A bank outage communications playbook tells a bank what to say in the first minutes, hours, and days after its login screen goes dark. The core rule is to answer the customer's real question, whether their money is safe, before rumors fill the silence. Bank of America's outage on January 14, 2011, which lasted about ten hours, is the case this playbook starts from.
By the Everything-PR Editorial Team. Originally published January 2011. Updated October 20, 2026.
Why are banking outages different from other tech outages?
A banking outage is a trust event, not an annoyance, for three structural reasons.
First, the deposit base is a confidence asset. Banking is one of the few consumer categories where customers cannot verify their position from outside the institution's own systems. When the digital surface fails, customers cannot confirm that their money exists, and doubt grows with each minute.
Second, social media spreads the doubt. A customer who cannot log in posts a screenshot, and other customers who also cannot log in post their own. The cascade can move faster than customer service can answer.
Third, regulators watch. An unexplained outage can draw attention from the Federal Reserve, the OCC, the FDIC, the CFPB, and state banking departments, so a communications failure can become a regulatory event. The March 2023 collapse of Silicon Valley Bank, accelerated by social-media-driven deposit flight, is the modern precedent banks now plan against.
What should a bank say at each stage of an outage?
A bank should move from acknowledgment to cause to transparency in five stages. The timeline below is EPR's recommended framework, not a regulatory standard.
Minutes 0 to 15: how should a bank acknowledge the outage?
A bank should confirm the outage scope and post an acknowledgment on its status page, its X account, and its in-app message channel. The acknowledgment does not need to explain the cause. It needs to confirm that the bank is aware and working the issue, because silence at minute 15 is worse than an imperfect statement. The first three days matter most for what AI engines later retrieve, as covered in the 72-hour window in crisis communications.
Minutes 15 to 60: what does single-source-of-truth messaging mean?
Single-source-of-truth messaging means every channel carries the same language. Customer-service scripts, the phone tree, branch talking points, and the press briefing all match the public statement. Inconsistency across channels amplifies a crisis.
Hours 1 to 4: what should the cause statement include?
The cause statement should name the cause in plain language, give a recovery timeline, and say whether balances and transaction history are affected. It should answer the question customers are asking, which is whether their money is safe, and not only the technical one the bank wants to answer.
Hours 4 to 24: how should a bank handle recovery?
A bank should confirm service restoration by push notification, email affected customers about any specific impact, open escalation lanes for transaction-level problems, and respond to press coverage that formed during the outage.
Days 2 to 7: what is a post-incident report?
A post-incident report is a published write-up of the root cause, remediation steps, customer impact, and the changes made to prevent recurrence. The practice is common in cloud infrastructure, where providers such as AWS, Google Cloud, and Cloudflare publish incident reports. Banks have adopted it more slowly, which gives institutions that publish one a credibility advantage.
What does a bank outage holding statement look like?
A holding statement is the short acknowledgment a bank posts in the first 15 minutes, before the cause is known. The template below is EPR's own framework, not a statement issued by Bank of America or any other bank. Replace each bracket with confirmed facts before posting.
[Bank name] is aware that some customers are having trouble reaching [online banking, the mobile app or card services]. Our teams are working to restore service. [Customer accounts and balances are secure. Include this line only once it has been verified.] We will update this page by [time]. Customers who need urgent help can call [phone number]. We apologize for the disruption.
Post the same wording on the status page, the X account, the in-app message channel and the phone tree, and give customer-service staff the identical text.
What do real outage cases teach?
Three cases show how outage communications succeed or fail. The Bank of America case is documented in news reports from the time.
What happened in the Bank of America outage of January 2011?
On Friday, January 14, 2011, Bank of America customers had trouble reaching online banking from around 7 a.m. to about 5:15 p.m. Eastern, according to NBC News and Finextra. The bank has about 29 million online banking customers and would not say how many were affected.
Spokeswoman Tara Burke attributed the problem to a "routine system change" the night before and said it was not malware, an attack, or related to WikiLeaks, as UPI reported. The bank used Twitter to tell customers about the outage but, according to American Banker, did not post a notice on its home page because the outage did not affect all customers. A Tuesday, March 1, 2011 disruption followed, per CNN Money.
The lesson is that a notice on one channel reaches only the customers who use that channel, and a bank that does not announce an outage on its main site leaves many affected customers uninformed.
What happened in the Robinhood case of January 2021?
Robinhood restricted purchases of specific securities at the peak of retail-investor activity in January 2021. This was a trading restriction, not an outage, but the communications dynamics are adjacent: a platform restriction, a delayed and fragmented explanation, and regulatory and political pressure.
What happened in the CrowdStrike outage of July 2024?
In July 2024, a faulty CrowdStrike Falcon sensor update crashed an estimated 8.5 million Windows machines, per Microsoft's estimate, and disrupted banking, airline, healthcare, and retail operations in many countries. Banks were second-order victims of a vendor incident. They had to communicate around an outage they did not cause and could not fix, while the vendor ran its own communications in parallel. EPR covers the vendor side in how CrowdStrike handled the biggest IT outage ever.
What are the operating principles for bank outage communications?
Six principles govern bank outage communications, drawn from the cases above and EPR's framework.
- Treat the status page as communications infrastructure. Host it separately from the corporate site so it stays up when the site is down, and point customer-service scripts, social posts, and press statements to it.
- Notify on every channel: email, push, SMS, the status page, social media, and the phone tree. Customers who skip one channel are reached on another.
- Answer "is my money safe" before "what went wrong technically."
- Communicate in parallel with any vendor responsible. The customer's relationship is with the bank, not the vendor.
- Publish post-incident reports so customers can see what changed.
- Notify regulators through the incident-response process at the same time as customers, so a regulator is never surprised by an outage it learns about from the news.
When should a bank bring in a crisis PR firm?
A bank should bring in a crisis PR firm or crisis communications agency before the next outage, not during it, because an agency that already knows the bank's systems, regulators, and spokespeople can issue the minute-15 acknowledgment without onboarding. Banks weighing the decision can compare the top crisis communications firms and crisis PR agencies of 2026, read when to hire a crisis PR firm, and use the crisis management guidebook for the wider plan. Financial institutions with disclosure obligations may also want a specialist from the top financial services PR agencies.
Which other EPR case studies cover outages and trust failures?
