Chief Information Security Officer of Union Bank of Nigeria, Francis Mojoyinola, has warned that cybercriminals are increasingly exploiting human trust, urgency and deception alongside technical vulnerabilities to defraud individuals and compromise financial institutions.
Mojoyinola said effective cybersecurity required more than improved technology and routine awareness campaigns, stressing the need for stronger institutional safeguards, prompt incident reporting and continuous customer education.
In an article marking the end of Cybersecurity Awareness Month in October, he cited the 2026 Verizon Data Breach Investigations Report, which examined more than 31,000 security incidents across 145 countries and found that human involvement featured in 62 per cent of breaches, up from 60 per cent the previous year.
He noted that attackers increasingly relied on persuading employees or customers to disclose sensitive information, open malicious links or bypass established security procedures.
Mojoyinola also cited research by the University of California, San Diego, involving more than 19,500 employees of a large health system, which found that embedded phishing training reduced the likelihood of clicking malicious links by about two per cent, while mandatory annual training showed no meaningful relationship with employees’ responses to phishing emails.
He argued that cybersecurity education must reflect the circumstances in which people encounter fraud, including workplace pressure, urgent requests and messages appearing to come from senior officials or trusted institutions.
On the Nigerian banking sector, he referenced data from the Nigeria Inter-Bank Settlement System (NIBSS), which showed that digital payment fraud losses fell by 51 per cent in 2025, from N52.26 billion in 2024 to N25.85 billion.
However, he said social engineering and insider abuse remained significant threats, citing NIBSS Chief Executive Officer, Premier Oiwoh, who had identified insider involvement as a recurring concern in fraud investigations.
According to Mojoyinola, insider-related incidents do not always involve dishonest employees, as otherwise trustworthy workers can be manipulated through impersonation, pressure or seemingly legitimate urgent requests.
He stressed that employees must be encouraged to report mistakes and suspected security breaches immediately rather than conceal them out of fear of punishment, noting that delays in reporting exposed credentials could worsen the consequences of an attack.
He also warned that customers’ banking credentials were vulnerable when shared with relatives, assistants or other trusted individuals, even where there was no intention to commit fraud.
Citing the Verizon report, he said phishing simulations showed that the median click rate for mobile channels, including voice calls and text messages, was about 40 per cent higher than for email.
He urged customers to treat urgent requests for banking information as warning signs, never disclose one-time passwords or other authentication codes, verify suspicious requests through independently obtained official channels and reject authentication prompts they did not initiate.
Mojoyinola further called on financial institutions to strengthen customer protection and respond promptly when fraud is reported, arguing that victims should not be subjected to blame or stigma that could discourage early reporting.
He said banks must recognise that their reputations could be affected when customers are defrauded, even where the initial compromise occurs outside the institution’s systems.
On institutional safeguards, he recommended stronger authentication measures, password managers, restricted access to sensitive information, additional approval checks and monitoring systems capable of detecting unusual account activity.
He said Union Bank adopted the theme, “Building a Cyber Strong Culture,” for its 2026 Cybersecurity Awareness Month campaign to emphasise that cybersecurity depended on both technological controls and the everyday behaviour of employees and customers.
Mojoyinola said a strong security culture should encourage people to question unusual requests, verify information and report suspicious activity promptly, while requiring institutions to design systems that remain resilient when human errors occur.
He maintained that employees and customers should be treated as essential participants in cybersecurity rather than the weakest links, adding that effective protection required shared responsibility between individuals and the institutions they depend on.