Charity Bank Takes Down Online Services After Third-Party Software Flaw Exposed

CAF Bank, which handles banking for around 14,000 charities across the UK, has pulled its online banking platform offline after discovering a security vulnerability in how third-party software connects to its customer portal. The outage has been running since July 24 with no confirmed end date.

The bank, owned by the Charities Aid Foundation and holding £1.45 billion in customer deposits, says it spotted suspicious activity on some accounts and traced the problem back to a previously unknown flaw in an integration between external software and its online banking system. It's now working with its technology partner to patch the issue before bringing anything back online.

Some charities have been left unable to access their accounts at all, which is causing genuine operational pain. Running payroll without access to your bank is not a minor inconvenience, and for smaller organisations with tight cash flow, it's the kind of disruption that can cascade quickly.

CEO Alison Taylor has apologised, and the bank says phone support remains available with priority given to time-sensitive payments like salaries. What she didn't say was whether affected customers would receive any compensation. That question, apparently, is still off the table.

This is not CAF Bank's first stumble in recent memory. Last year the bank drew complaints from customers locked out of accounts during a platform migration, forcing a public apology at the time. The bank never disclosed what that transition cost, and it hasn't said much about this incident's financial impact either.

The core banking infrastructure is reportedly unaffected and customer funds are described as safe. Cold comfort if you can't actually move any of them.