CAF Bank Halts Online Services Over Third-Party Software Vulnerability

CAF Bank, a financial institution serving approximately 14,000 charities, has been forced to suspend its online banking services following the discovery of a vulnerability within its third-party software integration. The outage, which began on July 24, has significantly disrupted operations for its charitable clients, many of whom rely on the platform for essential functions such as payroll processing and account management.

The bank, owned by the Charities Aid Foundation, confirmed the ongoing unavailability of its online portal in a message to customers, stating that services would remain offline until further notice. This decision was prompted by reports of suspicious activity observed on some customer accounts. CAF Bank indicated that it detected the issue early and proactively notified affected customers about any attempted fraudulent transactions.

Following an internal investigation, CAF Bank identified an undisclosed vulnerability concerning the connection between external software and its online banking portal. The bank is currently collaborating with its technology partner to develop and implement a fix for the identified flaw. While the core banking infrastructure remains unaffected and customer funds are secure, the bank is undertaking necessary modifications to its online service to ensure its integrity.

In a statement, CEO Alison Taylor expressed her apologies for the disruption, acknowledging the frustration caused to customers. "We are working with external experts to fix an issue we identified with third-party software related to our online banking portal," Taylor stated. "The core bank is not affected. We are acutely aware of the impact this has on our customers and want this to be fixed as soon as possible, but we cannot restore access to the online service until we are assured the issue is safely resolved."

Taylor further assured customers that the bank could still provide support via telephone and was prioritizing time-sensitive transactions, including payroll. When questioned about potential compensation for affected clients, she declined to comment. This incident echoes past difficulties CAF Bank faced last year when a new banking platform launch led to widespread login and transaction issues, for which the bank later issued an apology.

The bank has not disclosed the financial investment made in its platform, but it reported holding £1.45 billion ($1.93 billion) in customer deposits at the close of its 2024/25 financial year. The current outage highlights the critical importance of robust security for third-party integrations, as vulnerabilities in these components can have far-reaching consequences for even well-established financial institutions and their client base.