ON the night of Feb 5, 2016, hacl(ers pushed 35 fraudulent payment instructions through the SWIFT interbank messaging system. By the time Bangladesh Banl( detected the breach, $81 million had left its account at the New Yorl( Federal Reserve and landed in the Philippines.

Most of it was never recovered. There was no break-in, no border crossed, no vault touched the heist happened entirely through a screen.

But this is not only a story about central banl(s. The same battle is now fought daily on the phone in your pocket. It is the call from someone claiming to be `from your banl(`, warning that your card is being blocked and asl(ing you to `verify` your details. It is the fal(e loan app, the link that looks exactly like your banl(`s website but is not. The Bangladesh Banl( robbers needed months of planning to trick a central banl( Today`s fraudster needs only a phone call and 30 seconds of your trust.

The reason this matters to every Pal(istani household is simple: our money now lives on digital rails. Nine in 10 retail payments in Pakistan are made digitally the salary that arrives in an account, the pension drawn from an ATM, the remittance sent from Dubai, the utility bill paid from a mobile app, the shopkeeper`s QR code. In a single quarter, these transactions now approach Rs170 trillion in value. This is a genuine triumph of convenience and financial inclusion. But it also means that when the rails are attacked, it is not an `IT problem` it is your salary and your savings that are on the line.

And the attackers are getting smarter.

AI, the same technology banks use to detect fraud, now helps criminals write flawless fake messages, clone voices and mimic official websites. Globally, nearly three in four people report that they, or someone close to them, were touched by cyber-enabled fraud last year. Pal(istan is no exception: the credentials of more than 180m Pal(istani internet users surfaced in a global data breach, and malicious software targeting banking apps on smartphones rose by more than half in a year. As mobile banl(ing grows, so does the attack surface and unlike a bank branch, a smartphone has no security guard.

Banks themselves remain the most attractive target, for an obvious reason: they hold valuable information and they can move money. Global studies put the average cost of a single breach at around $5m higher in finance while institutions that invest ahead of the curve lose far less when trouble comes. The principle applies to a banl( exactly as it applies to a household: prevention always costs less than loss.There is encouraging news. Pal(istan has climbed from 79th to 29th on the ITU`s Global Cybersecurity Index in just three years. The State Bank has set up a dedicated Cyber Risl( Management Department, launched Cyber Shield 2025-30, and this January conducted the country`s first industry-wide cybersecurity drill across 34 financial institutions a recognition, at last, that an attack on one banl( is a threat to all.

Consider what disruption would actually feellike. If even a tenth of digital payments stopped for two days apps down, cards declined, QR codes dead transactions worth roughly Rs100 billion could be affected. The queue outside the ATM would be the leastofit:shopkeepersunpaid,salaries delayed, and a corrosive question in people`s minds is my money safe on this phone? That question, repeated often enough, would push people bacl( towards cash and undo a decade of hard-won progress. Trust takes years to build and one bad weel(end to lose.The task for Pal(istan`s banl(s, therefore, is to move beyond minimum compliance towards genuine resilience. Cybersecurity must sit on the boardroom agenda alongside credit and liquidity risl( with continuous monitoring, tested defences, scrutiny of third-party vendors,and staff trained as rigorously as tellers once were trained to spot forged cheques.

Banks, regulators and technology firms must also cooperate far more closely, because criminals collaborate freely while defenders too of ten work alone. The benchmarl( must be the attack withstood.

But the reader has a role too, and it is decisive. Remember three things. Your bank will never not once, not ever call to ask for your PIN, password or the one-time code sent to your phone; anyone who does is a thief. A prize you never entered for is bait, and an offer too good to be true always is. And a moment`s pause before clicking alink is the cheapest security investment ever invented.

The strongest firewall in the country is an alert customer.

Bangladesh Bank lost $81m in a single night because attackersfound an opening.

The question for every banl(, and for every one of us holding a phone is not whether such an opening exists. The question is whether we find it before they do.• The writer is a banker.