The Human Firewall – Why the First Line of Defence Runs in Both Directions

As security technology improves, cybercriminals increasingly combine technical weaknesses with pressure, deception and misplaced trust. They target people, both inside and outside institutions, and everyone must learn to recognise these attempts.

By Francis Mojoyinola | Chief Information Security Officer, Union Bank of Nigeria

People often tell me, sometimes within a minute of learning what I do for a living, that they would never fall for a scam. They say it lightly, the way somebody might mention being a careful driver. I have come to regard that statement as one of the most revealing things a person can say to me because the people who get caught are seldom careless. They are capable, busy people who are quite certain, right up until the moment it happens, that it could never happen to them.

As we close out Cybersecurity Awareness Month this October, much of the conversation has focused on systems and whichever technology is currently fashionable. Technology matters, but it is only part of the answer. Criminals may exploit vulnerable systems, stolen credentials and human trust within the same incident.

Why the attacks have shifted to people

The Verizon Data Breach Investigations Report for 2026, which examined more than 31,000 security incidents across 145 countries, found that a human element was present in 62 per cent of all breaches, up from 60 per cent the previous year. Most attackers now focus their efforts on persuading somebody to open the door, and they have become very good at that persuasion. The locks have improved, so people have become the target.

What does awareness actually achieve?

Knowing about fraud offers far less protection than most of us assume. Researchers at the University of California, San Diego, conducted an eight-month experiment involving more than 19,500 employees of a large health system. They sent ten phishing campaigns and measured how many people clicked on the links. Embedded training, the kind that appears immediately after somebody fails a simulation, reduced the likelihood of clicking by around 2 per cent. The annual mandatory training that most institutions rely on showed no meaningful relationship with whether an individual fell for a phishing email. The researchers concluded that such programmes, as they are commonly implemented, are unlikely to offer much practical value in reducing phishing risks.

I do not interpret this as an argument for abandoning awareness, and I would be a peculiar person to make such an argument during Cybersecurity Awareness Month. Rather, I see it as a necessary correction. Awareness teaches people what a scam looks like in a calm environment, whereas attacks are designed for different kinds of moments: when you are between meetings, when a message carries the name of somebody senior, or when there is a deadline and a plausible reason to hurry.

There is a further complication, and I raise it carefully because it may sound like an insult, although that is not my intention. Confidence is itself a risk factor. Someone who believes they are far too alert to be deceived is less likely to check and may even talk themselves out of the slight feeling of discomfort that could have saved them. They are also slower to accept what has happened afterwards, costing valuable time.

Several of the most security-conscious people I have met, both within and outside this industry, have fallen victim to quite ordinary scams on days when they were busy. Ninety seconds of inattention is all an attacker needs, and even the most capable among us have plenty of such moments in a day. Any defence that relies on people never being deceived is built on a very weak foundation.

Inside an institution

The exposure within an institution is wider than most people imagine. The Nigeria Inter-Bank Settlement System (NIBSS) reported that digital payment fraud losses in the country fell by 51 per cent in 2025, from ₦52.26 billion to ₦25.85 billion the previous year. That improvement is real, and the banking industry deserves some credit for it. However, what lies beneath the figures is less reassuring.

NIBSS identified social engineering and insider abuse in particular as the most prevalent techniques. Its Chief Executive Officer, Premier Oiwoh, put it plainly: “Insider involvement is high, and recent investigations have confirmed this.”

The word ‘insider’ often brings to mind a dishonest employee, and sometimes that image is accurate. Far more often, however, the insider involved in an incident is an entirely honest colleague who is tired, receives an urgent request from someone claiming authority and simply tries to be helpful.

The Verizon research also tracks this trend. Pretexting, in which an attacker creates a believable scenario and assumes a role to gain someone’s trust, accounted for 6 per cent of breaches as an entry route and is appearing more frequently in ransomware and extortion cases. An effective pretext works by providing a seemingly legitimate reason to believe that the rules do not apply on that particular occasion.

This brings me to the behaviour I value most among my colleagues at Union Bank. It has very little to do with avoiding mistakes, given that mistakes are human. Rather, it is the speed with which someone admits to making one.

The hours immediately after a credential has been exposed can significantly influence the scale and consequences of an incident. Where people fear blame, those hours are often wasted as a frightened colleague hopes the problem will quietly resolve itself. Organisational culture determines how such situations unfold, and that culture is shaped by how leadership reacts when someone first admits to an error. We have invested considerable effort in ensuring that such reactions are predictable and positive here.

The same principle applies between institutions. Reviewing the 2025 figures, Oiwoh observed that although some institutions had reported zero incidents, failure to report incidents was unacceptable. An industry that conceals incidents from itself learns nothing, and fraud simply moves to whichever bank has not yet encountered it.

Beyond the walls of an institution

The most valuable credentials in banking do not reside in our systems at all. They are held by our customers. Passwords, personal identification numbers (PINs) and the codes we send to mobile phones are the keys, and they are kept by millions of people who have jobs and other distractions.

Those keys are shared far more widely than our terms and conditions might suggest. Many people bank with assistance. An elderly parent may share a code with the son who manages her affairs. A business owner may allow a trusted assistant to handle routine payments because that is part of the assistant’s responsibility. A husband and wife may have known each other’s PINs for years and think nothing of it. Nobody in these arrangements intends any harm, and most of the time, none occurs.

However, each arrangement widens the circle of people with access to the keys to a single account. An attacker needs only to find the least careful person in that circle on their least careful day.

The attacks have also shifted to the channels people use most. The Verizon report found that, in phishing simulations, the median click rate for mobile channels, such as voice calls and text messages, was around 40 per cent higher than for email. In our market, that finding is no abstraction. The phone is the primary channel. Fraud often arrives through a call from someone who already knows your name and your last transaction. It is delivered in a calm voice and accompanied by a convincing reason why you must act immediately.

Oiwoh made a second observation in the same report that has stayed with me. He said awareness remains critical because many victims are still easily deceived. I want to be careful about how that statement is interpreted.

When somebody is defrauded, the instinct across the industry is often to establish whose fault it was. Where the exposure originated with the customer, there may be a tendency to feel that the institution is quietly off the hook. I have no patience for that attitude.

A person who has lost money is frightened and frequently ashamed. Shame makes people slower to report incidents, which can increase the loss. The first obligation is to treat the affected person properly and act quickly to recover or secure the money. Education should come afterwards, and it is far more effective once the individual has been treated with dignity and respect.

Financial institutions must also accept an unavoidable reality: when a customer is defrauded, the bank’s name will often become part of the public conversation, even when the initial compromise occurred during an interaction in which the bank had no involvement.

Educating and protecting customers is therefore not merely a public service. It is also a direct form of institutional protection.

The habits that matter

If I could change a few habits among every colleague and customer, I would choose the following:

Treat urgency itself as a warning sign. Every serious fraud attempt comes with a reason why you must act immediately, yet almost nothing legitimate in banking will collapse simply because you took ten minutes to verify a request.

Never share the code sent to your phone with another person under any circumstances, even when the caller knows a great deal about you and sounds exactly like someone from your bank.

Verify requests through a channel you have independently chosen, such as the telephone number printed on your bank card or the official application already installed on your phone, rather than using a number or link supplied by someone else.

Never approve an authentication prompt that you did not personally initiate.

Report any suspicious activity as soon as you notice it, even before you are certain that something has gone wrong. Waiting for certainty can cost us valuable time.

None of these instructions is difficult to understand, which is precisely the problem. Simple instructions are easy to agree with and equally easy to forget at the very moment they matter.

That is why I have stopped thinking of customer education as a campaign with a beginning and an end. Instead, I regard it as an ongoing responsibility that requires patient repetition in plain language through the channels people actually use, for as long as we remain in business. It is also why our security advisories go out regardless of whether it happens to be October.

Building a cyber-strong culture

Habits alone will not be enough to address these challenges, which is why a greater share of the responsibility rests with us rather than our customers.

The same researchers who found conventional training ineffective were clear about what they would recommend in its place: better security engineering rather than more lectures. They highlighted the importance of multi-factor authentication and password managers that release credentials only to genuine websites, ensuring that even convincing imitations cannot collect them.

The principle extends well beyond these two measures. Institutions must build systems in which a single human error does not become a major security incident. This requires restricting access to what each employee genuinely needs to perform their role, introducing approval processes that require a second pair of eyes, deploying monitoring systems capable of detecting unusual account activity before customers notice it, and establishing verification procedures that do not depend on a tired employee remembering a rule at nine o’clock at night.

At Union Bank of Nigeria, we adopted Building a Cyber-Strong Culture as our theme for this year’s Cybersecurity Awareness Month. The word ‘culture’ was chosen deliberately. Controls can be purchased and installed, but culture takes longer to build.

Culture determines whether controls are properly applied during an ordinary working day, when people have competing demands, crowded inboxes and limited time. It determines whether an employee feels comfortable questioning an unusual request from someone senior and whether a customer reports suspicious activity before a loss becomes more difficult to contain.

A cyber-strong culture does not portray employees or customers as the weakest links. Instead, it recognises them as essential participants in security while acknowledging that they are human. It encourages people to pause before acting, verify unusual requests and report concerns promptly.

At the same time, it requires institutions to design controls around real human behaviour rather than an idealised individual who is never tired, hurried, distracted or deceived.

That is what the human firewall means in practice. It is not a demand for perfect vigilance but a shared system of habits, technology, institutional safeguards and trust.

Our security systems will continue to improve, and criminals will continue to look for ways around them. One of the strongest controls an institution can have is a colleague who is willing to report immediately that something may have gone wrong, alongside a customer who calls while suspicious activity is still unfolding rather than long afterwards.

People are part of the first line of defence, but the institutions they depend on must also be ready to defend them.

About the author

Francis Mojoyinola is the Chief Information Security Officer at Union Bank. He leads the bank’s cybersecurity strategy, information security governance and data protection operations, ensuring the confidentiality, integrity and availability of its digital assets.

He has more than two decades of experience spanning information technology, risk management and financial control across the Nigerian banking industry. His work focuses on building resilient systems, developing threat detection and response frameworks, and ensuring compliance with regulatory requirements and ISO standards.

Before assuming his current role, Francis held senior positions in IT governance, cybersecurity and audit functions within the financial sector. He has contributed to strengthening the bank’s risk posture and aligning its digital operations with global security standards.

Francis is a Fellow of the Institute of Chartered Accountants of Nigeria (FCA), an Honorary Senior Member of the Chartered Institute of Bankers of Nigeria (HCIB), a Certified Information Security Manager (CISM) and a graduate of Obafemi Awolowo University, Ile-Ife.