At the bank where I used to work, both the institution and the clients themselves were under more-or-less daily attack, but the primary interest of the executives was in keeping it all quiet. They were also fixated on finding a technical solution, rather than in undertaking the kind of client and staff education that could have a real impact.

A technical fix is kind of difficult in an environment where the most serious breaches are the result of a casual attitude toward security (poor password choice) or the willing surrender of security info (giving someone your login information simply because they ask for it).

The most effective course would be to give people the knowledge they need to protect themselves, but no one--certainly not a commercial entity--wants to tell its client base "we can't protect you as you use our service, you'll have to look out for yourselves."

So, secrecy prevails and people are often unaware there's a problem...which is the perfect situation for those intent on information theft.