For years, financial institutions treated security as something that happened in the background. Essential, but largely invisible. However, RFI Global’s MacroMonitor study shows that 37% of US households worry about the safety of their deposits in banks and savings institutions, highlighting why security remains top of mind for many consumers.
Security has become more than a back-end function; it is now part of the customer experience. It’s not just because fraud remains a concern. It’s because digital banking is now the primary way consumers interact with their bank (91% of US households perform banking tasks via digital channels), and increasingly, how they judge it. Trust, reassurance and control are no longer abstract concepts for customers. They are evaluated through what customers can see and do within their app.
The latest findings from RFI Global’s MacroMonitor study and iSky Radar UX platform underline this shift. Access to account security tools and card controls is now a meaningful part of the digital banking experience, not just a niche feature. As digital banking becomes the primary channel for customer interaction, expectations around security are becoming more visible and more immediate.
That’s a fundamental change. Security is no longer just something banks deliver to customers. It’s something they must enable customers to actively participate in.
Customers still expect strong back-end protection. That hasn’t changed. But what’s becoming more important is the ability to act. Customers want to lock cards, review activity, manage authentication and respond quickly when something feels off. More importantly, they want to feel empowered to act without relying on the bank to resolve every issue. That sense of control is central to trust.
The importance of getting security right extends beyond protection. MacroMonitor data shows that among households considering switching their primary banking provider, 11% cite poor fraud response as a reason for leaving, rising to 16% among consumers aged 50-59.
The strongest digital experience strikes a balance between clear communication, simple design, and practical tools that customers can use. Many US institutions have the underlying capabilities, but the experience can still feel fragmented or buried.
When security tools are easy to find and use, they reinforce trust in the brand, not just protect it.
Age plays a clear role in shaping security expectations. According to iSky Voice of the Customer (VoC) data, Gen Z and Millennials are more likely to prioritize tools that allow active tracking of account activity. They expect visibility, alerts and immediate control because that’s what they experience everywhere else in their digital lives. For these customers, reassurance doesn’t come from a promise of safety. It comes from being able to monitor, manage and intervene in real time.
Older segments still value security, but often with less emphasis on active control. That creates an important challenge for US financial institutions. A one-size-fits-all security experience is unlikely to meet evolving expectations of every consumer group.
Security design is becoming segmented to meet the needs of different customers.
One of the clearest gaps in the market is not the absence of alerts, but the absence of guidance. Too many experiences notify customers of issues without explaining what to do next. That creates anxiety rather than confidence. The strongest approaches shift from simple alerts to supported journeys—ones that explain what’s happened, what it means, and what action the customer should take. Security becomes a continuous loop of communication, action, feedback and reassurance.
DBS provides clear step-by-step guidance when account access is restricted, including actions such as closing other apps or disabling screen-sharing. Revolut follows up security actions with prompts that encourage customers to take additional steps, such as changing passcodes if concerns remain. Crypto.com and Revolut also highlight emerging best practice in impersonation protection, warning customers directly in-app when communications are not from the provider.
This matters because fraud prevention is increasingly a shared responsibility. Customers can play a role, but only if they are properly equipped to do so.
In the US, scams are becoming more sophisticated, and better front-end guidance will matter as much as stronger back-end detection.
Security hubs (a centralized area within a banking app that helps customers monitor, manage, and strengthen the security of their accounts through a range of fraud prevention and account protection tools) are becoming more common across digital banking, and that’s a positive step. But simply grouping features is not enough. The real difference lies in whether the experience builds confidence. While security may not always be the first feature consumers think about, it remains an important contributor to the overall digital experience, ranking among the key drivers of mobile banking satisfaction.
The good news for banks is that many consumers already feel positive about current protections. Our data shows that two-thirds (67%) of mobile banking users are satisfied with their app’s security, with satisfaction particularly high among older consumers.
The best hubs combine overview and action. They help customers understand their current protection, identify gaps, and act quickly. A long list of settings doesn’t create reassurance. Clarity does.
US institutions should be careful not to mistake feature depth for experience quality. Customers don’t want complexity, they want confidence.
Consumers are beginning to see value in AI’s role in security. Our data show that 23% of US households are comfortable using AI-powered fraud prevention services. However, concerns remain significant: 54% cite privacy and data security as a concern when using AI-powered financial services.
AI will undoubtedly play a growing role in fraud detection and prevention. But from a customer’s perspective, its value will depend on how it improves the experience. Faster alerts, more relevant prompts, clearer guidance and smoother recovery journeys all matter. But the principle is simple: technology only adds value if it helps customers understand and act.
The winners won’t be those with the most sophisticated systems behind the scenes. They’ll be the ones who translate that sophistication into everyday reassurance.
The implication for US financial institutions is clear. Security isn’t just a protective layer anymore; it’s part of the value proposition. Customers still expect to be kept safe. But increasingly, they also expect to be informed, empowered and in control. Institutions must treat security as a two-way engagement, not a one-way control function.
Security is no longer just about preventing loss. It’s about creating confidence, and striking the right balance will help build trust among customers, deepen digital usage and stand out in a competitive market.
Security is increasingly influencing how customers choose, use and evaluate their banking provider. For deeper insights into consumer attitudes towards security, fraud prevention and digital banking experiences, get in touch to find out more from RFI Global’s Security and Fraud Report.
Security is no longer a back-end function. As digital channels become the primary way customers interact with their bank, security is now a visible and essential part of the customer experience. Customers assess trust, reassurance and control through what they can see and do within their banking app, making security a front-end experience driver.
Customers expect more than protection. They want the ability to actively manage their security, including locking cards, reviewing activity and responding to potential threats in real time. This sense of control strengthens trust and reduces reliance on the bank, while poor fraud response can directly drive customer switching.
Younger consumers, particularly Gen Z and Millennials, expect real-time visibility, alerts and control over their accounts. They prioritise tools that allow active tracking and intervention. Older customers still value security highly, but with less emphasis on direct control, increasing the need for more segmented and tailored security experiences.
The most effective approaches go beyond alerts by providing clear guidance on what has happened, what it means and what action to take. Strong security experiences combine simple design, accessible tools and clear communication, helping customers feel confident and capable rather than anxious or overwhelmed.
| Cookie | Duration | Description |
|---|---|---|
| __cf_bm | 1 hour | This cookie, set by Cloudflare, is used to support Cloudflare Bot Management. |
| __hssc | 1 hour | HubSpot sets this cookie to keep track of sessions and to determine if HubSpot should increment the session number and timestamps in the __hstc cookie. |
| __hssrc | session | This cookie is set by Hubspot whenever it changes the session cookie. The __hssrc cookie set to 1 indicates that the user has restarted the browser, and if the cookie does not exist, it is assumed to be a new session. |
| AWSALBCORS | 7 days | Amazon Web Services set this cookie for load balancing. |
| AWSALBTG | 7 days | Amazon Web Services set this cookie for load balancing. |
| AWSALBTGCORS | 7 days | Amazon Web Services set this cookie for load balancing. |
| cookielawinfo-checkbox-advertisement | 1 year | Set by the GDPR Cookie Consent plugin, this cookie records the user consent for the cookies in the "Advertisement" category. |
| cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
| cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
| cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
| cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
| cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
| CookieLawInfoConsent | 1 year | CookieYes sets this cookie to record the default button state of the corresponding category and the status of CCPA. It works only in coordination with the primary cookie. |
| elementor | never | The website's WordPress theme uses this cookie. It allows the website owner to implement or change the website's content in real-time. |
| rc::a | never | This cookie is set by the Google recaptcha service to identify bots to protect the website against malicious spam attacks. |
| rc::c | session | This cookie is set by the Google recaptcha service to identify bots to protect the website against malicious spam attacks. |
| viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |
| wpEmojiSettingsSupports | session | WordPress sets this cookie when a user interacts with emojis on a WordPress site. It helps determine if the user's browser can display emojis properly. |
| XSRF-TOKEN | 2 hours | This cookie enhances visitor browsing security by preventing cross-site request forgery. |
| Cookie | Duration | Description |
|---|---|---|
| AWSALB | 7 days | AWSALB is an application load balancer cookie set by Amazon Web Services to map the session to the target. |
| AWSALBTG | 7 days | Amazon Web Services set this cookie for load balancing. |
| AWSALBTGCORS | 7 days | Amazon Web Services set this cookie for load balancing. |
| Cookie | Duration | Description |
|---|---|---|
| __hstc | 6 months | Hubspot set this main cookie for tracking visitors. It contains the domain, initial timestamp (first visit), last timestamp (last visit), current timestamp (this visit), and session number (increments for each subsequent session). |
| _ga | 1 year 1 month 4 days | Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors. |
| _ga_* | 1 year 1 month 4 days | Google Analytics sets this cookie to store and count page views. |
| hubspotutk | 6 months | HubSpot sets this cookie to keep track of the visitors to the website. This cookie is passed to HubSpot on form submission and used when deduplicating contacts. |
| wmc | 1 year 1 month 4 days | Workable sets this cookie to assign a unique visitor ID for statistical purposes. |
| Cookie | Duration | Description |
|---|---|---|
| _cfuvid | session | Description is currently not available. |