Most Bangladeshi Banks Lack Tested App Cyberattack Plans, BIBM Study Finds

Image: Collected

Most commercial banks in Bangladesh operate mobile banking applications without tested emergency response plans, exposing millions of digital banking customers to fraud through weak real-time monitoring and lax oversight of third-party software vendors, according to new research by the Bangladesh Institute of Bank Management (BIBM).

The findings were unveiled in Dhaka on Wednesday during a BIBM roundtable titled "Banking Apps Security in Bangladesh: Current Status and Challenges." Surveying thirty-four banks across the country, researchers found that banks largely focus on logging security breaches after the fact rather than actively intercepting live threats.

Only 31 percent of the surveyed lenders maintain documented and regularly tested incident response plans for their mobile applications, while just 44 percent monitor application programming interface (API) traffic in real time. Although 81 percent of banks keep security event logs, passive record-keeping remains far more common than proactive threat detection.

Heavy reliance on external software developers further compounds the sector's vulnerability. While 78 percent of surveyed institutions use at least one vendor-developed banking app, only 34 percent continuously monitor security risks linked to third-party APIs.

Phishing and social engineering rank as the most widespread forms of digital banking fraud, trailed closely by account takeovers and credential theft. Despite the surge in targeted attacks, only 16 percent of banks have deployed adaptive authentication—a security measure that dynamically tightens verification requirements when a transaction appears risky.

Banks attributed these defensive gaps to resource and staffing bottlenecks. Budget constraints and inadequate security tools were each cited by 47 percent of respondents, while 38 percent pointed to a shortage of qualified cybersecurity professionals. Researchers noted that the findings reflect banks' self-reported practices rather than independent audits or sector-wide estimates.

Speaking at the event as chief guest, Bangladesh Bank Deputy Governor Md Habibur Rahman underscored the urgency of fortifying cybersecurity defenses across the financial sector.

To close existing security gaps, BIBM Director General Md Ezazul Islam called on banks to conduct joint cybersecurity exercises, streamline customer fraud reporting channels, enforce stricter verification for high-risk transactions, and establish firmer accountability standards for third-party technology vendors.