"We have informed CAF Bank customers that the online banking service will be unavailable until further notice." — Alison Taylor, CEO, CAF Bank
CAF Bank suspends online banking after reports of suspicious activity
CAF Bank, the Charities Aid Foundation-owned lender that serves 14,000 charities, has suspended its online banking service after receiving reports of suspicious activity on some customer accounts. The bank told customers — in a message seen by The Register — that online services have been unavailable since July 24 and will remain so until further notice. The communications say the bank detected the problem early and notified customers of any attempted fraud.
The bank emphasised that its "core banking services" were not affected and that money held in customer accounts was safe. At the end of its 2024/25 financial year CAF Bank held £1.45 billion ($1.93 billion) in customer deposits.
Vulnerability located in third‑party software connection
Following an investigation, CAF Bank identified a "previously undetected vulnerability" in the way third‑party software connects to its online banking portal. The bank said it is working with its technology partner on a fix and is making changes to the online service. Until the bank is "assured the issue is safely resolved", it will not restore online access.
The bank also said it was working with external experts to address the issue. Those steps, the bank explained, are aimed at ensuring a secure restoration rather than a rapid reopening of the portal.
Practical effects: payroll, phone support and lessons from last year
The outage has left some charities struggling to run payroll after being cut off from their accounts. CAF Bank said it remains able to support customers by phone and is prioritising time‑sensitive payments such as payroll. The bank’s message acknowledged the "frustration" the disruption causes.
CAF Bank has faced similar customer-access issues before. Last year, customers were unable to log in or make transactions when a new banking platform was introduced; the bank later apologised to customers experiencing difficulties during that transition and said it was focused on supporting them through the launch. The bank has not disclosed how much it spent on the platform.
Alison Taylor’s statement and the question of compensation
In a public statement, CEO Alison Taylor said she was "very sorry for the disruption and understand the frustration this can cause for our customers." She reiterated that the core bank remains unaffected and that the organisation is "acutely aware of the impact this has on our customers and want this to be fixed as soon as possible."
Taylor confirmed the bank is "working with external experts to fix an issue we identified with third‑party software related to our online banking portal." She declined to comment on whether the bank will compensate customers for the outage.
How charities, technology partners, and payroll teams are responding
- Charities: Organisations that bank with CAF Bank are relying on telephone support and the bank’s prioritisation of payroll payments while online access is suspended; some are already reporting difficulty running payroll.
- Technology partners and external experts: The bank has engaged a technology partner and external experts to identify and fix the previously undetected vulnerability in the third‑party connection before restoring online access.
- Payroll teams and time‑sensitive payment processors: These teams are dependent on the bank’s promise to prioritise time‑sensitive payments such as payroll and will need continued phone support until the portal is restored.
CAF Bank’s decision to keep the portal offline until it is satisfied the vulnerability is fixed underscores a trade‑off the bank has chosen: protect customer funds and the core ledger while accepting disruption to daily operations for 14,000 charity customers. The immediate next steps the bank has made public are clear — work with the technology partner and external experts to close the connection vulnerability and continue phone‑based support — while the longer question of compensation remains unanswered.
