TIRANA, Albania — A technical incident at Raiffeisen Bank Albania has raised questions over the reliability of banking transaction systems after customers reported unexpected changes in the balances of their accounts during the past 48 hours.
 |
Raiffeisen Bank Albania subsequently acknowledged that a technical and operational problem had occurred in the processing and posting of a limited number of card transactions during a limited period.
According to the bank, some card transactions were reflected twice in customers’ accounts. The bank said it immediately activated corrective procedures and carried out checks to ensure that account information and balances were accurate.
Raiffeisen stated on October 5 that the affected transactions had been verified and that the correction process had been completed, with customer accounts now reflecting the actual transactions and corresponding balances.
The bank also explicitly denied that the incident was caused by unauthorized access to its systems, a compromise of customer data or a cybersecurity incident. It described the problem as technical and operational rather than the result of outside interference.
The Questions Do Not End With the Technical Explanation
Even if the incident was not a cyberattack, the episode raises legitimate questions about the resilience and control of banking infrastructure.
For customers, the distinction between a cyberattack and a technical failure may be important from a security perspective, but the immediate concern is simpler: why were account balances temporarily affected in the first place?
A banking system is ultimately built on the accuracy of its records. When a customer sees an unexpected reduction or duplication of transactions in an account, even if the money is subsequently restored, confidence in the system can be affected.
This is particularly relevant as Albania increasingly relies on electronic payments, cards and digital banking services.
The issue is therefore not necessarily whether Raiffeisen suffered a cyberattack. Based on the bank's current statement, there is no evidence establishing that. The more immediate question is whether the bank's technical controls adequately prevented a processing error from being reflected in customers' accounts.
What Is the Role of the Bank of Albania?
The episode also places attention on the role of the Bank of Albania, which is responsible for banking supervision and has an established regulatory framework covering operational, information-technology and cybersecurity risks.
The Bank of Albania's supervisory framework specifically identifies operational risk among the major risks that must be monitored in the banking sector. Its supervisory function also examines internal controls and corporate governance as mechanisms for mitigating such risks.
In November 2024, the central bank approved Regulation No. 51/2024 on the management of operational risk by banks, payment institutions and electronic-money institutions. The regulation entered into force on March 1, 2025, establishing minimum requirements for managing operational risk.
The Bank of Albania has also maintained specific regulatory requirements concerning the use of information and communication technology by licensed financial institutions.
This means that a technical incident at a major bank is not simply an internal IT matter. It falls within a broader regulatory framework designed to ensure that banks identify, control and mitigate operational and technological risks.
Transparency Is Now the Key Issue
Raiffeisen has said that the problem has been corrected and that customer balances now accurately reflect actual transactions.
That is an important immediate step, but transparency about the cause of the incident is equally important.
Customers and the regulator should be able to establish, at an appropriate level of detail:
- what caused the transaction-processing error;
- how many customers and transactions were affected;
- whether any funds were temporarily unavailable;
- how the bank detected the problem;
- how quickly the error was identified and corrected;
- whether the incident exposed weaknesses in internal controls; and
- what preventive measures have been introduced to prevent a recurrence.
The fact that the bank says there was no unauthorized access or cybersecurity breach should not end the discussion about operational resilience.
A system can fail without being hacked.
A Test of Trust in Albania's Digital Banking System
The broader issue is trust.
Albania's financial sector is undergoing increasing digitalization, with customers relying more heavily on cards, online banking and electronic transactions. The more financial activity moves into digital systems, the more important the reliability and accuracy of those systems becomes.
A technical failure that is quickly detected, transparently explained and fully corrected can remain a contained operational incident.
A failure that is poorly explained, repeatedly experienced or inadequately investigated can become something much more serious: a problem of public confidence.
For now, the available evidence does not establish that Raiffeisen Bank Albania suffered a cyberattack or that customers' funds were stolen. The bank says the incident resulted from a technical and operational problem involving the posting of certain card transactions and that the correction has been completed.
But the episode nevertheless raises a question that goes beyond one bank:
How resilient are Albania's banking systems when a technical failure is capable of temporarily altering what customers see in their accounts?
That is a question for Raiffeisen Bank Albania, but also for the country's banking regulator.