Human Factors, Ethics and Customer Protection

Introduction

Cybersecurity in banking is not solely a technical discipline. Authentication systems, transaction-monitoring models and security operations can be undermined by a customer who discloses a one-time password, an employee who bypasses a control for convenience, or a manager who treats suspicious behaviour as a performance issue rather than a security signal. Human behaviour is therefore part of the bank’s attack surface, control environment and ethical responsibility.

This chapter examines social engineering, security culture, behavioural vulnerabilities and insider threats. It then considers how banks can design awareness and intervention programmes without reducing cybersecurity to blame or surveillance. The central managerial problem is dual: institutions must detect and prevent harmful activity while preserving privacy, fairness, explainability, accessibility and legitimate customer autonomy. Customer protection also requires careful treatment of liability when fraud occurs through authorised or apparently authorised transactions.

A mature approach views people neither as the weakest link nor as perfectly rational security actors. Customers and employees operate under stress, time pressure, incomplete information, cognitive bias, unequal digital literacy and organisational incentives. Effective controls therefore combine technology, process design, education, supportive intervention and accountable governance.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Explain the mechanisms and variants of social engineering in banking.
2. Analyse behavioural vulnerabilities and distinguish error, negligence, malicious conduct and coercion.
3. Evaluate security culture and insider-threat risk using socio-technical frameworks.
4. Design proportionate awareness, reporting and intervention programmes.
5. Assess the ethical implications of surveillance, behavioural analytics and AI-assisted fraud detection.
6. Apply principles of privacy, fairness, explainability, inclusion and customer liability to banking decisions.

1. The human attack surface

The human attack surface includes every point at which a person can influence the confidentiality, integrity or availability of information and financial services. It includes customers, branch staff, contact-centre agents, developers, administrators, contractors, merchants and senior executives. It also includes ordinary decisions: clicking a link, approving a payment, sharing credentials, opening a file, overriding a warning or failing to report an anomaly.

Human-related security events should not be classified too quickly as “user error.” Four analytically different conditions are especially important:

This classification matters ethically. If every incident is blamed on an individual, employees conceal events and customers may be treated unfairly. If every event is excused as a system failure, deterrence and accountability disappear. A just security culture distinguishes culpability from contribution to risk.

2. Social engineering in banking

Social engineering is the deliberate manipulation of human judgement to obtain information, access, money or an action that benefits an attacker. It exploits trust relationships and decision contexts rather than relying only on software vulnerabilities.

Common forms

• Phishing: deceptive messages that induce a recipient to click, disclose credentials or make a payment.
• Smishing and vishing: phishing through SMS and voice calls.
• Business email compromise: impersonation of an executive, supplier or customer to redirect funds or alter payment instructions.
• Authorised push-payment fraud: a victim is persuaded to approve a transfer, often after being told that funds must be moved to a “safe account.”
• Impersonation and pretexting: an attacker constructs a credible story and identity, such as a bank investigator, regulator or technology provider.
• Mule recruitment: individuals are recruited, knowingly or unknowingly, to receive and transfer criminal proceeds.
• Quid pro quo and baiting: an attacker offers assistance, a reward or an urgent benefit in exchange for access or information.
• Tailgating and physical manipulation: an unauthorised person gains entry by exploiting politeness or perceived authority.

Social engineering succeeds when the attacker aligns a message with a plausible context. Authority, urgency, scarcity, reciprocity, social proof and fear are recurring influence mechanisms. A message need not be technically sophisticated if it arrives when the recipient is distracted, financially anxious or under an organisational deadline.

A cognitive account of susceptibility

Human judgement is often bounded rather than fully rational. Under time pressure, people use heuristics—efficient rules of thumb—to decide whether a request is credible. Attackers exploit:

• Authority bias: excessive deference to a senior or official-looking source.
• Availability bias: vivid warnings, such as “your account is under attack,” dominate assessment.
• Confirmation bias: recipients notice details supporting what they already expect.
• Normalcy bias: unusual activity is interpreted as routine.
• Commitment effects: after beginning a conversation or transaction, a person continues to avoid admitting doubt.
• Cognitive overload: complex warnings are ignored when the user is multitasking.

Training should therefore teach verification behaviours, not merely lists of suspicious words. A useful behavioural rule is: stop, separate, verify. Stop the interaction; separate the request from the apparent relationship; and verify through an independent channel. “Independent” means not using the phone number, link or reply address supplied by the suspicious message.

3. Security culture and behavioural risk

Security culture is the shared pattern of assumptions, values and practices through which an organisation understands and manages security. It is visible not in policy documents alone but in what employees do when controls conflict with speed, sales targets, customer convenience or managerial pressure.

A strong culture has five characteristics:

1. Leadership example: senior personnel follow the same controls as other staff.
2. Psychological safety: employees can report mistakes and suspicious requests without disproportionate punishment.
3. Operational integration: security is embedded in workflows, procurement, product design and performance management.
4. Learning orientation: incidents produce system improvements, not only disciplinary outcomes.
5. Consistent accountability: deliberate abuse and reckless conduct are addressed fairly and transparently.

Security culture can be assessed through surveys, interviews, focus groups, control observations, reporting rates, exercise results and incident data. No single metric is sufficient. A high reporting rate may indicate healthy vigilance, but it may also reflect excessive false alarms. A low incident rate may indicate strong controls, under-reporting or inadequate detection.

A useful programme-level metric is the proportion of simulated or real suspicious events reported through the approved channel:

The metric is meaningful only when the denominator is defined, the exercise is ethically governed and reporting opportunities are comparable. It should be interpreted alongside false-positive rates, reporting speed, quality of reports and employee experience. It must not be used as a simplistic ranking tool that encourages employees to report every harmless message.

4. Insider threats: a socio-technical perspective

An insider threat is the potential for a person with legitimate access to harm information, systems, customers or the institution. Insiders may be malicious, negligent, compromised or coerced. Threats can arise from employees, contractors, vendors and privileged administrators.

A practical classification is:

• Malicious insider: deliberately steals, alters or discloses assets.
• Negligent insider: creates exposure through avoidable carelessness.
• Compromised insider: credentials or endpoint are controlled by an external attacker.
• Coerced insider: acts under threats, extortion or severe personal pressure.

Risk is not determined by job title alone. It emerges from the interaction of access, opportunity, motivation, capability and control weakness. Privileged-access management, segregation of duties, least privilege, dual approval, immutable logging and timely access removal reduce opportunity. Fair treatment, support for distressed employees and realistic workloads can reduce pressure-related vulnerability, although they cannot eliminate malicious intent.

Behavioural indicators should be treated as prompts for proportionate review, not proof of misconduct. Examples may include unusual data downloads, access outside normal duties, repeated control overrides, unexplained conflicts of interest or sudden contact with suspicious third parties. A single indicator is rarely decisive. Context, legitimate business reasons, data quality and the possibility of account compromise must be examined.

The insider-threat lifecycle normally includes prevention, detection, triage, investigation, containment, recovery and learning. Investigations should preserve evidence, limit access to sensitive employee information, document decisions and provide procedural fairness. Employment law, collective agreements, privacy law and evidentiary requirements may constrain monitoring and disciplinary action.

5. Designing awareness and intervention programmes

Awareness is not equivalent to information transfer. A programme is effective when it changes decisions under realistic conditions and strengthens reporting and recovery. It should be risk-based, role-specific, inclusive and evaluated.

A design cycle

Risk diagnosis. Analyse fraud typologies, incident reports, customer complaints, near misses, job roles, attack simulations and environmental pressures. Identify high-consequence behaviours rather than merely counting training completions.

Behavioural objectives. State observable actions. For example: “Employees verify changes to supplier bank details using a known contact” is stronger than “Employees understand payment fraud.”

Control and workflow design. Training cannot compensate for a process that rewards unsafe speed. Add call-back verification, cooling-off periods, beneficiary warnings, dual control and clear escalation paths where appropriate.

Role-specific learning. A branch employee, software engineer, treasury officer and retail customer face different risks. Modules should be short, contextual and repeated at appropriate intervals.

Practice and reinforcement. Simulated messages, role-played calls, secure reporting exercises and feedback improve transfer. Simulations must not collect unnecessary personal data or humiliate participants.

Measurement and improvement. Evaluate knowledge, behaviour, reporting, response time, fraud losses and user friction. Compare trends over time and test whether improvements persist.

Interventions should follow a graduated model. A low-risk event may prompt a contextual warning or coaching. Repeated high-risk behaviour may require supervised work, access adjustment or formal review. Suspected malicious activity requires evidence preservation and investigation. Coercion or victimisation requires safeguarding and support as well as security action.

Customer education and accessible protection

Customer communication should be brief, specific and repeated at moments of risk. Banks should clearly state that they will not ask customers to disclose passwords or transfer money to “protect” an account. They should offer accessible channels for customers with disabilities, limited language proficiency, low digital literacy or limited connectivity. Voice, branch, assisted-digital and secure messaging options may be necessary complements to app-based controls.

Good customer protection uses secure defaults: transaction limits, trusted-beneficiary delays, confirmation of unusual payees, friction for high-risk transfers and simple recovery routes. However, friction must be proportionate. Excessive authentication or unexplained declines can exclude older customers, people with disabilities, migrants, rural users and customers without reliable smartphones.

6. Surveillance, privacy and ethical analytics

Behavioural analytics can identify unusual logins, transaction patterns, device changes, session characteristics and access to sensitive records. Its legitimate purpose may be fraud prevention or insider-threat detection, but it creates risks of excessive monitoring, function creep and unjustified suspicion.

A defensible governance framework asks:

• What precise security purpose justifies collection?
• Is the data necessary and proportionate to that purpose?
• Is there a less intrusive alternative?
• How long will the data be retained?
• Who can access it, and how is access logged?
• Can affected people obtain an explanation, correction or review?
• What evidence shows that the model is accurate across relevant groups?

Privacy is not merely secrecy. It includes control over personal information, contextual integrity and protection from unjustified inference. A bank should distinguish security telemetry from information collected for marketing or employee performance management. Reusing fraud-monitoring data for unrelated evaluation may violate purpose limitation and undermine trust.

A risk-based governance process can be represented as:

Figure: A proportionate governance process for behavioural security analytics.

7. Fairness, explainability and AI-assisted decisions

Fraud models often produce scores rather than definitive conclusions. A score may trigger additional verification, temporary review or a payment hold. It should not automatically be treated as proof that a customer is dishonest.

Fairness has multiple dimensions. Group fairness asks whether error rates or outcomes differ systematically between demographic or vulnerability groups. Individual fairness asks whether similar cases receive similar treatment. These goals can conflict, particularly when groups have different base rates, data quality or exposure to fraud. Consequently, fairness cannot be reduced to one statistical test.

For a binary decision, useful measures include:

A false positive may inconvenience or exclude an innocent customer; a false negative may allow fraud. The appropriate balance depends on transaction value, reversibility, customer vulnerability and available human review. Rates should be calculated on a clearly defined evaluation sample and interpreted with confidence intervals where decisions are consequential.

Explainability should be actionable rather than merely technical. A customer may need to know that a payment was held because it involved a new beneficiary, an unusual device and a high-risk transfer pattern, together with the steps needed to verify it. Revealing precise detection thresholds could assist attackers, so explanations should provide meaningful reasons without exposing sensitive defensive detail.

Human oversight must be real. A human reviewer who merely confirms an algorithmic result without examining evidence is not meaningful oversight. Reviewers need authority, training, time, relevant context and a documented route to override the system. Automated decisions should be monitored for drift, feedback loops and disparate impact.

8. Customer liability and institutional responsibility

Customer liability for fraud is legally jurisdiction-specific and depends on facts, contractual terms and applicable payment-services rules. A sound policy should not assume that authentication proves informed consent. A transaction may be technically authenticated yet socially engineered, coerced or executed after an account takeover.

Assessment should consider:

• Was the transaction authorised in law and in fact?
• Did the customer act fraudulently or with gross negligence, or were they deceived?
• Did the bank’s controls, warnings and response processes operate properly?
• Was there delay in detecting or recalling funds?
• Was the customer vulnerable, coerced or reasonably reliant on an impersonated bank employee?
• Did a receiving institution or intermediary have relevant duties?

Banks should publish understandable liability rules, provide rapid reporting channels and begin investigation without presuming customer fault. Temporary holds, recall attempts, emergency credential changes and support for victims can reduce harm. Complaints and appeals should be independent enough to challenge an initial decision.

A fair allocation of responsibility recognises that fraud is an ecosystem problem. Customers have duties to protect credentials and report incidents, but banks control authentication design, transaction monitoring, communication practices, payee verification, staff training and recovery processes. Liability should therefore be evidence-based and proportionate, not a mechanism for transferring all operational risk to consumers.

9. Illustrative case: the “safe account” fraud

Background

A retail bank observes a rise in transfers made by customers to newly created beneficiaries. Victims report receiving calls from people claiming to be bank fraud investigators. The caller knows partial personal information and instructs the customer to move funds to a safe account while an investigation is conducted.

Problem

The transactions are authenticated through the customer’s normal device and one-time password. A purely technical system labels them as authorised. However, the surrounding evidence suggests social engineering and potentially authorised push-payment fraud. The bank must balance rapid intervention with customer autonomy and avoid treating every new beneficiary as criminal.

Analysis

The attack exploits authority, urgency and fear. The one-time password is not evidence that the customer understood the true destination or purpose of the payment. Risk indicators include a new beneficiary, unusual amount, rapid movement of funds, a recent inbound call and language associated with account protection. These indicators are probabilistic and may also occur in legitimate emergencies.

Approach

The bank implements a layered response:

1. A plain-language confirmation states that bank staff will never ask customers to move money to protect it.
2. High-risk transfers receive a short cooling-off period, with an accessible option for urgent human assistance.
3. Contact-centre staff use an independent callback process and never rely on caller-provided numbers.
4. The model triggers review rather than automatic denial when risk and customer vulnerability are high.
5. Customers can report suspected fraud through app, telephone and branch channels.
6. The bank records reasons for intervention and offers a rapid appeal route.
7. Staff receive training on empathy, non-blaming language and safeguarding.
8. The bank shares typology information with relevant industry and law-enforcement partners within lawful limits.

Outcome

After implementation, the bank observes fewer completed transfers to newly created high-risk beneficiaries and faster reporting of attempted scams. Some legitimate payments are delayed, particularly for customers who rarely use digital channels. The bank therefore adds trusted-beneficiary facilities, improved multilingual messages and assisted verification rather than removing all friction.

Learning points

The case demonstrates that effective customer protection is neither unrestricted convenience nor blanket blocking. It is a calibrated combination of behavioural insight, technical signals, human review, accessible communication and fair remediation. It also shows why “authenticated” and “authorised” should not be treated as interchangeable concepts.

10. Governance and implementation priorities

A banking institution should assign clear responsibilities across the three lines of defence. Business and product teams own safe process design; risk and compliance functions set policy and challenge assumptions; internal audit independently evaluates governance and control effectiveness. Boards should receive information about human-factor risks, material fraud trends, customer harm, model performance, complaints and remediation—not only training completion figures.

A practical control framework includes:

• documented acceptable-use, access and reporting policies;
• least privilege, segregation of duties and privileged-access review;
• secure onboarding, role changes and prompt offboarding;
• independent verification for high-risk payment and supplier changes;
• protected whistleblowing and incident-reporting channels;
• privacy impact and algorithmic impact assessments;
• tested business continuity and customer-recovery procedures;
• supplier and contractor security requirements;
• periodic red-team, phishing and social-engineering exercises governed by consent and safeguards;
• post-incident learning with owners and deadlines.

Metrics should be balanced. Possible measures include median time to report, time to contain, proportion of high-risk transactions receiving effective intervention, customer harm avoided, false-positive burden, appeal outcomes, training transfer and control override rates. Management should avoid targets that encourage concealment, excessive blocking or discriminatory treatment.

Challenges and limitations

First, behaviour is context-dependent. A training intervention may work in a simulated environment but fail during a real crisis. Second, data about fraud and insider incidents are incomplete because victims and employees may fear blame. Third, fairness metrics can conflict, and demographic data may be unavailable or legally restricted. Fourth, attackers adapt to warnings and controls, producing an arms race between deception and intervention. Fifth, human review can introduce its own inconsistency and bias. Finally, customer protection may conflict with speed, convenience and financial inclusion.

These limitations support a principle of continuous assurance. Banks should test interventions with diverse users, review outcomes rather than intentions, document uncertainty, and revise controls when evidence shows avoidable exclusion or harm. Ethics is not an approval stage at the end of a project; it is an operating discipline throughout design, deployment and review.

Chapter Summary

Human factors are central to banking cybersecurity because people interpret requests, operate controls, approve payments and respond to warnings. Social engineering exploits authority, urgency, fear and cognitive overload; effective defence therefore requires verification habits, secure workflow design and timely human support. Security culture is demonstrated through leadership behaviour, psychological safety, integrated controls, learning and fair accountability.

Insider threats may be malicious, negligent, compromised or coerced. Detection must combine least privilege, segregation of duties, logging and contextual investigation while respecting privacy and due process. Awareness programmes should define observable behaviours, use role-specific practice, provide accessible customer support and measure real-world outcomes rather than completion alone.

Behavioural analytics and AI can improve detection but create risks of surveillance, privacy intrusion, bias, opacity and exclusion. Proportionate governance requires purpose limitation, data minimisation, model testing, human review, explanation and remedies. Customer liability must be evidence-based and recognise that authentication does not always establish informed authorisation. Sustainable customer protection combines technical controls, behavioural insight, institutional responsibility and ethical governance.

Key Terms

Social engineering: Manipulation of people to obtain access, information, money or an action.

Phishing: Deceptive electronic communication intended to induce unsafe action.

Authorised push-payment fraud: Fraud in which a victim is manipulated into approving a payment.

Security culture: Shared organisational assumptions and practices concerning security.

Insider threat: Risk arising from a person with legitimate access causing harm.

Least privilege: Providing only the access necessary for an assigned task.

Segregation of duties: Dividing critical tasks so one person cannot complete an abuse independently.

Psychological safety: A climate in which people can raise concerns or admit mistakes without disproportionate punishment.

Behavioural vulnerability: A condition that makes unsafe influence or decision-making more likely.

At-risk behaviour: A shortcut that increases risk but is perceived as useful or normal.

Purpose limitation: Restricting data use to specified legitimate purposes.

Data minimisation: Collecting and retaining no more personal data than necessary.

False positive: A legitimate case incorrectly classified as suspicious.

False negative: A harmful or fraudulent case incorrectly classified as legitimate.

Explainability: The ability to provide understandable reasons for a system output or decision.

Human oversight: Meaningful human ability to review, challenge and override an automated result.

Customer vulnerability: Circumstances that increase exposure to harm or reduce ability to protect interests.

Just culture: An approach distinguishing human error, risky behaviour and culpable misconduct fairly.

Function creep: Use of information for purposes beyond those originally justified.

Review Questions

Short Answer Questions

1. Define social engineering and explain why technical authentication does not necessarily prevent it.
2. Distinguish mistake, at-risk behaviour, negligence and malicious conduct.
3. Identify four characteristics of a strong security culture.
4. What is the difference between a false positive and a false negative in fraud detection?
5. State three principles that should govern behavioural security analytics.

Long Answer Questions

1. Explain how cognitive biases and situational pressure contribute to social-engineering success in banking.
2. Evaluate the socio-technical controls required to manage insider threats.
3. Design an awareness and intervention programme for a retail bank experiencing increased payment fraud.
4. Discuss the ethical tensions between behavioural surveillance, fraud prevention and employee privacy.
5. Explain how fairness, explainability and human review should be incorporated into AI-assisted fraud decisions.

Analytical / Application Questions

1. A customer approves a transfer after a caller claiming to be a bank investigator instructs them to use a “safe account.” Analyse the evidence the bank should consider before deciding liability and remediation.
2. An employee repeatedly accesses customer records outside normal working hours, but claims to be investigating a service problem. Develop a proportionate investigation plan that protects security and procedural fairness.
3. A fraud model blocks a higher proportion of transactions from customers using shared devices and low-bandwidth networks. Identify possible causes, fairness risks and corrective actions.

Multiple Choice Questions with Answers

Question 1

Which statement best describes social engineering?

A. Exploiting only software vulnerabilities through automated code

B. Manipulating people to obtain information, access, money or an unsafe action

C. Encrypting customer data to prevent unauthorised disclosure

D. Testing network capacity under heavy traffic

Correct Answer: B. Manipulating people to obtain information, access, money or an unsafe action

Question 2

Which response is most appropriate to an unexpected request to transfer money to a safe account?

A. Reply using the contact details in the message

B. Complete the transfer quickly to avoid account closure

C. Stop and verify through an independent, trusted channel

D. Share the one-time password with the caller for confirmation

Correct Answer: C. Stop and verify through an independent, trusted channel

Question 3

Which condition describes a compromised insider?

A. A person deliberately abusing legitimate access

B. A person making an accidental typographical error

C. A person whose credentials or endpoint are controlled by an external attacker

D. A person refusing to work overtime

Correct Answer: C. A person whose credentials or endpoint are controlled by an external attacker

Question 4

Why should a high fraud-model score not automatically be treated as proof of customer dishonesty?

A. Scores are probabilistic indicators and may contain errors

B. Fraud models never use transaction data

C. Human review is prohibited in banking

D. All customers must be treated as fraudulent

Correct Answer: A. Scores are probabilistic indicators and may contain errors

Question 5

What does data minimisation require?

A. Collecting all available data for possible future use

B. Collecting and retaining no more personal data than necessary

C. Deleting all security logs immediately

D. Using personal data for unrelated marketing purposes

Correct Answer: B. Collecting and retaining no more personal data than necessary

Question 6

A detection system identifies 20 legitimate transactions as suspicious out of 200 legitimate transactions. What is the false-positive rate for this legitimate population?

A. 5%

B. 10%

C. 20%

D. 90%

Correct Answer: B. 10%

Question 7

Which feature most strongly indicates a just security culture?

A. Punishing every employee who reports a mistake

B. Suppressing incident data to protect reputation

C. Encouraging reporting while distinguishing error from culpable misconduct

D. Allowing senior staff to bypass security controls

Correct Answer: C. Encouraging reporting while distinguishing error from culpable misconduct

Question 8

Which practice best supports meaningful human oversight of an automated fraud decision?

A. Requiring reviewers to approve every model output without examination

B. Giving reviewers evidence, authority, time and a documented override route

C. Removing all audit logs from the review process

D. Allowing only the affected customer to alter the model

Correct Answer: B. Giving reviewers evidence, authority, time and a documented override route

Question 9

Why can excessive authentication friction create an inclusion risk?

A. It may disadvantage customers with disabilities, limited connectivity or low digital literacy

B. It guarantees that all fraud will succeed

C. It eliminates the need for customer support

D. It prevents banks from explaining decisions

Correct Answer: A. It may disadvantage customers with disabilities, limited connectivity or low digital literacy

Question 10

Which statement about customer liability is most defensible?

A. Technical authentication always proves informed customer authorisation

B. The customer is always liable for any transaction using a password

C. Liability should be evidence-based, proportionate and sensitive to deception, vulnerability and bank controls

D. Banks should never investigate disputed transactions

Correct Answer: C. Liability should be evidence-based, proportionate and sensitive to deception, vulnerability and bank controls