As cyber threats become increasingly sophisticated, Union Bank of Nigeria’s Chief Information Security Officer, Francis Mojoyinola, has called for stronger cybersecurity awareness, responsible digital behaviour and improved institutional safeguards, stressing that people remain a critical line of defence against cybercrime.
In an article examining the growing threat of social engineering and digital fraud, Mojoyinola explained that cybercriminals increasingly exploit human trust, psychological pressure and misplaced confidence alongside technical vulnerabilities to gain access to sensitive information and financial assets.
Titled “The Human Firewall – Why The First Line of Defence Runs in Both Directions,” the article highlights the shared responsibility of financial institutions, employees and customers in preventing cyberattacks and reducing financial losses.
Reflecting on the recently concluded Cybersecurity Awareness Month in October, Mojoyinola noted that while technological security systems remain essential, they cannot independently eliminate cyber risks because criminals increasingly target the people who interact with those systems.
Citing the 2026 Verizon Data Breach Investigations Report, which examined more than 31,000 security incidents across 145 countries, he disclosed that human involvement was identified in 62 per cent of data breaches, compared with 60 per cent in the previous year.
He observed that cybercriminals have increasingly shifted their attention towards manipulating individuals into opening the door to institutional systems, even as technological security measures continue to improve.
On the effectiveness of cybersecurity awareness programmes, the Union Bank executive referenced an eight-month research experiment involving more than 19,500 employees of a large health system in the United States.
According to him, the research found that conventional mandatory annual cybersecurity training had no meaningful relationship with employees’ likelihood of falling for phishing emails, while embedded training produced only a modest reduction in clicking behaviour.
He argued that cybersecurity education must therefore go beyond routine training sessions and focus on practical interventions that prepare people to recognise suspicious activities in real-life situations.
Mojoyinola also cautioned against excessive confidence, explaining that individuals who believe they are too knowledgeable or security-conscious to fall victim to scams may become less vigilant and more reluctant to question suspicious requests.
INSIDER THREATS AND INSTITUTIONAL RESPONSIBILITY
Addressing cybersecurity risks within financial institutions, Mojoyinola cited data from the Nigeria Inter-Bank Settlement System (NIBSS), which indicated that digital payment fraud losses in Nigeria declined by 51 per cent in 2025, from ₦52.26 billion to ₦25.85 billion.
While acknowledging the improvement, he noted that social engineering and insider abuse remained significant concerns, quoting NIBSS Chief Executive Officer, Premier Oiwoh, as saying that insider involvement was high and had been confirmed by recent investigations.
He explained that insider-related fraud does not always involve dishonest employees, as genuine staff members can also become victims of manipulation, particularly when pressured by individuals impersonating senior officials or making urgent requests.
The Union Bank executive emphasised the importance of creating an institutional culture where employees can promptly report mistakes, suspicious activities and compromised credentials without fear of automatic blame or punishment.
According to him, the speed with which an employee reports a security incident can significantly influence the scale of the damage and the institution’s ability to respond effectively.
He also called for greater transparency and cooperation among financial institutions, stressing that failure to report fraud incidents prevents the banking industry from identifying emerging threats and developing effective collective responses.
CUSTOMERS ALSO HAVE A ROLE TO PLAY
Beyond institutional systems, Mojoyinola identified customers as another critical component of the cybersecurity defence structure, noting that passwords, personal identification numbers and one-time passwords remain valuable targets for fraudsters.
He observed that many customers routinely share banking credentials with relatives, spouses, assistants and other trusted individuals to facilitate financial transactions.
Although such arrangements may be motivated by convenience and trust, he warned that they increase the number of people with access to sensitive account information and create additional opportunities for cybercriminals.
He further highlighted the growing use of telephone calls and text messages in executing phishing attacks, noting that mobile channels are increasingly exploited because of their direct connection to people’s everyday activities.
According to the 2026 Verizon report, phishing simulations recorded a median click rate for mobile channels, including voice calls and text messages, approximately 40 per cent higher than email.
Mojoyinola therefore urged customers to remain cautious when receiving unsolicited calls or messages requesting sensitive banking information, particularly where the caller creates an artificial sense of urgency.
He also stressed that financial institutions must treat defrauded customers with empathy and respond swiftly to suspected fraud incidents rather than focusing immediately on assigning blame.
He maintained that customer education and protection are not merely public service responsibilities but also important measures for protecting the reputation and integrity of financial institutions.
PRACTICAL STEPS TO PREVENT DIGITAL FRAUD
To strengthen personal and institutional cybersecurity, Mojoyinola outlined several practical measures employees and customers should adopt.
These include treating urgent financial requests with suspicion, never sharing one-time passwords or authentication codes with anyone, independently verifying unusual requests through trusted channels and rejecting authentication prompts that they did not personally initiate.
He also encouraged customers to report suspicious activities immediately, even when they are not completely certain that fraud has occurred.
He explained that early reporting gives financial institutions a better opportunity to investigate suspicious transactions, contain potential losses and prevent further compromise.
BUILDING A CYBER-STRONG CULTURE
Mojoyinola further advocated stronger investment in cybersecurity infrastructure and institutional controls, arguing that organisations must design systems capable of withstanding human errors.
Among the recommended measures are multi-factor authentication, password managers, restricted access based on employees’ responsibilities, additional approval requirements for sensitive transactions and continuous monitoring of unusual account activities.
He disclosed that Union Bank of Nigeria adopted “Building a Cyber Strong Culture” as its theme for the 2026 Cybersecurity Awareness Month, emphasising that cybersecurity must become an integral part of everyday institutional operations.
According to him, while security controls can be purchased and installed, building a sustainable cybersecurity culture requires time, commitment and consistent leadership.
He explained that such a culture encourages employees to question unusual instructions, report suspicious activities and follow established security procedures, while customers are encouraged to remain vigilant and protect their financial credentials.
Mojoyinola maintained that employees and customers should not be regarded as the weakest links in cybersecurity but as essential participants in protecting financial systems.
He concluded that effective cybersecurity requires a combination of technology, responsible human behaviour, institutional safeguards and mutual trust.
He stressed that the strongest defence is not a system that assumes people will never make mistakes, but one that enables employees and customers to recognise threats, report incidents promptly and receive the necessary support when something goes wrong.
ABOUT THE AUTHOR
Francis Mojoyinola is the Chief Information Security Officer at Union Bank of Nigeria, where he leads the bank’s cybersecurity strategy, information security governance and data protection operations.
He has over two decades of experience spanning information technology, risk management and financial control within Nigeria’s banking industry.
His professional focus includes developing resilient systems, strengthening threat detection and response frameworks, and ensuring regulatory and ISO-standard compliance.
Before his current position, he held senior roles in IT governance, cybersecurity and audit functions within the financial sector.
Mojoyinola is a Fellow of the Institute of Chartered Accountants of Nigeria (FCA), an Honorary Senior Member of the Chartered Institute of Bankers of Nigeria (HCIB), and a Certified Information Security Manager (CISM).
He is a graduate of Obafemi Awolowo University, Ile-Ife.
By Francis Mojoyinola, Chief Information Security Officer, Union Bank of Nigeria
