Cyber Risk

Why Phishing Still Works on Ugandan Banks and Fintechs

A well defended network is still entered through a valid login, using a password the owner supplied willingly.

Topic

Banking security

Focus

Phishing and email compromise

Published

Author

Phone and payment terminal illustrating phishing risk for banks

Why phishing still works on banks and fintechs

Banks and fintechs in the region have spent heavily on perimeter tools and very little on the people clicking the links. The result is a well defended network entered through a valid login, using a password the owner supplied willingly.

Attackers no longer send the obvious message full of errors. They send a payment approval notice at month end, an HR memo during salary week, or a supplier invoice from a domain that differs by a single character.

Business email compromise is the expensive one

The costly attacks are not mass phishing runs. They are targeted. An attacker sits quietly inside a mailbox for weeks, learns how your institution phrases payment instructions, notes who approves what, then intervenes in a real thread at exactly the right moment. By the time anyone notices, the funds have already moved through several accounts.

What actually changes staff behavior

Annual slide decks do not change behavior. Repeated, short, sector specific exposure does. Staff should see simulated messages built from real attacks on institutions like theirs, then receive immediate feedback at the moment they click rather than in a report three weeks later.

The second change is cultural. Staff must be able to report a suspicious message, and an actual mistake, without fear of blame. Institutions that punish reporting simply stop hearing about incidents. They do not stop having them.

Controls in this checklist

Verify payment changes by phone

Enforce multi factor authentication

Flag external senders in email

Run phishing simulations monthly

Reward reporting, never punish it

Review mailbox forwarding rules