The Human Firewall – Why The First Line of Defence Runs in Both Directions

As security technology improves, cyber criminals increasingly combine technical weaknesses with pressure, deception and misplaced trust. They aim at people, inside an institution and outside it, and everyone must learn to recognise these attempts.

People tell me, often within a minute of learning what I do for a living, that they would never fall for a scam. They say it lightly, the way somebody might mention being a careful driver. I have come to treat that sentence as the most revealing thing a person can say to me, because the people who get caught are seldom the careless ones. They are capable, busy people who were quite certain, right up until the moment it happened, that it could not happen to them.

As we close out Cybersecurity Awareness Month this October, lots of the conversation around it focused on systems and whichever technology is currently fashionable. Technology matters, but it is only part of the answer. Criminals may exploit vulnerable systems, stolen credentials and human trust within the same incident.

The Verizon Data Breach Investigations Report for 2026, which examined more than 31,000 security incidents across 145 countries, found a human element present in 62 per cent of all breaches, up from 60 per cent the year before. Most attackers now put their effort into persuading somebody to open the door, and they have become very good at that persuasion. The locks improved, so the people became the target.

Knowing about fraud offers far less protection than most of us assume. Researchers at the University of California, San Diego, ran an eight month experiment across more than 19,500 employees of a large health system, sending ten phishing campaigns and measuring who clicked. Embedded training, the kind that appears the moment somebody fails a simulation, reduced the likelihood of clicking by around 2 per cent.

The annual mandatory training that most institutions rely on showed no meaningful relationship with whether a person fell for the email. The researchers concluded that such programmes, as they are commonly run, are unlikely to offer much practical value in reducing phishing risk.

I do not read that as a case for abandoning awareness, and I would be a peculiar person to argue it during Cybersecurity Awareness Month. I read it as a correction. Awareness teaches people what a scam looks like in a calm room, while attacks are built for the other kind of moments when you are between meetings, when the message carries the name of somebody senior, when there is a deadline and a plausible reason to hurry.

There is a further wrinkle, and I raise it carefully because it sounds like an insult and is not intended as one. Confidence is itself a risk factor. Somebody who believes they are far too alert to be deceived checks less, and talks themselves out of the small flicker of discomfort that would have saved them.

They are also slower to accept what has happened afterwards, which costs time nobody has. Several of the most security-conscious people I have met, in this industry and outside it, were caught by something quite ordinary on a day when they were busy. Ninety seconds of inattention is all an attacker needs, and the most capable among us have plenty of such seconds in a day. Any defence resting on people never being deceived is resting on very little.

The exposure inside an institution is wider than most people picture. NIBSS, the Nigeria Interbank Settlement System, reported that digital payment fraud losses in the country fell by 51 per cent in 2025, to ₦25.85 billion from ₦52.26 billion the year before. That improvement is real, and the banking industry deserves some credit for it. What sits underneath the number is less comfortable. NIBSS identified social engineering, and insider abuse in particular, as the most prevalent technique, and its chief executive, Premier Oiwoh, put it without decoration: “Insider involvement is high, and recent investigations have confirmed this.”

The word insider summons the image of a dishonest employee, and sometimes that image is accurate. Far more often, the insider in an incident is an entirely honest colleague who was tired, who was asked for something urgently by a voice claiming authority, and who did the helpful thing. The Verizon research tracks this too. Pretexting, where an attacker builds a believable scenario and a role to play inside it, accounted for 6 per cent of breaches as a route in, and is turning up more often in ransomware and extortion cases. A good pretext works by supplying a reason to believe the rules do not apply on this one occasion.

This brings me to the behaviour I value most in my own colleagues at Union Bank, and it has very little to do with avoiding mistakes given that mistakes are human. It is the speed with which somebody admits one. The hours immediately after a credential is exposed can significantly affect the scale and consequences of an incident. Where people fear blame, those hours get spent by a frightened colleague hoping the problem will quietly resolve itself. The culture decides how that goes, and the culture is set by how leadership reacts the first time somebody owns up. We have put a good deal of work into making that reaction a predictable and positive one here.

The same principle operates between institutions. Reviewing the 2025 figures, Oiwoh observed that while some institutions had reported zero incidents, a failure to report is unacceptable. An industry that hides incidents from itself learns nothing, and the fraud simply moves along to whichever bank has not yet seen it.

The most valuable credentials in banking do not sit in our systems at all. They sit with our customers. A password, a personal identification number, the code we send to a phone: these are the keys, and they live in the pockets of several million people who have jobs and distractions of their own.

Those keys are shared far more widely than our terms and conditions imagine. A great many people bank with help. An elderly parent passes a code to the son who manages her affairs. A business owner lets a trusted assistant handle the routine payments, because that is what an assistant is for. A husband and wife have always known each other’s personal identification number and think nothing of it at all. Nobody in these arrangements intends harm, and most of the time none comes of it. Each one widens the circle of people holding the keys to a single account, and an attacker needs only to find the least careful person in that circle on their least careful day.

The attack has also moved to where people actually live. The Verizon report found that in phishing simulations, the median click rate for mobile channels such as voice calls and text messages ran around 40 per cent higher than for email. In our market, that finding is no abstraction. The phone is the channel. Fraud here arrives most often as a call from somebody who already knows your name and your last transaction, delivered in a calm voice, carrying a reason you must act immediately.

Oiwoh made a second observation in the same report that has stayed with me. Awareness remains critical, he said, because many victims are still easily deceived. I want to be careful about how that is heard. When somebody is defrauded, the instinct across the industry is arguably to establish whose fault it was, and where the exposure began with the customer, to feel quietly off the hook. I have no patience for that. A person who has lost money is frightened and frequently ashamed, and shame makes people slower to report, which makes the loss larger. The first obligation is to treat the person properly and move quickly on the money. The teaching comes afterwards, and it lands a great deal better once somebody has been treated decently.

Financial institutions must also accept an unavoidable reality: when a customer is defrauded, the bank’s name will often become part of the public conversation, even where the initial compromise occurred during an interaction in which the bank had no involvement.

Educating and protecting customers is therefore not only a public service. It is a direct form of institutional protection.

If I could fix a small number of habits in every colleague and every customer, I would choose these. Treat urgency itself as the warning sign, because every serious fraud carries a reason you must act this minute, and almost nothing legitimate in banking collapses because you paused for ten of them. Never pass the code sent to your phone to another human being under any circumstance, including when the caller knows a great deal about you and sounds exactly like your bank.

Verify through a channel you chose yourself: the number printed on your card or the application already on your phone, rather than any number or link somebody has handed you. Approve no authentication prompt you did not personally begin. Tell us the moment you suspect something, well before you are certain, because certainty costs hours we cannot afford.

None of this is hard to understand, which is precisely the trouble. Simple instructions are easy to agree with and easy to forget at the one moment they matter. That is why I have stopped thinking of customer education as a campaign with a start and an end, and started treating it as maintenance, repeated patiently in plain language, through the channels people actually use, for as long as we are in business. It is the reason our own advisories go out whether or not it happens to be October.

Habits alone will not carry this, which is why the larger share of the work belongs to us rather than to our customers. The same researchers who found training wanting were clear about what they would put in its place, and it was engineering rather than more lectures. They pointed to authentication that requires a second factor, and to password managers that will release a credential only to the genuine website, so that even a convincing imitation collects nothing.

The principle runs well beyond those two measures. Build an institution in which a single human error remains survivable: access limited to what a role genuinely requires, approvals that need a second pair of eyes, monitoring that notices something unusual on an account before the customer does, and verification procedures that do not rely on a tired person recalling a rule at nine o’clock at night.

At Union Bank of Nigeria, we adopted Building a Cyber Strong Culture as our theme for this year’s Cybersecurity Awareness Month. The word “culture” was selected deliberately. Controls can be purchased and installed, but culture takes longer to build. Culture determines whether controls are used properly during an ordinary working day, when people have competing demands, full inboxes and limited time. It determines whether an employee feels able to question an unusual request from someone senior and whether a customer reports suspicious activity before a loss becomes more difficult to contain.

A cyber strong culture does not present employees or customers as the weakest links; it recognises them as essential participants in security while accepting that they are human. It encourages people to pause before acting, verify unusual requests and report concerns quickly. At the same time, it requires institutions to design controls around real human behaviour rather than an idealised person who is never tired, hurried, distracted or deceived. That is what the human firewall means in practice. It is not a demand for perfect vigilance, but a shared system of habits, technology, institutional safeguards and trust.

Our security systems will continue to improve, and criminals will continue to look for ways around them. One of the strongest controls an institution can have is a colleague willing to report immediately that something may have gone wrong, and a customer who calls while suspicious activity is still unfolding rather than long afterwards. People are part of the first line of defence, but the institutions they depend on must also be ready to defend them.

Francis Mojoyinola is the Chief Information Security Officer at Union Bank. He leads the bank’s cybersecurity strategy, information security governance, and data protection operations, ensuring the confidentiality, integrity, and availability of its digital assets.

He has over two decades of experience spanning information technology, risk management, and financial control across the Nigerian banking industry. His work focuses on building resilient systems, developing threat detection and response frameworks and ensuring regulatory and ISO-standard compliance.

Before his current role, Francis held senior positions in IT governance, cybersecurity, and audit functions within the financial sector. He has contributed to strengthening the Bank’s risk posture and aligning its digital operations with global security standards.

Francis is a Fellow of the Institute of Chartered Accountants of Nigeria (FCA), an Honorary Senior Member of the Chartered Institute of Bankers of Nigeria (HCIB), a Certified Information Security Manager (CISM), and a graduate of Obafemi Awolowo University, Ile-Ife.