UK Banking App Glitch:
What Savers Need to Know

What Actually Happened

At some point on Thursday morning, 12 March 2026, a misconfiguration or caching error inside Lloyds Banking Group's mobile and internet banking infrastructure caused customers to be served the wrong session data when they logged in. Instead of seeing their own account, they were shown the transactions, balances and in some cases the full financial details of a completely different customer.

The scale of individual exposure was significant. One woman told the BBC she saw the accounts of six different users over a 20-minute period on the Bank of Scotland app — including benefit payments from the Department for Work and Pensions that used National Insurance numbers as payment references. Another customer, posting on social media, reported being able to see the detailed financial records of 30 different people, including names, account numbers, sort codes, NI numbers and transaction histories going back to 2024.

Consumer champion Martin Lewis flagged the issue on Facebook, where his post drew close to 2,000 responses from alarmed customers. One wrote: "I can see other people's bank account details and payments. If I log out and back in, the details change to someone else." Another said: "Very worrying — my balance is correct but two different people's account transactions are on my app."

What Lloyds Said

Lloyds Banking Group's response came in stages. Its initial message on X read: "Hi. Sorry about this. We are now aware some customers are having issues with viewing transactions & balances right now. Bear with us as we fix this."

A fuller statement followed: "This morning, we incorrectly showed transaction information from some accounts to other customers in Internet Banking and the mobile app. We're sorry this happened. This issue was quickly identified and resolved. We can assure you that nobody had access to your accounts. We're currently reviewing what happened to ensure this cannot occur again. Protecting our customers' personal information and account security remains our priority."

Halifax separately confirmed on social media it was aware of customers "having issues with viewing transactions and balances." A Lloyds spokesperson added: "We're sorry that some customers experienced an issue viewing transactions in the app for a short time this morning. The issue was quickly resolved and we're looking into what happened."

Notably, Lloyds did not define what "a short time" meant, nor how many customers were affected. Some customers continued reporting difficulties accessing their accounts even after these statements were published.

The Critical Distinction: Money Security vs Data Security

The most important thing to understand about this incident is the difference between two types of risk that are often conflated but are entirely separate.

Financial security — whether your money could be stolen — was not compromised. Lloyds confirmed that no one gained access to others' accounts, meaning no one could make payments, withdraw funds, or move money that wasn't theirs. Your FSCS protection (up to £120,000 per person at UK-authorised banks) covers you against bank failure, not incidents like this, and remains entirely intact.

Data security — whether your personal financial information remained private — was compromised. This is a materially different and serious concern. Account numbers, sort codes, National Insurance numbers and transaction histories are exactly the kind of data used in identity fraud, phishing attacks, and social engineering scams. The fact that no unauthorised transactions occurred does not mean the data exposure carries no downstream risk for affected customers.

The GDPR Angle: Lloyds Has Regulatory Obligations

Under UK GDPR, organisations that experience a personal data breach are required to assess whether it meets the threshold for reporting to the Information Commissioner's Office (ICO). If the breach is likely to result in a risk to the rights and freedoms of individuals — which the exposure of account numbers, sort codes and National Insurance numbers clearly may — the organisation must report it to the ICO within 72 hours of becoming aware of the breach.

Where the breach is likely to result in a high risk to affected individuals, the organisation must also notify those individuals directly — without undue delay. The exposure of NI numbers alongside account details and transaction histories could plausibly facilitate identity theft or targeted fraud, which would typically clear the "high risk" threshold.

Lloyds Banking Group has not publicly confirmed whether it intends to file an ICO report or notify affected customers individually as of the time of writing. The ICO has the power to investigate data breaches of this nature and to impose fines of up to £17.5 million or 4% of global annual turnover under UK GDPR — whichever is higher.

A Pattern of UK Bank IT Failures

This incident does not exist in isolation. In 2025, a series of significant IT failures affected TSB, Nationwide, First Direct and Lloyds itself, prompting concern among MPs about the reliability of UK banking infrastructure — particularly as banks continue to close branches and push customers toward digital-only access. When digital is the only channel and the digital channel fails, there is no fallback.

The broader context is the tension between cost efficiency and resilience. Running fewer branches and more centralised software systems reduces cost, but concentrates operational risk. A single misconfiguration that exposes customer data across three brands simultaneously is precisely the kind of systemic failure that regulators and parliamentary committees have been warning about. The Prudential Regulation Authority (PRA) and FCA have ongoing work on operational resilience requirements for UK banks — incidents like this are exactly the evidence base for tighter standards.

What You Should Do If You Were Affected

Whether you saw other people's data, or are concerned that your own data may have appeared on someone else's screen, the following steps are appropriate.

What This Means for Savers Choosing Between Banks

For savers weighing where to hold their money, this incident is a reminder that bank selection involves more than comparing interest rates. The operational robustness of a bank's technology infrastructure — and its track record on data security — is a legitimate factor in the decision, particularly for those who rely entirely on digital access.

It is worth noting that Lloyds Banking Group is one of the most heavily regulated and well-capitalised banking groups in the UK. The fact that a bank of this scale can still experience a data exposure of this kind illustrates that no institution is immune to software failures. The more instructive question is how quickly the bank identified and fixed the problem, how transparently it communicated, and what steps it takes to prevent recurrence — all of which remain to be seen as the full picture emerges.

The Bottom Line

The Lloyds Banking Group data glitch on 12 March 2026 is serious but should be understood in proportion. Your money is safe. FSCS protection is intact. No one gained control of anyone else's account. But the exposure of National Insurance numbers, account details and detailed transaction histories to strangers — at scale, across three major banking brands — is a significant data protection failure with real potential for downstream harm to affected customers.

The next 72 hours will be telling: whether Lloyds files an ICO report, whether it notifies affected customers directly, and what its technical post-mortem reveals will determine how this is ultimately judged by regulators. In the meantime, the action steps above are worth taking regardless of whether you received a notification from the bank.