"We have informed CAF Bank customers that the online banking service will be unavailable until further notice," Alison Taylor said, adding that she was "very sorry for the disruption" as the bank works with external experts to fix a vulnerability.
Alison Taylor: shutting access until the connection is safe
CAF Bank, the Charities Aid Foundation-owned lender that serves 14,000 charities, suspended its online banking service on July 24 and has kept it offline "until further notice," the bank confirmed in a message seen by The Register. In that message and a later statement, CEO Alison Taylor said the decision followed reports of "suspicious activity on some customer accounts" and that the bank had detected the problem early and notified affected customers of attempted fraud.
Taylor said the core bank is not affected and that money held in customer accounts is safe, but she made clear the online portal would not be restored until the bank was "assured the issue is safely resolved." She also said CAF Bank is "still able to support on the phone" and is "prioritizing time-sensitive payments such as payroll." She declined to comment on whether the bank will compensate customers.
Vulnerability in the third‑party software connection
Following an investigation, CAF Bank identified "a previously undetected vulnerability in the connection between third-party software and the online banking portal." The bank said it is working with its technology partner and external experts to develop and deploy a fix, and that it is making changes to the online service while the work proceeds.
The bank framed the suspension as a precautionary protective step: although the core banking systems are intact and funds remain secure, the online interface that links customers and third-party applications is the area under remediation.
Immediate impact: charities, payroll and account access
The outage has had tangible operational consequences. The Register reported some organisations were "struggling to run payroll" after being cut off from their online accounts. CAF Bank acknowledged the disruption and said it was prioritising urgent, time-sensitive payments to mitigate harm to customers that rely on the bank for routine disbursements.
Customer notifications about attempted fraud were part of the bank's response, the communications said. Beyond phone support and prioritized payments, the bank has not disclosed other remediation measures it has offered to affected organisations.
Past platform troubles and the bank’s scale
This is not the first time CAF Bank's online service has caused friction. The bank faced customer complaints last year when a new banking platform was introduced and some customers were "unable to log in or make transactions." At the time a CAF Bank spokesperson said the institution was "focused on supporting its customers through the transition and helping them with the new online banking service," noting that "the vast majority of our customers are online, with thousands of payments being made and received every day." The bank apologised then for the disruption and for waits on calls.
CAF Bank has not disclosed how much it has spent on its platform, but the bank reported £1.45 billion ($1.93 billion) in customer deposits at the end of its 2024/25 financial year, a reminder of the scale of funds affected by any interruption to online access.
How technologists, charities, and technology partners are responding
- Technologists and security teams: CAF Bank said it is working with its technology partner and external experts to fix the connection vulnerability. Those teams will be focused on validating the patch and ensuring third‑party connectors cannot be abused before restoring customer access.
- Charities and payroll teams: Organisations that rely on CAF Bank — some of which make thousands of daily payments through online channels — are watching for timely resolution and have already relied on phone support and the bank's prioritisation of payroll to manage short-term obligations.
- Technology partners and external experts: The bank has placed its technology partner at the centre of remediation. That partner and outside experts will be responsible for engineering and testing the fixes the bank says are necessary before customers are permitted back into the online portal.
CAF Bank's posture is cautious: core systems and customer funds remain, by the bank's account, secure, but the institution will not reopen its online gateway until the specific connection issue is confirmed fixed. The unanswered practical questions — notably whether and how customers will be compensated and how long the outage will last — remain in the hands of the bank and its external teams as they race to restore a service relied on by thousands of charities.
