest industrial segments, agriculture and construction.

And fast track this by using your present member base to segue into commercial lending into those segments.

A good car loan experience for a farmer’s wife, or a home builder’s husband, just may lead to a 7 figure commercial loan – for the credit union that is thinking that way.

So Johnner likes the “law of attraction,” which essentially says that what we focus on comes into our life.

Start thinking on construction and ag loans and they just may happen for you.

His company also is a provider of mobile tools that automate lending and loan management and, he says, many lenders are still rooted in legacy technology (spreadsheets). A newcomer to the field who has the right technology in place just may start closing deals.

What will the regulator say? Johnner addresses that in this podcast.

He also talks about buying a community bank to accelerate success in commercial lending – but stresses there are other ways.

If you want more high profit loans this is a must podcast.

Like what you are hearing? Find out how you can help sponsor this podcast here. Very affordable sponsorship packages are available. Email rjmcgarvey@gmail.com

Find out more about CU2.0 and the digital transformation of credit unions here. It’s a journey every credit union needs to take. Pronto

The Future of Airport Rides May Be Decided In Phoenix


By Robert McGarvey

The Phoenix City Council just blinked – which means that Uber and Lyft which had threatened to pull out of Sky Harbor Airport, the 13th busiest airport in the US, will continue to drive passengers to the airport and away from it. They had said January 31st was there last day at PHX. But they are staying. For now.

Trust me, this is just the beginning of the story. We are nowhere near the end and there’s no reason to rush because the ending is likely to be unhappy.  And what happens in Phoenix may well shape what happens in airports around the country as cities desperately seek new ways to balance their airport budgets. Historically, cities have dinged taxi companies with airport fees and that worked well – until suddenly the taxi businesses collapsed as Uber and Lyft rose.

Which has cities like Phoenix scrambling for new ideas.

Like a hefty fee on Uber and Lyft rides.

Which did not sit well with the ridesharing companies because, remember, they have their eyes on lots of towns. Not just Phoenix.

So when the city came up with its big new fee — $4 on ever trip, in or out of the airport, by a ridesharing company – the ridesharing companies vowed to pull out. 

Those new Phoenix fees seemed a quick way for Phoenix to secure its airport transportation cashflow which, right now, teeters on the edge of collapse. Per Phoenix New Times, “Currently, airport officials say, taxis and ride-share companies are only covering about $9 million of the $26 million needed to maintain and operate Sky Harbor’s ground transportation system.”

What stopped those new fees is that the Arizona Attorney General Mark Brnovich filed suit and, after the city talked with the Arizona Supreme Court, it opted to delay implementation of the fees pending the court’s ruling on the constitutionality of the fees.

Brnovich claims the fees are unconstitutional.  “I think it maybe dawned on the mayor and other Council folks that this is really serious, and it was not only an unconstitutional tax, it was dumb,” Brnovich told KTAR FM’s Arizona’s Morning News.

He pointed to Proposition 126, passed by Arizona voters in 2018, that banned new taxes on services as prohibiting the ridesharing fees which he said amounted to a new tax.  

The back story is that taxi traffic at the airport plummeted 42% between 2015 and 2018.  Taxi companies, by the way, would pay $1.75 per fare under the new rules. Why so much less? Because they contribute less to traffic congestion at the airport, per the city, they can’t pass those fees onto consumers, and they operate under extensive regulation, says the city.

Uber and Lyft account for 80% of the commercial traffic at Sky Harbor – which put a bullseye on the services.  The city did offer a discounted, $2.80 fee for rides that begin and end at the Sky Train depot rather than at the terminals. But most rides would incur the $4 fee.

Is that anti-consumer? Maybe, maybe not. That’s because taxi fares generally are higher for consumers – although the Uber and Lyft surge pricing can raise those prices higher.  But much of the time taxi fares are dearer than fares with Uber or Lyft.

Nonetheless, Uber and Lyft said no way to to the proposed fees. Uber explained why it would exit Phonix before paying them: “Our riders and drivers should not be treated as a piggybank to fill the Airport’s budget holes. This fee unfairly penalizes those who rely on ridesharing to get to or from PHX by asking them to bear a disproportionate share of costs associated with the Sky Train. On behalf of the riders and drivers who rely on Uber, we cannot accept a partnership that unfairly burdens our shared passengers.”

Basically, Uber and Lyft decided to play chicken with Phoenix and Phoenix – because of Prop 126 – blinked.

For now.

What happens next? My guess is that the Brnovich position will prevail, that the AZ Supreme Court will tell the city it cannot impose the fees on ridesharing companies as it had proposed.

But the City Council will come up with a different way to extract money from passengers of ridesharing companies. Probably they will make it stick because the airport needs the money and ridesharing ventures are a well heeled target.

Very probably, if Phoenix prevails airports around the country will hungrily explore ways to grab more income out of every rideshare. Pretty much all of them have seen taxi revenues shrinking and – in their minds – the logical place to make up the difference is whacking the rideshare companies and their passengers.

Where do I stand? Personally I don’t take Uber to the airport. I ride the light rail which stops in front of my apartment and costs $1. It’s about as fast and it lets me off at the Sky Train station.

Family members however often use Uber to Sky Harbor and sometimes I pay, using a $15/month credit for Uber that Amex gives to Platinum Card holders. The fare ranges from $8 to $12, plus tip (generally $2).  

Add a $4 fee to those fares and it’s a 50% or 33% increase.  

Presently there are no fees on drop offs. The fee on a pick up is $2.66.

Sure losers in this brawl, no matter how it shakes out, are the drivers. I don’t see a brightening future for taxi drivers – many of whom already have shifted to driving for Uber or Lyft.  Why? Driving a taxi is hard, low paying work, a reality documented in a Boston Globe three-part Spotlight report from 2013.  I drove a taxi in Boston and Cambridge in 1970-73 and it was just as bad then. Nothing has changed apparently, and that is why some drivers who have access to a vehicle that would be acceptable to Uber or Lyft prefer that route.  The pay maybe is no better for an Uber driver but very probably the working conditions are a bit better.


Make no mistake, rideshare drivers earn low wages and drivers have very little ability to pressure the companies who listen to investors, not workers. It is a grim outlook.

But the other losers in the deal will be the passengers who use rideshare or taxis to get to the airport. Fares and fees will go up.  That seems inevitable. If there’s a single, loud, unavoidable message in this it’s that the cost of getting to the airport in a car is going up. Maybe by a lot.

That will be true in Phoenix and probably in many other cities around the country as anti car sentiments rise, anger at congestion increases, and politicians decide to stick it to people who ride in cars, maybe especially to airports.

That’s my guess about the ending to this story.

We can hope I am wrong.

CU 2.0 Podcast Episode 75 Milind Borkar Illuma Labs

Passwords are broken. You know that.

But do you know call centers are heading that way?

Call centers are under attack by criminals. Smart criminals. And they are targeting credit unions.

Credit unions are responding by asking more members ever harder questions. Just one problem. As the questions get more obscure – what was the make of the second car you owned – more members give wrong answers.

Fraudsters incidentally often can perform quite well on these tests because they have amassed data via the dark web.

They probably know the name of that kindergarten teacher that you have forgotten.

Tough questions are no cure.

The better solution is to implement biometric authentication that eliminates the need for answering a series of obscure questions. Enter Illuma Labs which is focused on helping small and mid sized financial institutions – that means you, credit unions – implement passive voice recognition.

As for what passive recognition means it’s that it happens in the background, the member needs do nothing special. In a matter of quick seconds he/she is authenticated and you can get down to business.

That means quicker call times, lower costs, happier members and happier call center staff.

This podcast is a guided tour into how voice rec works, how to implement it quickly and at low costs, and why this is the 21st century solution to a lot of the fraud credit union call centers are experiencing.

Listen here

Like what you are hearing? Find out how you can help sponsor this podcast here. Very affordable sponsorship packages are available. Email rjmcgarvey@gmail.com

Find out more about CU2.0 and the digital transformation of credit unions here. It’s a journey every credit union needs to take. Pronto