CAF Bank reopens online service but warns of further outages
CAF Bank has restored its online banking service after shutting it down for more than ten days following what it described as "attempted fraud", though it has warned customers that further intermittent outages are likely as it manages traffic to the site. The disruption is the latest blow to the Charities Aid Foundation-owned bank, which serves small charities and was already facing criticism over a troubled platform migration last year, leaving customers worried about their ability to pay staff and suppliers during the outage.
The bank said it first spotted "attempted fraudulent activity" on 21 July affecting a small number of accounts, prompting it to pull online access on 22 and 24 July while it investigated with external specialists. On 25 July it detected further "malicious activity" aimed at disabling some individual logins, tracing the cause to a previously unknown vulnerability in how third-party software connects to its online banking portal; it stressed that core banking funds were never at risk. CAF Bank is waiving its £5 monthly account charge for August and September as an apology, with CEO Alison Taylor acknowledging the "frustrating experience" and lengthy phone-support delays while the investigation continues.
In short
- CAF Bank restores online banking after 10+ days offline due to fraud attempt
- Vulnerability found in third-party software linking to banking portal
- Bank waives £5 monthly fee for August and September as apology
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The bank's security-first response was justified given the severity of the threat. A previously unknown vulnerability had enabled malicious actors to target specific accounts and attempt to disable logins, representing a genuine risk to the banking system. Thorough investigation and careful remediation of such vulnerabilities, even if time-consuming, reflects responsible stewardship of customer funds. The bank demonstrated good faith by confirming that core funds were never at risk and reopening only once confident in the fix, whilst fee waivers and support acknowledgement show recognition of customer impact.
The case against
The 10-day disruption was disproportionately severe for small charities with critical operational needs. A more granular response—restoring services to unaffected accounts whilst investigating the vulnerability—would have minimised genuine hardship to organisations struggling to meet payroll and supplier obligations. The bank's phased closures and current warnings of further outages suggest the initial remediation was inadequate, raising questions about resource allocation and planning. The compensation offered—a £10 fee waiver—appears modest relative to the documented operational crisis customers endured.
Explained simply
CAF Bank is part of the Charities Aid Foundation, which supports charitable giving and provides banking services to small charities. These organisations use their accounts to manage day-to-day payments, including wages and bills to suppliers.
The bank has previously faced criticism over problems with a new banking platform, which disrupted some customers’ services. The latest incident involved attempted fraud and malicious activity linked to a weakness in software connecting to the online banking portal; CAF Bank said its core banking funds were not at risk.