Cybersecurity Essentials for Bank Staff

About this module

Banks hold money, personal data and access to payment systems, which makes them a constant target for cybercriminals. Technical controls are essential, but many successful attacks begin with a person: an employee who clicks a link, shares a password or is persuaded to bypass a procedure. This module sets out the essential practices that every member of staff, in every role, is expected to follow. It complements each bank's own information security policies.

Learning objectives

By the end of this module, participants should be able to:

• recognise phishing and other social-engineering attempts;
• apply good practice for passwords and multi-factor authentication;
• keep devices and workspaces secure;
• know how and when to report a security incident; and
• handle customer data in a way that protects customers and the bank.

1. Phishing

Phishing is an attempt to trick a person into revealing information, opening a malicious attachment or visiting a fraudulent website. It usually arrives by email, but also by text message (smishing), voice call (vishing) or messaging application.

Warning signs

• Unexpected messages creating urgency, fear or excitement, such as an account suspension, an overdue invoice or a prize.
• Sender addresses that differ slightly from genuine ones, or display names that do not match the address.
• Links whose real destination differs from the text shown. Hover over a link to check before clicking.
• Requests for passwords, one-time passcodes or payment details.
• Unexpected attachments, particularly documents that ask you to enable content or macros.
• Generic greetings, an unusual tone or careless errors.

What to do

Do not click links, open attachments or reply. Report the message through your bank's reporting procedure. If you have already clicked or entered information, report it immediately; speed limits the damage.

2. Social engineering

Social engineering exploits trust, helpfulness and respect for authority. Attackers may impersonate senior executives, IT support staff, regulators, suppliers or customers. Common approaches include:

• Executive impersonation: an urgent instruction, apparently from a senior manager, to make a payment or release information outside normal procedures.
• Fake IT support: a caller asking you to install software, reveal your password or approve a login prompt.
• Pretexting: a plausible story used to obtain customer information by telephone.
• Tailgating: an unauthorised person following staff into secure areas.

The defence is to follow procedure, even under pressure. Verify unusual requests through a known, independent channel. No legitimate colleague will ask for your password, and no genuine process requires you to bypass a control.

3. Passwords and multi-factor authentication

• Use long passphrases that are hard to guess, and a different one for each system.
• Never share passwords or write them where others can see them.
• Use an approved password manager where your bank provides one.
• Use multi-factor authentication (MFA) wherever it is available.
• Never approve an MFA prompt you did not initiate. Report it, as it may mean someone has your password.
• Change your password immediately if you suspect it has been compromised.

4. Device and workspace hygiene

• Lock your screen whenever you leave your desk.
• Allow security updates to install promptly, and never disable security software.
• Install only software approved by your bank.
• Do not connect personal or unknown USB devices to bank equipment.
• Use only approved devices and secure connections for remote work, and avoid public Wi-Fi for bank business unless using approved secure access.
• Keep documents containing customer information out of sight, and dispose of them securely.
• Report lost or stolen devices immediately.

5. Reporting incidents

A security incident is any event that may compromise the confidentiality, integrity or availability of the bank's systems or information. Examples include clicking a phishing link, losing a laptop, noticing unusual system behaviour, sending data to the wrong recipient or receiving a suspicious request for information.

Report incidents immediately through your bank's designated channel, even if you are unsure or think you may have made a mistake. Early reporting allows the security team to contain the problem. Staff who report honestly and promptly should be supported, not blamed. Banks have their own obligations to notify the Central Bank of The Gambia and other authorities of significant incidents, and they depend on staff reporting early.

6. Protecting customer data

Customers trust banks with sensitive personal and financial information. Every member of staff shares responsibility for protecting it:

• Access customer information only when you need it for your work.
• Verify a caller's identity in line with procedure before discussing an account.
• Never send customer data to personal email addresses or unapproved applications.
• Check recipients carefully before sending messages that contain customer information.
• Do not discuss customer matters in public places.
• Follow your bank's rules on classifying, storing, sharing and disposing of information.

Check your understanding

1. You receive a message from a senior manager asking you to make an urgent payment outside normal procedures. What should you do?
2. Your phone shows an MFA approval request that you did not initiate. What might it mean, and what should you do?
3. You realise you have emailed a customer statement to the wrong address. What is your first step?

Key message

Security is part of every role. Stop, check and report: when something seems unusual, pause, verify through a trusted channel and report it promptly.