Cyber Security Challenge in Digital Banking

Online banking services, internet banking (IB), mobile financial services (MFS) and QR payments are already part of our daily lives. Customers can transfer money, pay bills and make purchases without visiting a bank branch. Bangladesh is now entering a new era of digital banking, with new digital banks expected to bring more services to customers. This progress will make banking easier and faster. At the same time, cybersecurity will become more important.
Cyber security is not only about protecting a bank’s website or mobile application. A single transaction may involve a customer's phone, the bank's systems, a payment gateway, a payment network and the beneficiary's bank. A weakness at any point can create an opportunity for fraud. Both new digital banks and existing banks must therefore make cybersecurity a part of their daily operations.
One common threat is phishing, where criminals trick customers into sharing confidential information. For example, a customer may receive an SMS or email claiming that a subscription or online service will be suspended unless the payment card is confirmed. The message contains a link to a fake website that looks like the genuine service provider's website. The customer enters the card number, expiry date and security code. Criminals may then use these details to attempt unauthorised purchases. They may also ask for a one-time password to complete a fraudulent transaction. Customers should never share their PINs, passwords or one-time passwords in response to such messages. They should verify any request through the service provider's official channel.
Mobile and internet banking face other risks. Criminals may steal passwords, create fake banking applications or use malicious software to gain access to devices. They may also take control of accounts through SIM replacement fraud. Even a secure banking application cannot always protect a customer who is tricked into approving a fraudulent transfer. Banks need strong authentication, secure applications, transaction alerts and effective fraud monitoring. Customers must also use official applications and avoid unknown links.
Card payments, ATMs and QR transactions have their own challenges. Stolen card details may be used for online purchases. Criminals may also replace a merchant's genuine QR code with one linked to another account. A customer may believe the payment is going to a shop when the money is sent elsewhere. Banks and payment providers should display the recipient's name clearly before payment confirmation and monitor unusual transactions.
Mobile financial services and agent banking face risks from fake customer-care representatives, stolen PINs and dishonest agents. A fraudster may pretend to be a service provider and ask a customer to share an OTP to solve an account problem. Once the code is shared, the criminal may gain access to the account. Corporate banking faces different risks. Criminals may compromise a company's email account and send false instructions to change a supplier's bank details. Dual approval and independent verification of payment instructions can help prevent such fraud.
Interbank transfers and payment networks also need strong protection. Transactions through payment switches, electronic fund transfer systems and real-time settlement platforms depend on secure connections and accurate instructions. If a system or its access credentials are compromised, transactions may be manipulated or services disrupted. Banks must protect connections between systems, restrict access, detect duplicate transactions and reconcile payments independently.
Banks also depend on technology vendors, cloud services, telecommunications networks and fintech partners. A security weakness at one provider may affect several institutions. Ransomware attacks can disrupt services and prevent customers from accessing their accounts. Banks should assess third-party risks, protect customer data, maintain secure backups and test recovery plans regularly.
Artificial intelligence brings both opportunities and risks. Banks can use AI to identify unusual transactions and detect fraud more quickly. Criminals can also use AI to create convincing messages and imitate voices. Banks must improve their detection systems and train employees to recognise new forms of fraud.
Bangladesh Bank has issued various guidelines to help banks and financial institutions manage technology and cybersecurity risks. These guidelines provide a foundation for safe banking. As digital banking grows, new services, payment methods and fraud techniques continue to emerge. Banks need to adapt their security measures to keep pace with these changes. Regular reviews of security practices, staff training, independent security testing and effective incident response can help banks protect customers and maintain trust in digital banking.
Customers have a role as well. They should verify payment recipients, enable transaction notifications and use official banking channels. Banks will never need a customer's PIN or OTP for routine customer support. Any unexpected request to confirm card details, pay a fee or prevent account suspension should be checked before action is taken.
Digital banking will continue to grow in Bangladesh. Its success will depend not only on speed and convenience but also on trust. Banks, regulators, technology providers and customers must work together to protect money and personal information. As banking becomes more digital, cybersecurity must also evolve to keep every transaction safe.
_____________________________________
The writer is a former banker and Senior FinTech Specialist at Sovereign Secure