Fromenance for credit unions
A definitive answer for every member, with no analyst in the loop
Fromenance is a communication provenance platform sized for credit unions: register your member alerts at send time, and a member who forwards a suspicious one to verify@yourcu.org gets Verified, Not verified, or Known fraud in seconds while your small team reviews what failed. Setup is one TXT record, one redirect rule, and one footer.
What your customers are receiving
The impersonation scenarios credit unions fraud teams see every week, and what a Fromenance verdict does to each one.
The member alert lookalike
"Unusual sign in on your account" from yourcu-alerts.com with your logo. It passes authentication for the attacker's domain. Forwarded to verify@, it returns Not verified and the domain is an indicator before the second member calls.
The shared branch confusion
Members receive real mail from partners, processors, and card vendors and cannot tell it apart from a lure. Register the vendor stream through the journal path and those messages verify too.
The text to email pivot
A lure arrives by SMS and points at a page that emails a 'confirmation'. The emailed confirmation is not in your registry. The web verify page answers in seconds, and the SMS channel is on the roadmap with the same code in a shorter footer.
The copied footer
A lure that copies your verify footer resolves to Not verified and raises a replay flag internally. Attackers teach members to use verify@ and then deliver their lure to your fraud team through it.
Five people, thousands of members
A small fraud and security team cannot triage every 'is this real' email. Submissions arrive with signals, indicators, and a verdict already attached; the reply already went out.
The 'is this real' call
Each call costs roughly $8 to $15 and the agent cannot answer authoritatively. Every member who forwards to verify@ instead is a call that did not happen.
Register these streams first
Coverage is the whole game. Start with the communications customers already scrutinize, because those are the ones they will forward.
- 01
Fraud and card alerts
The stream members scrutinize most. Best first stream for a pilot; register from the ESP webhook or a single API call.
- 02
Account and transaction alerts
High volume, template driven, and where lures most often imitate you.
- 03
Loan and payment notices
Auto loan, mortgage, and payment due notices from the loan servicing platform, registered through the journal BCC path when the vendor cannot call an API.
- 04
Statements and e-notices
Batch runs through the batch endpoint or a journal target on the statement vendor's sending system.
Outcomes you can put in front of the board
Every metric below is captured by the product itself, so the pilot report is a dashboard export.
Fewer calls, fewer tickets
Contact center 'is this real' volume and abuse mailbox volume on the pilot stream, before and during, reported at day 30, 60, and 90.
Analyst hours back
Suspicious message triage per week, before and during. Submissions come pre-extracted and pre-decided; the analyst reviews and overrides, they do not parse.
Earlier detection
Time from first member submission to analyst confirmation of a campaign, and lookalike domains discovered from member forwards rather than from a monitoring feed.
Fewer takeovers
ATO events traced to phishing of the pilot stream, and the reimbursement and card reissue costs that follow them.
Members who keep reading
A verifiable footer on every alert gives members a reason to trust real mail, which protects e-statement adoption and digital servicing.
Intelligence yield
Indicators not present in your existing feeds, verified by your team, exportable as CSV or STIX for your gateway, SIEM, or takedown vendor.
Compliance framing
Credit union examiners ask how members are protected from impersonation and how the institution responds. Fromenance gives you a documented, customer facing control: verdicts are immutable, analyst actions are audited, registered communications carry a timestamp and a recipient hash, and retention is a setting you control. Reports export from the admin app. We give you the evidence; your compliance officer frames it under NCUA guidance.
The pilot, week by week
60 to 90 days on one stream. Onboarding help included, because we know the team is small.
Step 1: Week 0
Contract and DPA, tenant created, TXT record published, redirect rule live, forwarding test passed.
Step 2: Week 1
One stream registered, footer deployed to that template, reply identity live on your domain.
Step 3: Weeks 2 to 12
Run. Weekly 30 minute review of Submissions and Indicators with your fraud lead. Reports at day 30, 60, and 90.
Questions evaluators ask
- We have a five person team. How much work is this?
- One TXT record, one mailbox with a redirect rule, one footer paste, and one ESP webhook or API call. The setup wizard walks through the six steps and sends a test message before go live. Docs give click by click steps for Google Workspace and Microsoft 365. After that, the reply is automatic and the analyst's job is review.
- How is it priced for a credit union?
- Annual contracts banded by protected members. The small credit union band (up to 250K) is $20K to $40K per year for the verification tier with 2 domains, 3 sources, 5 users, and 90 day retention. The pilot is a fixed fee credited to the first contract.
- Does it help with NCUA examinations?
- It gives you a customer facing fraud control with an immutable verdict log, an audit trail of every analyst action, and a written pilot report with before and during metrics. It is evidence for your program, not a certification.
- What happens when a vendor message is not registered?
- The member gets Not verified with the words 'no registered communication matches', never 'fraudulent'. An analyst can mark it legitimate, which registers it retroactively and flags the coverage gap on that source so you can add the vendor stream.
- Can members use it without email?
- Yes. yourcu.org/verify accepts pasted text, an .eml file, or a screenshot and renders the verdict on the page in your branding. No account, nothing to install.
Run a 60 to 90 day pilot on one communication stream.
Fraud alerts or transaction alerts are the best first stream. You get a written report of verification volume, verdict distribution, campaigns discovered, and intelligence yield.