if Credit Union account is hacked

Why are you specifically asking about a credit union? Your 'friend' appears to be paranoid about any financial institution.

The answer to your question is 'it depends'. Typically on things like (1) If Joe Duffy is involved (2) if a PIN or password is required to transfer money out.

Yes, if it's clear fraud

If you hand over the details required to get in your account, it is not hacking. Banks do not refund in these cases unless they have been able to retrieve the money - it isn't their fault. CUs will be the same.

Yes when you attempt login a text will be sent to your phone with a code which is then required to be entered on the PC, even if someone was screen sharing your PC they wouldn't be able to create a 2nd connection as it would only be valid for a single login and then it expires.

This was brought in within the last 2 years, it's possible if someone had an online account with a credit union before this that they would have only needed a password but all would have moved over to this mobile phone authentication since.

Now one area where this is open to fraud is if a customer goes to an address that looks like their bank but is not the correct URL and is a website run by a fraudster who they are then sending their verification code to.

For example you get an email and it says you need to login to your credit union account to resolve some problem, you click on the link in the email which brings you to a website which 'looks like' your credit union but is actually using a completely different URL like www.mycreditunion-securewebsite.net and you enter your details, the fraudster on their PC tries to login to your account using the correct URL which then sends you a text, you then enter these details on www.mycreditunion-securewebsite.net and they in turn login to the correct URL and commit fraud on your account. This is why you should never ever login to your accounts following any link.

What bank is that? I thought all Irish banks forced 2FA for browser logins

For the website, you need to authenticate with the phone app.

No separate authentication for the app itself.

That’s not true. Social engineering and phishing are hacking just as much as someone finding a compromise in the software implementation or guessing someone’s password.

That’s not to say that it’s the banks fault or responsibility.

It is but it may be that your device was compromised or there was an issue in the banks network infrastructure.

This post started about Credit Unions or not? Anyone know of an online transaction with a C U debit card that actually went thru? The customer service firm(UK) handling transaction are a waste of space.