Susan Abayomi
As cybercrime continues to evolve, Union Bank of Nigeria has emphasised the need for stronger cybersecurity awareness among employees and customers, warning that human behaviour remains a major factor in financial fraud.
Francis Mojoyinola, the bank’s Chief Information Security Officer, made this known in an article examining the growing role of human error, deception and misplaced trust in cyberattacks.
In his article titled “The Human Firewall – Why The First Line of Defence Runs in Both Directions,” Mojoyinola explained that although financial institutions continue to strengthen their security systems, cybercriminals are increasingly exploiting human vulnerabilities to gain access to sensitive information and financial resources.
He noted that many fraud victims are not necessarily careless individuals but often busy, competent people who believe they are sufficiently knowledgeable to recognise fraudulent activities.
Reflecting on Cybersecurity Awareness Month in October, he stressed that technological improvements alone cannot completely address cyber threats, as criminals frequently combine system vulnerabilities, stolen login details and social engineering techniques to execute attacks.
Citing the 2026 Verizon Data Breach Investigations Report, which examined more than 31,000 security incidents across 145 countries, Mojoyinola disclosed that human involvement featured in 62 per cent of data breaches, compared with 60 per cent in the previous year.
According to him, cybercriminals increasingly focus on manipulating individuals into granting access rather than relying solely on technical weaknesses.
He also highlighted the limitations of conventional cybersecurity awareness programmes, referencing an eight-month study conducted by researchers at the University of California, San Diego, involving more than 19,500 employees of a large healthcare organisation.
The study found that mandatory annual cybersecurity training had no significant relationship with employees’ susceptibility to phishing attacks, while immediate training following simulated phishing incidents produced only a modest improvement.
Mojoyinola explained that cybersecurity education must go beyond teaching people how to identify fraudulent messages in controlled environments. He said organisations must prepare employees and customers to recognise suspicious activities even when they are distracted, under pressure or responding to seemingly urgent requests.
He further warned that excessive confidence in one’s ability to identify scams could increase vulnerability, as people who believe they cannot be deceived may become less cautious when handling suspicious communications.
Insider Threats and Financial Fraud
Addressing cybersecurity challenges within financial institutions, Mojoyinola cited figures from the Nigeria Inter-Bank Settlement System (NIBSS), which showed that digital payment fraud losses declined by 51 per cent in 2025 to ₦25.85 billion, compared with ₦52.26 billion recorded in 2024.
Despite the improvement, he noted that social engineering and insider abuse remained significant concerns.
He referenced comments by NIBSS Chief Executive Officer, Premier Oiwoh, who acknowledged the high level of insider involvement in financial fraud, adding that recent investigations had confirmed the concern.
Mojoyinola explained that insider-related incidents do not always involve dishonest employees. In many cases, unsuspecting workers may unknowingly compromise security after responding to urgent requests from individuals pretending to be senior officials or other trusted authorities.
He identified pretexting, a technique in which criminals create convincing scenarios to manipulate their targets, as another growing threat.
According to him, one of the most important security practices within an organisation is encouraging employees to report mistakes or suspicious incidents immediately rather than conceal them out of fear of punishment.
He stressed that the speed with which an exposed credential or security breach is reported can significantly influence the extent of the damage.
He added that management plays an important role in creating an environment where employees feel comfortable reporting security concerns without fear of blame.
Mojoyinola also called for greater transparency among financial institutions, noting that failure to report fraud incidents prevents the banking industry from learning from security breaches and developing stronger preventive measures.
Customers Also Have a Role to Play
Beyond the workplace, the Union Bank executive identified customers as an important part of the cybersecurity defence system, noting that personal identification numbers, passwords and one-time verification codes are valuable credentials that must be protected.
He observed that many customers share their banking details with relatives, assistants and other trusted individuals to make financial transactions easier.
Although such arrangements may be based on trust, he warned that they increase the number of people with access to sensitive account information, creating additional opportunities for cybercriminals.
He also highlighted the growing use of mobile phones by fraudsters, citing the Verizon report’s finding that phishing simulations conducted through mobile channels, including phone calls and text messages, recorded median click rates approximately 40 per cent higher than those involving emails.
According to him, this is particularly relevant in Nigeria, where fraudulent calls often involve individuals who already know their victims’ names and recent transaction details.
Mojoyinola further cautioned financial institutions against shifting responsibility entirely to customers whenever fraud occurs.
He explained that victims often experience fear and embarrassment after losing money, and such feelings may discourage them from reporting incidents promptly.
He maintained that banks must prioritise treating affected customers appropriately and responding quickly to contain financial losses before focusing on educating them about preventive measures.
He added that financial institutions must recognise that their reputations can be affected whenever customers experience fraud, even when the initial compromise occurs outside the bank’s systems.
Consequently, he described customer education and protection as both a public responsibility and an important part of institutional security.
Practical Steps to Prevent Cyber Fraud
Highlighting essential security practices, Mojoyinola advised employees and customers to be cautious whenever they receive urgent requests involving financial transactions or sensitive information.
He urged individuals never to disclose verification codes sent to their phones, regardless of how convincing or knowledgeable a caller may appear.
He also recommended verifying suspicious requests through independently established channels, such as official telephone numbers or banking applications, rather than using contact details or links supplied by unknown callers.
Other precautions include rejecting authentication requests that were not personally initiated and reporting suspected fraud immediately, even when there is no certainty that an account has been compromised.
He emphasised that developing these habits requires continuous education rather than occasional awareness campaigns.
According to him, financial institutions must communicate security information regularly, using simple language and the platforms customers and employees frequently access.
Building a Stronger Cybersecurity Culture
Mojoyinola maintained that individual vigilance must be supported by stronger institutional security measures, including multi-factor authentication, password management systems and improved monitoring tools.
He explained that organisations should establish security structures capable of limiting the consequences of human mistakes.
Such measures include restricting employees’ access to information according to their responsibilities, introducing additional approval procedures for sensitive transactions and monitoring unusual account activities.
He disclosed that Union Bank adopted “Building a Cyber Strong Culture” as its theme for this year’s Cybersecurity Awareness Month, stressing that a strong security culture goes beyond purchasing and installing technological solutions.
According to him, organisational culture determines how effectively security measures are applied during everyday operations and whether employees feel confident questioning unusual instructions, particularly those coming from senior officials.
He added that customers must also feel encouraged to report suspicious activities before they develop into major financial losses.
Mojoyinola explained that a strong cybersecurity culture should recognise employees and customers as essential participants in security rather than treating them as weak links.
He said institutions must design their security systems around realistic human behaviour, acknowledging that people can become tired, distracted, pressured or deceived.
He concluded that effective cybersecurity requires a combination of technology, responsible behaviour, institutional safeguards and mutual trust.
While security systems will continue to improve, he warned that cybercriminals would equally continue to develop new methods of attack.
He therefore stressed that employees must be encouraged to report suspected security breaches promptly, while customers should contact their banks as soon as they notice unusual activities.
He noted that although people remain an important part of the first line of defence, financial institutions must also take responsibility for protecting those who depend on their services.
About the Author
Francis Mojoyinola is the Chief Information Security Officer at Union Bank of Nigeria, where he oversees cybersecurity strategy, information security governance and data protection operations.
He has more than 20 years of experience in information technology, risk management and financial control within Nigeria’s banking industry.
His professional expertise includes developing resilient security systems, strengthening threat detection and response frameworks, and ensuring compliance with regulatory requirements and international ISO standards.
Before his current position, he held senior roles in IT governance, cybersecurity and audit within the financial services sector.
Mojoyinola is a Fellow of the Institute of Chartered Accountants of Nigeria (FCA), an Honorary Senior Member of the Chartered Institute of Bankers of Nigeria (HCIB) and a Certified Information Security Manager (CISM). He is also a graduate of Obafemi Awolowo University, Ile-Ife.
