MFA for Business Banking – Security Questions with 2nd Request Multifactor Authentication: Quick Tip Sheets Note to Financial Institutions: We are providing these QT sheets to you in PowerPoint format – please feel free to change to your FIs template, add scenarios, etc. – anything you need to do to customize then for your FI.

MFA for Business Banking – Security Questions with 2nd Request Maintenance Policies Multifactor Authentication (affects entire commercial client base) Enable or disable MFA Once enabled, select the Effective Date Maintenance Policies Additional Options (affects entire commercial client base) Select if users will be able to change their own addresses Maintenance Customer Maintenance (affects individual commercial client – these settings override the Policies settings) Enable or disabled MFA Once enabled, select the Effective Date Managing MFA on the Admin Platform Tips If an Effective Date was previously defined on the Customer Maintenance screen, then changing or adding the Effective Date on the Policies page will only override it if the date has not passed. The MFA Effective Date must be the current days date or future dated. If you set it 1-2 weeks out, this allows all users to confirm/update their address and to set up their security questions and answers before they are required to enroll. Definitions Temporary Access = when a user logs into Business Banking from an unenrolled computer, after the MFA Effective Date. Security Questions with Second Request = the user is challenged for temporary access with the Security Questions screen, displaying two of their five security questions. Users have the ability to request a second set of security questions if they feel they cannot answer them. Two of the remaining three questions are displayed. If the user cannot answer them correctly, they are locked out.

MFA for Business Banking – Security Questions with 2nd Request … But Before the Effective Date is Reached Step 1: User logs into the Customer Platform. Step 2: Next screen displays the users address. User must either confirm that the address is correct, or if its not: change it here (if your FI allows users to change their own address) OR contact their Company Admin and have them change it Step 3: User must set up security questions and answers. Step 4: User is taken to Business Banking. … After the Effective Date is Reached Step 1: User logs into the Customer Platform. Step 2: Next screen is the Enhanced Login Security Screen (See Quick Tip sheet for Enrolling a Computer) User Experience After MFA Enablement

MFA for Business Banking – Security Questions with 2nd Request Enroll a Computer/Browser Step 1: After logging in, user is presented with the Enhanced Login Security screen displaying two of their security questions. Step 2: The user enters their answers, then checks the box to add extra security protection to this computer. Step 3: A success screen displays. Unenroll a Computer/Browser Step 1: Once logged in, user goes to Administration Login Credentials Unenroll Computers Step 2: On the Unenroll Computers screen, user selects either the first option (to unenroll this computer) or the second option (to unenroll all computers). Step 3: MFA removes the cookie from the users browser. Enroll or Unenroll a Computer Tips – Enroll a Computer Users can enroll as many computers and browsers as they wish. Once a user enrolls one computer, the user is now enrolled in MFA. Once a computer/browser is enrolled, the user will see nothing different at future logins to Business Banking from that computer using that browser. A user should only enroll a computer that is non-public and that they will use regularly to access Business Banking. Tips – Unenroll a Computer The user is still enrolled in MFA! So if they log in again from this or any unenrolled computer, they will not be allowed into their Business Banking session until they provide the challenge data (see Temporary Access tip sheet). User should only select this option if they are not going to be using this computer for Business Banking again. This Unenroll Computers feature will only display if the financial institution has enabled MFA for the company and the MFA Effective Date defined has been reached.

MFA for Business Banking – Security Questions with 2nd Request Step 1: Enrolled user logs into Business Banking from an unenrolled computer or browser. Step 2: System displays 2 of the 5 security questions. Step 3: User answers questions (they can also enroll this computer now) and is taken to Business Banking. OR Step 3: User feels they cannot answers questions, so clicks on Request Different Questions. Step 4: System displays two of the remaining five questions. Step 5: User enters their answers and clicks continue. Step 6: User has the option to enroll this computer in MFA. Step 7: User is taken to Business Banking. Temporary Access

MFA for Business Banking – Security Questions with 2nd Request Temporary Access Tips A user will only be challenged if they are an enrolled user, but are using an unenrolled computer (at the library, at a friends house, etc.) If a user wants to enroll the computer they are currently using, they can check the box to add enhanced security to this computer before continuing. Security codes expire after 30 minutes. If the MFA system sent the user a code less than 30 minutes ago and the code was not used, it will not automatically send a new one when the user tries to log in this time. If the user wasnt able to retrieve that security code and wants a new one, there is a Request a New Security Code link. If the user enters the wrong code, an error message displays. The user can try again. This counts as a bad login attempt. Once a user successfully enters a security code and is able to login, that code becomes invalid. If the user cannot retrieve their code, they should contact their company administrator. The administrator can change the users address to one where the user can retrieve the code. There is the possibility of the security code being routed to a users junk mail folder. Users who do not get the security code should check that folder. The answers to the security questions are not retained by the system, so a user can set up the same questions with the same answers again, if they desire.

MFA for Business Banking – Security Questions with 2nd Request Reporting on MFA is accomplished using the following Transaction Types: Existing Transaction Types with MFA information: 1.Bad login 2.Usermaint modified MFA-Specific Transaction Types: 1.Unenroll computer 2.All computers unenrolled 3.Computer enrolled 4.Login authenticated 5.User challenged 6.User computers unenrolled 7.Login credentials reset 8. address confirmed 9.Changed address 10.Questions created 11.Questions requested 12.Questions changed 13.Questions answered MFA Reporting Tips Customer Platform = Administration Activity Reporting, FI Admin Platform = Billing & Reporting Customer Activity Reporting See transaction type details in the users guide.