Disclaimer

I have filed a case with the Office of the Arbiter for Financial Services. I am legally not allowed to comment on this case.

BNF Bank was responsibly alerted to the security points raised in this article 6 weeks prior to publication.

Not yet back to normal

In March, BNF Bank (Malta) upgraded their IT system and the process went completely wrong. Even though initially the Bank attempted to minimize how wrong the upgrade had gone, today it admits there are problems as evidenced by their customer support pre-recorded messaging (taken 22 July 2025).

Following the publication of my first story, I've been contacted by several people who described the chaotic period that ensued when everything began to go wrong. Internal communication was in meltdown, with customer-facing employees uncertain about how to handle a situation no one had anticipated.

Based on my understanding of events, I speculate that the bank lacked a proper fallback plan specifying the point at which the upgrade would be abandoned and the old system reactivated. It resembles a train heading toward the end of the tracks with no ability to reverse course and return to its starting point.

One can only hope that the complete silence from the Maltese Financial Services Authority (MFSA) stems from their ongoing investigation of the matter, and that they will make their findings public in due course.

Security misunderstood

Poor security poses a grave risk in today’s world, where every individual and device can be a hacker’s target. Financial institutions—because they hold vast sums of money—are especially attractive. Highly specialized groups, including state‑sponsored actors, constantly seek new victims and vulnerabilities. Although reprehensible, this illicit industry generates billions of dollars in annual profits. The examples below highlight flaws in BNF’s mobile app.

Recent cybersecurity studies reveal that over 90 percent of cyberthreats in 2024 stemmed from social engineering, rendering banks with flaws such as the ones described here particularly exposed to attacks.

False Upgrade Alert

Security researchers have documented how attackers create fake or cloned applications that mimic legitimate banking apps to steal user credentials, frequently tricking users through phishing schemes. BNF’s confusing upgrade prompts provide the perfect social engineering opportunity for such attacks.

This popup appeared when users logged into their mobile app, even when they were running the latest version. Since the majority of people use automatic app updates, this unnecessary warning would likely cause confusion. As the app owner, BNF Bank should only display such warnings when the version on the device is actually outdated. At the time of writing, subsequent versions of BNF’s mobile app still display similar text at the bottom of the login screen, again without verifying whether the app is the latest version.

A Hacker’s Perspective

A malicious actor would love institutions like BNF Bank because their actions make attacks easier and much more rewarding. It would be simple to socially engineer targets by exploiting the misleading prompts on the bank’s own app.

Cybersecurity experts warn that fake banking apps are commonly “distributed through unofficial app stores or phishing websites” to trick users into sharing their login credentials and sensitive financial information. The vulnerability BNF has created makes these attacks significantly easier to execute.

My attack script would play out along these lines:

“Good morning/afternoon. I’m calling about a security notice on your mobile app that you may have ignored.”

“I want to assure you that I will not be asking for any passwords or personal information.”

“Please open your app, and you will see that we have been showing you a notice to upgrade. Let me help you with that process.”

(The goal is to convince the victim to install a fake app. While “helping” them log in, the attacker steals their credentials, takes over their account, and transfers their funds).

Target hacked.

Incorrect Instructions

The image below shows a section of the letter accompanying a new credit card, which explains how to activate it.

However, the instructions for activating the card via the eBNF Mobile App are incorrect. At the time I activated my card, it was not possible to do so using the app. This was later confirmed by the bank’s personnel.

The attacker would contact a potential victim and they wouldn’t have to invent a story from scratch; they would simply refer to the real (but misleading) notification from the bank.

Conclusion

My first article prompted a number of people to get in touch, and I’m grateful to those who shared their thoughts. One reader shared an example of user-hostile design that is too perfect not to share.

On BNF’s mobile app, setting card limits cannot be done by typing a number. Users must tap a spinner button, which adjusts the limit by €50 with each tap. Holding the button doesn’t speed it up. The reader wanted to lower their purchase limit from €40,000 to €1,000, a task which required them to tap the button almost 800 times. This is the kind of design failure that needs to be seen to be believed.

If you’ve encountered something similar or have more to discuss on this topic, get in touch (and don’t use company equipment to do so!!).