When the Fraudster Knows the Answers to Your Security Questions, What Do You Verify Next?

Blog

Credit Unions

Oct 09, 2026, 18:56 ET

Share:

Credit unions have spent years adding layers of technology designed to determine whether the person on the other end of a transaction really is who they claim to be. Institutions used layers of security questions to answer that question.

But what happens when the fraudster knows all the answers?

A recent lawsuit involving FiCare Federal Credit Union highlights the problem. The credit union alleges that criminals impersonated members and contacted a call center to have fraud restrictions removed from stolen debit and credit cards.

According to the allegations, the callers were able to provide enough information to get through knowledge-based authentication and convince human representatives that they were legitimate members.

The case is still being litigated, so the allegations should not be treated as established fact.

But the situation raises an important question for every financial institution: What happens when the information you’re using to verify someone has already been compromised?

Human intervention requires better information

It would be tempting to look at a case like this and argue that financial institutions need more human intervention.

But humans were already involved. That’s what makes the story interesting.

A human representative working with the same compromised information as the automated system isn’t necessarily another layer of protection. The representative may simply be making a judgment based on information the criminal already possesses.

Real verification requires another source of evidence.

That might mean confirmation through an authenticated mobile application. It could mean contacting the member through a previously established channel rather than one supplied during the suspicious interaction. 

In higher-risk circumstances, it could involve additional outreach designed to establish information that isn’t available to the person attempting the fraud.

The important principle is that the next layer of verification should introduce new information. That principle extends well beyond card fraud.

Financial institutions routinely encounter situations in which the information in their systems stops providing enough certainty. A borrower becomes unreachable. An address may no longer be accurate. A financed vehicle or piece of equipment may have moved. A business may no longer be operating where the lender expects it to be.

In those situations, repeating another database search or another automated communication may not resolve the uncertainty.

Sometimes the institution needs information from outside the system. That’s where targeted field intelligence can become valuable.

A field representative can attempt contact, verify an address, observe whether a business appears operational, confirm the presence of collateral, or simply gather facts that aren’t available through the lender’s existing digital channels.

That doesn’t mean every suspicious transaction or unanswered phone call requires someone in the field.

It means technology should help financial institutions recognize when their existing information is no longer sufficient, and when another source of evidence is warranted.

The future of fraud prevention isn’t choosing between technology and people. It’s giving people better information and knowing when to seek evidence the technology doesn’t have.

To find out more about how NCCI Services is helping credit unions get this additional layer of protection, reach out to us today. Contact Presley Santos at psantos@ncciservices.com or email CreditUnion@ncciservices.com.

Privacy Policy & Statement


The content of this website is fully and only intended for general informational and educational purposes. If you visit our website, we may collect general information about the way in which you use our site, including the time and duration of visit, IP address, browser type and version, operating system, device type, the website URL or web page that referred you to our site, your path through our site, and in site traffic patterns. We may use this information to identify levels and areas of interest to improve, refine and enhance user informational experience of our site, operational maintenance of our site, or as may be legally required.

If you provide information through this website, either in a form on this website or by sending us an email, we may collect and use that information to contact you if you so request.

We do not sell, rent, trade, or give away any information collected, including but not limited to, personally identifiable information (Personal Data) provided by visitors to our site, to any third party.

Terms of use


Informational Purposes Only

The content of this website is fully and only intended for general informational and educational purposes.

Proper Use

You agree that your use of this website at all times will be for informational and educational purposes only. You further agree that your use of this website will at all times be proper and lawful. You agree not to attempt to gain access to non-public areas of this site or to files, servers, or other data belonging to NCCI by “hacking” or other unauthorized means. You agree not to damage or disrupt the operation of this website by any electronic or other means.

No Guarantees, Warranties and Limitation of Liability

NCCI makes no guarantees, warranties, representations or claims with respect to any of the information or content on this website. Any testimonials or endorsements contained in the website do not constitute a guarantee, warranty or prediction regarding the outcome of any transaction. NCCI will make every effort to maintain current information on this website, but does not guarantee the currency, accuracy or completeness of the information. Information and content on this website are provided “as is” without warranty of any kind, either express or implied, including without limitation warranties of suitability, reliability, applicability, merchantability, fitness for a particular purpose, non-infringement, result or outcome. NCCI reserves the right, but has no obligation, to add, change, improve, and/or update the information and content on its website without notice or liability to you or any other person.

You use this website at your own risk. NCCI assumes no liability or responsibility for any errors or omissions in the information and content of this website. NCCI denies responsibility and liability for damages incurred as a result of your access to or use of information on this website, including but not limited to, liability for damages under contract theories, tort theories, or any damages caused by viruses or other malware contained within electronic files of this website or any linked site, regardless of prior notice to us. Under no circumstances and under no legal theory shall NCCI, its owners, its shareholders, its attorneys, its employees, its contractors, its agents, its suppliers, its vendors, or any other party involved in creating, designing, producing or delivering this website’s information and content be liable to you or any other person for any alleged direct, indirect, special, incidental, consequential damages of any character or kind arising from your or anyone’s access to, or use of, this website.

Intellectual Property Rights

All copyrightable text, graphics, imagery, illustrations, icons, logos, photographs, video clips, written materials, software, interfaces, code, the selection, arrangement and presentation of all materials and content on NCCI’s website, and the overall design of this website are protected under copyright and trademark laws and are the copyright, trademark, trade dress, intellectual and/or proprietary property owned, controlled or licensed by NCCI at © 2026 NCCI. All rights reserved.

You may use the materials and content on this website for personal informational and educational purposes only. Permission is granted to download, copy, and print materials from this website and you may send, forward, and transmit this website in hyperlink form for the purpose of viewing, reading, retaining, and educating for informational reference. Any other copying, distributing, displaying, retransmission, or modification of information, content or materials on this website, whether in electronic or hard copy form, without the express prior written permission of NCCI is strictly prohibited.

Indemnification

You agree to indemnify NCCI for any and all damages or harm caused by your violation of these Terms of Use. You further agree to defend, indemnify, and hold harmless NCCI, its owners, its shareholders, its attorneys, its employees, its contractors, its agents, its suppliers, and its vendors from any and all third-party claims, demands, damages, losses, costs, attorneys’ fees and expenses resulting from your violation of these Terms of Use. You agree that the exclusive venue for any litigation alleging a violation of these Terms of Use shall be the courts of State of Nevada, Clark County.