Banks leak your cash data via hidden trackers!

Financial institutions are inadvertently leaking customer data through tracking scripts embedded in their websites, despite heavy investment in data security. A review of 14 major European and US financial services websites revealed that scripts on account-opening and loan application pages transmitted sensitive personal and financial information to third parties.

In nine instances, this data sharing occurred without legally valid customer consent. The failures included scripts firing before consent was given, tracking continuing after explicit rejection, and the transmission of specific financial details like loan amounts and personal identifiers. One Dutch bank even used scripts to check for remote-access software on visitor devices.

Responsibility for these breaches is complex, with platforms often shipping default settings that maximize data capture. However, banks are ultimately accountable for selecting vendors, implementing consent mechanisms, and ensuring disclosed policies match actual data handling practices.

Rectifying this requires verifying script behavior in real-time, not just on homepages, and implementing controls to block unauthorized data transfers and sensitive field access. Consent mechanisms must function effectively across all site elements, and default data-sharing features should be disabled unless explicitly lawful and disclosed. Treating scripts on sensitive pages as part of an institution's risk surface is crucial.