Skip to content
Client area
EN
Request a demo
Banking and insurance · programme 06

Protect customer data

Make banking secrecy and cybersecurity a shared reflex.

Why this programme

A lent password, a screen left unlocked, an attachment opened too quickly: most data leaks start with a human action. The programme puts teams face to face with the everyday situations where customer data is exposed, at the counter, on the phone or when working from home. Everyone discovers what an attacker can do with it, and how to stop them.

What your teams experience

  1. The indiscreet desk: spot, in a projected scene, all the information a visitor could read or photograph.
  2. The right recipient: decide, message by message, what can be sent, to whom and through which channel.
  3. The password: build a strong passphrase as a team, then see how long it takes a machine to crack weak ones.
  4. The incident: a leak is discovered, and teams put the right reflexes and the right contacts back in order.

Each activity opens and closes with a projected cinematic sequence, personalised for your teams. The facilitator sets the pace: nothing moves forward without them.

What the company gains

Data protection habits shared by everyone, incidents reported sooner, and a culture of professional confidentiality that no longer rests on a handful of specialists.

62 %

The human element was involved in 62% of breaches.

Verizon2026 Data Breach Investigations Report (DBIR), 2026

Staging written for you

In your client area, a form specific to this programme collects your content: it is built into the challenges and cinematic sequences, exactly as you provide it. The look uses your logo and your colours. Teams are formed on the spot or based on your organisation chart.

Follow-up, up to D+30

Your follow-up dashboard stays with the programme, from the order to the final results.

  • After the session: the session report, with the gap between the opening and closing measures.
  • At D+7: a reminder asks a few key questions again, and the D+7 report shows what has been retained.
  • At D+30: a second reminder, and the D+30 report shows what holds over time.

Follow-up: before, during, after

The sources of this programme

The published research that this programme's games, measures and debriefs refer to. You can check every reference.

  1. Adams, A., & Sasse, M. A. (1999). Users are not the enemy. Communications of the ACM, 42(12), 40-46. 10.1145/322796.322806
  2. Sasse, M. A., Brostoff, S., & Weirich, D. (2001). Transforming the "weakest link". BT Technology Journal, 19(3), 122-131. 10.1023/A:1011902718709
  3. Bulgurcu, B., Cavusoglu, H., & Benbasat, I. (2010). Information security policy compliance. MIS Quarterly, 34(3), 523-548. 10.2307/25750690
  4. Siponen, M., & Vance, A. (2010). Neutralization: New insights into the problem of employee information systems security policy violations. MIS Quarterly, 34(3), 487-502. 10.2307/25750688
  5. Shay, R., Komanduri, S., Durity, A. L., Huh, P., Mazurek, M. L., Segreti, S. M., Ur, B., Bauer, L., Christin, N., & Cranor, L. F. (2016). Designing password policies for strength and usability. ACM Transactions on Information and System Security, 18(4), 1-34. 10.1145/2891411
  6. Loi organique n° 2004-63 du 27 juillet 2004 portant sur la protection des données à caractère personnel ; loi organique n° 2017-42 du 30 mai 2017 portant approbation de l'adhésion de la Tunisie à la Convention 108 et à son protocole additionnel (textes) ; autorité de contrôle : INPDP. www.inpdp.tn/
  7. Règlement (UE) 2016/679 du 27 avril 2016 (RGPD), articles 5 et 33 (texte).
  8. NIST (2025). SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (norme). csrc.nist.gov/pubs/sp/800/63/b/4/final
  9. Edmondson, A. (1999). Psychological safety and learning behavior in work teams. Administrative Science Quarterly, 44(2), 350-383. 10.2307/2666999
  10. Gollwitzer, P. M., & Sheeran, P. (2006). Implementation intentions and goal achievement. Advances in Experimental Social Psychology, 38, 69-119. 10.1016/S0065-2601(06)38002-1
  11. Roediger, H. L., & Karpicke, J. D. (2006). Test-enhanced learning. Psychological Science, 17(3), 249-255. 10.1111/j.1467-9280.2006.01693.x
  12. Howard, G. S. (1980). Response-shift bias. Evaluation Review, 4(1), 93-106. 10.1177/0193841X8000400105
Further reading (5 references)

Other research we drew on to design this programme.

  1. Herath, T., & Rao, H. R. (2009). Protection motivation and deterrence. European Journal of Information Systems, 18(2), 106-125. 10.1057/ejis.2009.6
  2. Floyd, D. L., Prentice-Dunn, S., & Rogers, R. W. (2000). A meta-analysis of research on protection motivation theory. Journal of Applied Social Psychology, 30(2), 407-429. 10.1111/j.1559-1816.2000.tb02323.x
  3. Acquisti, A., Brandimarte, L., & Loewenstein, G. (2015). Privacy and human behavior in the age of information. Science, 347(6221), 509-514. 10.1126/science.aaa1465
  4. Florêncio, D., & Herley, C. (2007). A large-scale study of web password habits. Proceedings of WWW 2007, 657-666. 10.1145/1242572.1242661
  5. Komanduri, S., Shay, R., Kelley, P. G., Mazurek, M. L., Bauer, L., Christin, N., Cranor, L. F., & Egelman, S. (2011). Of passwords and people: Measuring the effect of password-composition policies. Proceedings of CHI 2011, 2595-2604. 10.1145/1978942.1979321
Shared foundations (13 references)

The mechanics of all our sessions (team play, the debrief, the before-and-after measure, spaced reminders) and the research that also underpins the other programmes in the same specialty or sector.

  1. Tyler, T. R., & Blader, S. L. (2005). Can businesses effectively regulate employee conduct? The antecedents of rule following in work settings. Academy of Management Journal, 48(6), 1143-1158. 10.5465/amj.2005.19573114
  2. Treviño, L. K., Weaver, G. R., Gibson, D. G., & Toffler, B. L. (1999). Managing ethics and legal compliance: What works and what hurts. California Management Review, 41(2), 131-151. 10.2307/41165990
  3. Weaver, G. R., & Treviño, L. K. (1999). Compliance and values oriented ethics programs: Influences on employees' attitudes and behavior. Business Ethics Quarterly, 9(2), 315-335. 10.2307/3857477
  4. Kish-Gephart, J. J., Harrison, D. A., & Treviño, L. K. (2010). Bad apples, bad cases, and bad barrels. Journal of Applied Psychology, 95(1), 1-31. 10.1037/a0017103
  5. Parker, C., & Nielsen, V. L. (2009). Corporate compliance systems: Could they make any difference? Administration & Society, 41(1), 3-37. 10.1177/0095399708328869
  6. Verhage, A. (2009). Compliance and AML in Belgium: A booming sector with growing pains. Journal of Money Laundering Control, 12(2), 113-133. 10.1108/13685200910951893
  7. Takáts, E. (2011). A theory of "crying wolf": The economics of money laundering enforcement. Journal of Law, Economics, and Organization, 27(1), 32-78. 10.1093/jleo/ewp018
  8. Morrison, E. W., & Milliken, F. J. (2000). Organizational silence. Academy of Management Review, 25(4), 706-725. 10.5465/amr.2000.3707697
  9. Stasser, G., & Titus, W. (1985). Pooling of unshared information in group decision making. JPSP, 48(6), 1467-1478. 10.1037/0022-3514.48.6.1467
  10. Sitzmann, T. (2011). A meta-analytic examination of the instructional effectiveness of computer-based simulation games. Personnel Psychology, 64(2), 489-528. 10.1111/j.1744-6570.2011.01190.x
  11. Butler, A. C., & Roediger, H. L. (2008). Feedback enhances the positive effects and reduces the negative effects of multiple-choice testing. Memory & Cognition, 36(3), 604-616. 10.3758/MC.36.3.604
  12. Cepeda, N. J., Pashler, H., Vul, E., Wixted, J. T., & Rohrer, D. (2006). Distributed practice in verbal recall tasks. Psychological Bulletin, 132(3), 354-380. 10.1037/0033-2909.132.3.354
  13. ACFE (2024). Occupational Fraud 2024: A Report to the Nations. Association of Certified Fraud Examiners (rapport). legacy.acfe.com/report-to-the-nations/2024/

Before you book

How is a Corporate Solutions experience different from team building?

It starts from a business objective, not an activity: onboarding new hires, preventing a risk, bringing your commitments to life. It is staged for your company, with your content, your figures and your brand. Your teams play in person, on their phones, while a big screen tells the story and a facilitator runs the room. And it is followed up: the session report, then the D+7 and D+30 reminders in your client area.

Do we need to install an app?

No. Participants scan a QR code and play in their phone's browser. No account, no password, no installation. It works on iPhone and Android.

Is there a limit on the number of participants?

No. The platform adapts to your headcount, from a small team to the whole company, in one or several rooms.

Demo

See “Protect customer data” in action.

Thirty minutes on your premises. You play a challenge and see the report at the end.

Request a demo