The rise of open banking is transforming today’s banking industry, fostering more transparency, efficiency, and innovation. The opinions expressed here are those of the authors. They do not necessarily reflect the views or positions of UK Finance or its members. By enabling collaboration between banks and third-party providers, open banking is empowering consumers with more personalized and seamless financial services. Yet, this wave of innovation comes with its own set of challenges, particularly in the realm of fraud. According to a new survey by Themis and Bottomline, 59 per cent of respondents identified open banking as a service trend with significant potential to increase their bank’s fraud exposure. The evolution of open banking is on the rise globally, especially in markets such as the US and UK, where the technology has already been integrated into many popular financial tools and services. The global value of open banking transactions is expected to surpass $330 billion by 2027, up from $57 billion in 2023. While open banking allows individuals and small businesses to be more fully in charge of their own financial data, it also creates new challenges for banks navigating fraud risks. The collaborative nature of open banking introduces more opportunities for fraud. Fraudsters often target the weakest links, exploiting third-party providers that may lack the rigorous fraud awareness and defenses typically found in banks. This interconnectedness heightens the risk of data breaches, where sensitive financial information can fall into the wrong hands. With more parties sharing access to customer data, the challenge of ensuring robust security across the ecosystem becomes increasingly complex. Phishing and social engineering: Fraudsters can exploit non-bank entities, some of which may have less robust fraud awareness and defenses, by launching phishing campaigns or other social engineering attacks. Impersonation: Criminals may pose as legitimate third-party providers or financial institutions to deceive customers into revealing sensitive information, such as login credentials. Compromised endpoints: With more parties accessing financial data, there is a greater risk of API endpoints or third-party providers being compromised. This could allow bad actors to infiltrate the open banking ecosystem. Fake applications: A potential emerging threat involves fraudsters creating counterfeit third-party applications that appear legitimate to users, tricking them into sharing their financial data. It is important for banks and other financial institutions to remain aware of these risks and apply rigorous security and due diligence standards for third-party providers and API development and deployment. Multi-factor authentication mechanisms are also important to add an extra layer of protection, as are awareness campaigns that can help reduce the susceptibility to phishing and social engineering schemes. Open banking is just one example of today’s rapidly evolving fraud trends. More than ever, banks are having to balance the integration of transformative technologies with changing customer needs and new fraud risks. It is important to understand the dual role of technology in both driving and deterring fraud, as well as the interplay of traditional and emerging payment landscapes. In our study, survey respondents highlighted a range of trends to pay attention to in 2025 while building fraud defenses. Stay ahead of the curve, click here to read the full whitepaper today.

Open banking: Navigating new fraud risks

The article discusses the rise of open banking and its transformative impact on the banking industry, emphasizing the increase in fraud risks. According to a survey by Themis and Bottomline, 59% of respondents identified open banking as a service trend with significant potential to increase fraud exposure. The global value of open banking transactions is expected to surpass $330 billion by 2027, up from $57 billion in 2023. The article highlights various fraud risks, including phishing, social engineering, impersonation, compromised endpoints, and fake applications, and suggests measures to mitigate these risks.