Culture news and discussion on TalkFuse.
Charity bank pulls online services over third-party software flaw
CAF Bank, which provides banking services to around 14,000 charities, has suspended its online banking platform after discovering a security vulnerability in how third-party software connects to its portal. The shutdown has left some charities unable to access their accounts, causing difficulties for organisations trying to process time-sensitive payments such as payroll.
Online services have been unavailable since 24 July and will remain so until the bank is confident the issue has been safely resolved; it is working with a technology partner and external experts on a fix. The bank says the vulnerability was flagged after reports of suspicious activity on some customer accounts, but that core banking systems and customer funds are unaffected, and any attempted fraud has been reported to those involved. CEO Alison Taylor apologised for the disruption, said phone support remains available with payroll payments prioritised, and declined to say whether customers would be compensated. CAF Bank, part of the Charities Aid Foundation, held £1.45 billion in customer deposits at the end of its 2024/25 financial year, and previously faced criticism last year over problems following the launch of a new banking platform.
In short
- CAF Bank suspended online services over a third-party software flaw
- 14,000 charity customers affected; some struggling to run payroll
- Bank says funds are safe; phone support prioritises urgent payments
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The bank properly prioritised security by immediately suspending online services upon discovering a genuine vulnerability, as allowing financial systems to remain exposed whilst potentially compromised could cause far greater harm to 14,000 charities and £1.45 billion in customer deposits. Whilst the outage creates real disruption, financial institutions must not compromise on customer asset protection, and the bank has mitigated impact through maintained phone support with prioritised payroll processing. Moving cautiously with external expertise to properly resolve the vulnerability before restoring access is the responsible approach, even when it creates temporary inconvenience.
The case against
This incident reveals systemic failures in the bank's technology governance rather than representing a necessary security-versus-service trade-off, particularly given it is the second major platform crisis within twelve months. A properly managed financial institution should have caught third-party software vulnerabilities through robust quality assurance before they affected customers, and the extended outage since July suggests inadequate contingency planning or an inappropriately slow remediation process. The bank's refusal to discuss compensation whilst charities face genuine financial difficulties managing payroll and beneficiary payments compounds frustration with what appears to be preventable institutional negligence rather than unavoidable circumstance.
Explained simply
CAF Bank is a specialist financial institution that provides banking services to thousands of charities across the UK. These organisations rely on it to manage their money, process payments and handle payroll for their staff, making the bank an essential part of the infrastructure that allows charities to operate.
The bank has encountered a security problem in the third-party software that connects to its online platform, which charities use to access their accounts. This vulnerability prompted the bank to temporarily shut down its online services to prevent potential fraud, though the bank says customer funds and its core systems remain secure.
For many charities, losing access to online banking has created operational difficulties, particularly for organisations that need to pay staff or process urgent payments. The bank has maintained phone support to help charities with essential transactions whilst it works to fix the underlying security issue.
Art Culture Software Technology