One app glitch can undo years of brand loyalty. Lloyds just proved it.
On March 27, 2026, Finextra reported that a bug in the Lloyds Banking Group app had exposed the personal data of nearly 500,000 customers. Not a sophisticated cyberattack. A bug. The kind of thing that happens when you are moving fast, scaling systems, and trying to ship. The incident was later confirmed and covered by the UK Parliament's Treasury Committee. And in the space of a news cycle, Lloyds had a brand problem that no marketing budget was going to fix overnight.
I want to be clear about why I am writing this. Not to pile on Lloyds. Incidents like this happen to good organisations run by good people. I am writing this because if you lead marketing at a fintech or neobank, this is your future problem too. The only question is whether you have built the brand to survive it.
The trust bar is higher in digital banking, and that is the whole problem
When someone chooses a neobank or a fintech over their high street bank, they are making a statement. They have decided that the new thing is better: safer, smarter, more transparent, more on their side. That decision is emotional as much as rational. And because it is emotional, the betrayal when something goes wrong is proportionally bigger.
Legacy banks carry decades of inertia. Customers stay with them out of habit, inconvenience, or a vague sense that "they're all the same anyway." That cynicism is actually protective. When Barclays goes down on a Friday afternoon, people are annoyed. When Monzo goes down on a Friday afternoon, people feel let down. The relationship was different, so the disappointment is different.
I have seen this dynamic play out in consumer research again and again. The positive association that drives acquisition in digital banking ("they actually care about me") is the same association that amplifies damage when something breaks. You cannot have one without the other.
What the research tells us about recovery time
Brand trust recovery after a publicly reported data or privacy failure