CYBERSECURITY VULNERABILITIES IN OPEN BANKING ARCHITECTURES: MITIGATION STRATEGIES FOR FINANCIAL INSTITUTIONS

Abstract

Open banking requires banks to share customer data and payment initiation with licensed third-party providers through application programming interfaces, with the customer's consent. The model has stimulated competition and new services, but it has also widened the attack surface of financial institutions, because sensitive data and money movement now flow across organisational boundaries, through interfaces designed to be reached from outside. This paper examines the main cybersecurity vulnerabilities in open banking architectures and proposes a layered mitigation framework, called CS-FSM, built from three groups of controls: secure communication, based on digital certificates and data encryption; strong and adaptive authentication, combining multi-factor authentication, adaptive authentication, automated-abuse challenges, device registration, and redirection-based authentication; and continuous session monitoring. A taxonomy of fourteen vulnerabilities is developed across the consent, authentication, interface, third-party, and operational layers. The framework was evaluated in a simulated open banking environment with between 10 and 100 customers and compared with three data-driven protection schemes based on support vector machines, principal component analysis, and linear discriminant analysis. CS-FSM achieved an average data protection ratio of 83.9%, which rose from 72% with ten customers to 94% with one hundred, against averages of 57.6%, 66.2%, and 61.0% for the comparison schemes. It also maintained an average scalability ratio of 87.2%, increasing steadily with load while the other schemes fluctuated. The results indicate that coordinated layering of preventive controls with continuous monitoring is more effective and more scalable than isolated analytic defences, and the paper closes with practical recommendations for financial institutions.