Webinar Description
Key Takeaways
- Security research reveals widespread unintentional data leakage from banking websites to third-party advertising platforms
- Browser-based scripts are bypassing consent management systems and capturing sensitive financial data
- Case studies from 14 financial institutions across the US and Europe will be examined
- Intended for security professionals, compliance teams and IT decision-makers in financial services
- Practical guidance on implementing runtime controls for client-side data protection
Introduction
Jscrambler is hosting a live webinar on 20 August 2026 that examines how banking and financial services websites are inadvertently exposing customer data to third-party advertising networks. Titled “The Crack in the Vault: How Banking Sites Unknowingly Expose Customer Data to Third Parties,” the session presents findings from security research conducted across financial institutions in the United States and Europe. The webinar addresses a growing concern within application security: the gap between organisations’ data protection commitments and the reality of how client-side scripts handle sensitive information in production environments.
About This Event
This research-driven webinar brings together Jscrambler’s security research and product teams to present original findings on client-side data exposure in the financial sector. The session will analyse real-world cases from 14 banking and financial websites, demonstrating how sensitive information—including loan amounts, account details and hashed email addresses—is being transmitted to advertising technology platforms without adequate controls.
The presentation will map the technical pathways through which data exposure occurs, explain how third-party scripts circumvent cookie consent mechanisms, and outline practical approaches to implementing continuous monitoring and runtime protection for client-side environments.
The Client-Side Security Gap in Financial Services
Traditional security architectures in banking have concentrated heavily on server-side protections, network perimeters and backend infrastructure. However, modern web applications rely extensively on JavaScript executing within the customer’s browser—an environment that operates largely outside the organisation’s direct control. Third-party scripts embedded for analytics, advertising, personalisation and other functions can access the same page context as the financial institution’s own code.
The research to be presented demonstrates that these scripts are capturing sensitive data even when users have declined tracking consent or opted out of data sharing. This occurs because many consent management implementations control cookie placement but fail to prevent scripts from reading form fields, URL parameters and page content in real time. The data is transmitted before consent decisions take effect, or through mechanisms that bypass cookie-based controls entirely.
For financial institutions, this creates significant exposure across multiple dimensions: regulatory compliance with data protection frameworks, contractual obligations to customers, reputational risk, and potential liability for data handling by third parties operating outside their governance structures.
Technical Mechanisms Under Examination
The webinar will detail the specific technical methods through which data leakage occurs. Advertising and analytics scripts commonly employ techniques such as capturing form input values as users type, reading query string parameters that may contain account identifiers, and hashing email addresses for cross-platform tracking purposes. While hashing provides a degree of pseudonymisation, hashed identifiers remain linkable across advertising networks and can be combined with other data points to build detailed user profiles.
These scripts operate within the browser’s execution context, where they have access to the Document Object Model and can observe user interactions in ways that server-side security tools cannot detect. The research findings illustrate how this visibility gap leaves financial institutions unaware of data flows occurring on their own web properties.
Who Should Attend
The session is designed for security professionals responsible for web application protection, including those in security research and analyst roles. Product managers and marketing managers working in financial services will benefit from understanding how their technology choices affect data governance. IT and compliance departments at banks, credit unions and fintech organisations will find the content relevant to their oversight responsibilities. Decision-makers evaluating client-side security solutions will gain insight into the specific risks that runtime monitoring addresses.
Implementing Runtime Protection
Beyond identifying the problem, the webinar will provide actionable guidance on deploying continuous client-side monitoring to detect and block unauthorised data exfiltration. This approach involves instrumenting the browser environment to observe script behaviour in real time, identifying when sensitive data is being accessed or transmitted, and enforcing policies that prevent unauthorised data flows regardless of how third-party code attempts to operate.
For financial institutions navigating an increasingly complex landscape of privacy regulations and customer expectations, establishing visibility and control over client-side data handling represents an essential evolution in their security posture.