The Human Firewall: Why Cyber Defence Starts and Ends With People – Union Bank CISO

Francis Mojoyinola

People tell me within a minute of learning what I do for a living that they would never fall for a scam. They say it lightly, the way somebody might mention being a careful driver. I have come to treat that sentence as the most revealing thing a person can say to me, because the people who get caught are seldom the careless ones. They are capable, busy people who were quite certain right up until the moment it happened that it could not happen to them.

As we close out Cybersecurity Awareness Month this October, a lot of conversation has focused on systems and fashionable technology. Technology matters, but it is only part of the answer. Criminals may exploit vulnerable systems, stolen credentials and human trust within the same incident.

By Francis Mojoyinola, Chief Information Security Officer, Union Bank of Nigeria

Why attacks moved to people

The Verizon Data Breach Investigations Report for 2026 examined more than 31,000 security incidents across 145 countries and found a human element present in 62 percent of all breaches, up from 60 percent the year before. Most attackers now put their effort into persuading somebody to open the door, and they have become very good at that persuasion. The locks improved, so people became the target.

What awareness actually buys

Knowing about fraud offers far less protection than most of us assume. Researchers at the University of California, San Diego ran an eight month experiment across more than 19,500 employees of a large health system, sending ten phishing campaigns and measuring who clicked. Embedded training that appears the moment somebody fails a simulation reduced the likelihood of clicking by around 2 percent. Annual mandatory training showed no meaningful relationship with whether a person fell for the email. The researchers concluded that such programmes as commonly run are unlikely to offer much practical value in reducing phishing risk.

This is not a case for abandoning awareness. It is a correction. Awareness teaches people what a scam looks like in a calm room while attacks are built for other moments when you are between meetings, when the message carries the name of somebody senior, when there is a deadline and a plausible reason to hurry.

Confidence is itself a risk factor. Somebody who believes they are far too alert to be deceived checks less and talks themselves out of the small flicker of discomfort that would have saved them. They are also slower to accept what has happened afterwards, which costs time nobody has. Several of the most security conscious people I have met were caught by something quite ordinary on a day when they were busy. Ninety seconds of inattention is all an attacker needs.

Inside an institution

The exposure inside an institution is wider than most people picture. NIBSS, the Nigeria Interbank Settlement System, reported that digital payment fraud losses in the country fell by 51 percent in 2025 to 25.85 billion naira from 52.26 billion naira the year before. That improvement is real and the banking industry deserves some credit.

What sits underneath the number is less comfortable. NIBSS identified social engineering and insider abuse in particular as the most prevalent technique. Its chief executive, Premier Oiwoh, said insider involvement is high and recent investigations have confirmed this.

The word insider summons the image of a dishonest employee and sometimes that is accurate. Far more often, the insider is an entirely honest colleague who was tired, who was asked for something urgently by a voice claiming authority, and who did the helpful thing. The Verizon research tracks this too. Pretexting where an attacker builds a believable scenario and a role to play inside it accounted for 6 percent of breaches as a route in and is turning up more often in ransomware and extortion cases. A good pretext works by supplying a reason to believe the rules do not apply on this one occasion.

The behaviour I value most in my colleagues at Union Bank has very little to do with avoiding mistakes given that mistakes are human. It is the speed with which somebody admits one. The hours immediately after a credential is exposed can significantly affect the scale and consequences of an incident. Where people fear blame, those hours get spent by a frightened colleague hoping the problem will quietly resolve itself. The culture decides how that goes and the culture is set by how leadership reacts the first time somebody owns up.

The same principle operates between institutions. Reviewing the 2025 figures, Oiwoh observed that while some institutions had reported zero incidents, a failure to report is unacceptable. An industry that hides incidents from itself learns nothing and the fraud simply moves along to whichever bank has not yet seen it.

Beyond the walls of an institution

The most valuable credentials in banking do not sit in our systems at all. They sit with our customers. A password, a personal identification number, the code we send to a phone: these are the keys and they live in the pockets of several million people who have jobs and distractions of their own.

Those keys are shared far more widely than terms and conditions imagine. Many people bank with help. An elderly parent passes a code to the son who manages her affairs. A business owner lets a trusted assistant handle routine payments. A husband and wife have always known each other’s personal identification number. Nobody in these arrangements intends harm and most of the time none comes of it. Each one widens the circle of people holding keys to a single account and an attacker needs only to find the least careful person in that circle on their least careful day.

The attack has also moved to where people actually live. The Verizon report found that in phishing simulations, the median click rate for mobile channels such as voice calls and text messages ran around 40 percent higher than for email. In our market, that finding is no abstraction. The phone is the channel. Fraud here arrives most often as a call from somebody who already knows your name and your last transaction, delivered in a calm voice carrying a reason you must act immediately.

Oiwoh made a second observation that awareness remains critical because many victims are still easily deceived. When somebody is defrauded, the instinct across the industry is arguably to establish whose fault it was and where exposure began with the customer to feel quietly off the hook. A person who has lost money is frightened and frequently ashamed and shame makes people slower to report which makes the loss larger. The first obligation is to treat the person properly and move quickly on the money. The teaching comes afterwards and it lands a great deal better once somebody has been treated decently.

Financial institutions must also accept an unavoidable reality: when a customer is defrauded, the bank’s name will often become part of the public conversation even where the initial compromise occurred during an interaction in which the bank had no involvement. Educating and protecting customers is therefore not only a public service. It is a direct form of institutional protection.

The habits that matter

If I could fix a small number of habits in every colleague and every customer, I would choose these. Treat urgency itself as the warning sign because every serious fraud carries a reason you must act this minute and almost nothing legitimate in banking collapses because you paused for ten of them. Never pass the code sent to your phone to another human being under any circumstance including when the caller knows a great deal about you and sounds exactly like your bank. Verify through a channel you chose yourself, the number printed on your card or the application already on your phone, rather than any number or link somebody has handed you. Approve no authentication prompt you did not personally begin. Tell us the moment you suspect something well before you are certain because certainty costs hours we cannot afford.

None of this is hard to understand which is precisely the trouble. Simple instructions are easy to agree with and easy to forget at the one moment they matter. That is why I have stopped thinking of customer education as a campaign with a start and an end and started treating it as maintenance repeated patiently in plain language through the channels people actually use for as long as we are in business.

Building a cyber strong culture

Habits alone will not carry this which is why the larger share of work belongs to us rather than to our customers. The same researchers who found training wanting were clear about what they would put in its place and it was engineering rather than more lectures. They pointed to authentication that requires a second factor and to password managers that will release a credential only to the genuine website so that even a convincing imitation collects nothing. The principle runs well beyond those two measures. Build an institution in which a single human error remains survivable: access limited to what a role genuinely requires, approvals that need a second pair of eyes, monitoring that notices something unusual on an account before the customer does and verification procedures that do not rely on a tired person recalling a rule at nine o’clock at night.

At Union Bank of Nigeria, we adopted Building a Cyber Strong Culture as our theme for this year’s Cybersecurity Awareness Month. The word culture was selected deliberately. Controls can be purchased and installed but culture takes longer to build. Culture determines whether controls are used properly during an ordinary working day when people have competing demands, full inboxes and limited time. It determines whether an employee feels able to question an unusual request from someone senior and whether a customer reports suspicious activity before a loss becomes more difficult to contain.

A cyber strong culture does not present employees or customers as the weakest links, it recognises them as essential participants in security while accepting that they are human. It encourages people to pause before acting, verify unusual requests and report concerns quickly. At the same time, it requires institutions to design controls around real human behaviour rather than an idealised person who is never tired, hurried, distracted or deceived. That is what the human firewall means in practice. It is not a demand for perfect vigilance but a shared system of habits, technology, institutional safeguards and trust.

Our security systems will continue to improve and criminals will continue to look for ways around them. One of the strongest controls an institution can have is a colleague willing to report immediately that something may have gone wrong and a customer who calls while suspicious activity is still unfolding rather than long afterwards. People are part of the first line of defence but the institutions they depend on must also be ready to defend them.

About the author

Francis Mojoyinola is the Chief Information Security Officer at Union Bank. He leads the bank’s cybersecurity strategy, information security governance and data protection operations ensuring confidentiality, integrity and availability of its digital assets.

He has over two decades of experience spanning information technology, risk management and financial control across Nigerian banking industry. His work focuses on building resilient systems, developing threat detection and response frameworks and ensuring regulatory and ISO standard compliance.

Before his current role, Francis held senior positions in IT governance, cybersecurity and audit functions within financial sector. He has contributed to strengthening the bank’s risk posture and aligning its digital operations with global security standards.

Francis is a Fellow of the Institute of Chartered Accountants of Nigeria, an Honorary Senior Member of the Chartered Institute of Bankers of Nigeria, a Certified Information Security Manager and a graduate of Obafemi Awolowo University, Ile-Ife.