Cybersecurity Applications in Fintech Real-World Examples

import time
from collections import defaultdict, deque

# Allow at most 5 failed logins per account in 15 minutes
WINDOW, LIMIT = 15 * 60, 5
failures = defaultdict(deque)

def record_failure(user_id):
    failures[user_id].append(time.time())

def is_locked(user_id):
    q = failures[user_id]
    now = time.time()
    while q and now - q[0] > WINDOW:
        q.popleft()
    return len(q) >= LIMIT

for _ in range(5):
    record_failure("user42")
print(is_locked("user42"))   # True - require extra verification

# pip install pyotp
import pyotp

# Enrolment: store this secret securely for the user
secret = pyotp.random_base32()
totp = pyotp.TOTP(secret)
print("Scan into an authenticator app:",
      totp.provisioning_uri(name="user@example.test", issuer_name="DemoWallet"))

# Login: verify the 6-digit code the user enters
code = totp.now()                 # in real use, this comes from the user
print("valid:", totp.verify(code, valid_window=1))

from datetime import datetime, timedelta

def risky(transfers, now, new_payee):
    """transfers: list of (timestamp, amount) for one user."""
    last_hour = [a for t, a in transfers if now - t <= timedelta(hours=1)]
    reasons = []
    if len(last_hour) >= 5:
        reasons.append("many transfers in one hour")
    if new_payee and sum(last_hour) > 50000:
        reasons.append("large amount to a new payee")
    return reasons

now = datetime(2026, 11, 6, 23, 0)
history = [(now - timedelta(minutes=m), 12000) for m in (5, 10, 20, 30, 40)]
print(risky(history, now, new_payee=True))
# Flagged transfers go to step-up verification or review.

# FastAPI + Pydantic: reject bad input before it reaches business logic
from decimal import Decimal
from fastapi import FastAPI
from pydantic import BaseModel, Field

app = FastAPI()

class TransferRequest(BaseModel):
    to_account: str = Field(pattern=r"^ACC-\d{6}$")
    amount: Decimal = Field(gt=0, le=Decimal("100000"), decimal_places=2)
    note: str = Field(default="", max_length=100)

@app.post("/transfers")
def create_transfer(req: TransferRequest):
    # authentication, authorisation and rate limiting also apply here
    return {"status": "accepted", "to": req.to_account, "amount": str(req.amount)}

import re

def mask_card(number: str) -> str:
    digits = re.sub(r"\D", "", number)
    return "**** **** **** " + digits[-4:]

def mask_phone(phone: str) -> str:
    return phone[:2] + "******" + phone[-2:]

def safe_log(event: dict) -> dict:
    masked = dict(event)
    if "card" in masked:
        masked["card"] = mask_card(masked["card"])
    if "phone" in masked:
        masked["phone"] = mask_phone(masked["phone"])
    return masked

print(safe_log({"user": "U1", "card": "4111 1111 1111 4821", "phone": "9876543210"}))

# pip install cryptography
from cryptography.fernet import Fernet

# In production the key comes from a key management service, not code
key = Fernet.generate_key()
f = Fernet(key)

token = f.encrypt(b"PAN: ABCDE1234F")
print(token[:20], b"...")
print(f.decrypt(token))     # only holders of the key can read it

Fintech security controls

Identity
[ ] MFA available and encouraged
[ ] Rate limits and lockouts on login and OTP
[ ] Alerts for new devices and password changes

Transactions
[ ] Velocity and new-payee rules
[ ] Step-up verification for risky payments

APIs
[ ] Short-lived tokens with scopes
[ ] Input validation and rate limits

Data
[ ] Encryption at rest and in transit
[ ] Masking in UI and logs
[ ] Least-privilege staff access

Incident response outline

1. Detect: alert or report received
2. Triage: confirm, assess severity and scope
3. Contain: block accounts, revoke tokens, isolate systems
4. Investigate: logs, timeline, root cause
5. Notify: internal leaders, customers, regulators as required
6. Recover: restore safe operation
7. Learn: review and add new controls

Portfolio case study (lab or mock app only)

App: mock wallet API you built
Threat model: account takeover, payment abuse, data leak
Controls added: rate limits, TOTP, validation, masking
Tests: scripts proving each control works
Write-up: risks, controls, remaining gaps

Never test real fintech apps without written permission.