Banks are attacked because that is where the money is. It is a simple reason, and that is why it never goes away. What has changed in the last few years is that an attacker no longer needs to break into a complex system. More often than not, it is easier to call a frightened customer or a busy employee and politely ask for exactly what they need.
That means a bank's security is no longer just the IT team's job. It is also about how the person at the counter reacts, the customer in the app, and the manager who approves a large payment.
What the attacks look like today
Almost all of today's fraud revolves around a single idea: to get you to do, with your own hand, what the attacker wants.
- Phishing — fake emails that look like they come from the bank and send you to a fake site where you type in your own details.
- Vishing — phone calls where someone pretends to be a bank employee and rushes you to confirm a code or a payment.
- Smishing — text messages with a fake link and a message designed to scare you: "card blocked", "suspicious payment", "confirm now".
- Transfer fraud — the attacker gets into a company's email, changes the bank details on an invoice, and the money lands in their account.
- Attack on an employee — someone pretends to be the boss or a supplier and asks for an urgent payment, "just between us", before the office closes.
They all share two things: a rush and a fear. That is why they work. Nobody thinks clearly when told they will lose money in the next five minutes.
Fraud is more about people than computers
It is called social engineering, but in plain terms it simply means tricking the person. The attacker is not looking for a hole in the system. They are looking for someone who has access and can be talked into handing it over.
An example we see often: someone calls support, pretends to be an upset customer, says they have lost access and urgently need a reset. If the employee wants to be helpful and skips a check, the attacker has just walked into the account. No technology catches this if the person has not been taught to recognise the pattern.
What the law says
A bank has strict, overlapping rules, but the part that matters in a data fraud comes down to a few things.
- GDPR. If customer data ends up where it should not, the bank notifies the authority within 72 hours and, if the risk is high, notifies the customers too. Fines can reach 4% of turnover.
- Customer authentication. Payment rules require an online transaction to be confirmed with more than one factor, not just a password, precisely so that a stolen code is not enough.
- DORA and NIS2. Banks have to manage their IT risk, report major incidents and test how well their systems hold up. We covered this in detail in our article on information security in the financial sector.
What a bank can do in practice
No single measure solves everything. But a few of them put together block the large majority of fraud.
- Two-step authentication, everywhere. A password plus a code or an in-app confirmation. A stolen password is no longer enough.
- Transaction monitoring. Systems that spot the odd payment, the odd hour, the odd amount, and hold them until a person checks.
- Trained people. Staff taught to recognise a trick and not to rush. A simple "I'll call you back on the official number" stops a lot of fraud.
- Clear payment rules. A double check for large amounts, on a separate channel, so that a single email cannot move money.
- A plan for when it happens. Who calls whom, what gets shut down first, how customers are told. Written down beforehand, not improvised in the middle of the crisis.
- Testing. Simulated attacks on your own people and your own systems, so you find where the chain breaks before a real attacker does.
At INFOSHARE we help banks and financial firms put these in place: from information security and security testing to training the people. And for the personal-data side, everything is visible and provable in one place, in the askGDPR platform.
Frequently asked questions
What are the most common banking frauds today?
Most start with phishing (fake emails), vishing (fake calls where someone pretends to be the bank) and smishing (fake text messages). The goal is always the same: to convince a customer or an employee to hand over a password, a code received on the phone, or to approve a payment. Fraud through social engineering, meaning tricking the person, is far more common than technically breaking into the systems.
Why are banks such a popular target?
Because that is where the money is, along with the data that leads to money: accounts, cards, transaction history, identity details. A successful attack turns into profit straight away, so banks are attacked constantly and have to defend themselves every day, not now and then.
What must a bank do when it has a data breach?
Under GDPR, the bank must notify the supervisory authority within 72 hours of becoming aware of the breach and, if the risk to customers is high, notify them too. At the same time it has to stop the leak, gather the evidence and keep a record of the incident.
Does two-step authentication really help?
Yes. It asks for something the person knows (the password) plus something they have (the code on the phone), so a stolen password is no longer enough. It is not perfect, because some attackers trick the customer into handing over the code as well, but it cuts fraud significantly and is one of the cheapest measures for how much it blocks.
Want to protect your bank or firm from fraud and attacks?
We assess the risks, test your people and systems, and put together a defence plan everyone can understand, not just the IT team.