ithinkfi Security Tips

The ten habits

Ten habits cover the entire threat surface, and members who kept all ten reported zero fraud losses in 2024.

1. Enable two-step verification
2. Turn on transaction alerts
3. Use unique passwords with a manager
4. Never share credentials, even with family
5. Freeze cards when not in use
6. Review recognized devices monthly
7. Verify any caller before sharing codes
8. Avoid public Wi-Fi for banking
9. Update the app promptly
10. Check statements monthly

The list is deliberately boring; effective security usually is.

Phishing: the top attack

Phishing started 71% of fraud cases in 2024, usually with a fake text or email impersonating the credit union.

Ithinkfi never asks for passwords, one-time codes, or full card numbers by phone or message. A message that pressures urgency and requests codes is fraud, every time.

The data does not cover scams targeting other institutions, which sometimes spill into member confusion.

Password discipline

A password manager plus unique passwords removes the credential-reuse risk behind 19% of 2024 fraud cases.

Reused passwords from breached sites are the cheapest attack. A manager generates and stores unique passwords, and members who use one report 62% fewer login failures as a bonus.

Initially we recommended rotating passwords quarterly but found the practice caused weaker passwords, so the guidance now favors length and uniqueness over rotation.

Device hygiene

Three device habits matter: update the app, avoid public Wi-Fi for banking, and review recognized devices monthly.

Outdated apps carried 8% of 2024 security incidents. The recognized-device list in Settings shows every device with access, and removing stale ones closes old doors.

Public Wi-Fi is safe for browsing but not banking; cellular data removes the interception risk.

This guidance does NOT apply to corporate IT policies, which may override personal device settings on company hardware.

What to do the moment you see fraud

Freeze the card, change the password, call support, and file the dispute — in that order, and within minutes.

The first hour determines recovery speed: members who act within 60 minutes recover funds 2.4x faster on average. Zero-liability protection covers unauthorized transactions reported promptly.

The data does not cover authorized transfers made under pressure from scammers, which follow a different review path.

Hardening your account in 15 minutes

1. Enable two-step verification

   Settings > Security.

2. Turn on transaction alerts

   Alerts > Push notifications.

3. Update your password

   12+ characters, unique, stored in a manager.

4. Review recognized devices

   Remove anything you no longer use.