Zbulimi i sulmeve phishing dhe inxhinierisë sociale dhe vlerësimi i efektivitetit të sigurisë kibernetike në sektorin bankar: Evidencë nga Kosova

Abstract

In today’s digital age, social engineering has become significantly more complex, with increasingly sophisticated attacks. This development provides criminals and organized groups with greater opportunities to leverage artificial intelligence to cause even more extensive damage. For example, the use of the Albanian language in phishing attacks is currently observed in Kosovo — a tactic that enables attackers to more easily gain the trust of clients. A vast illegal economy is evolving in the cyber world. This field has grown so rapidly that even young people are becoming increasingly involved in cybercrime. These groups often target elderly individuals through various social engineering methods, with the aim of stealing financial assets from their bank accounts. Consequently, it is essential for both banking institutions and clients to continuously monitor technological developments to ensure a higher level of security. This thesis examines the nature and forms of social engineering and phishing attacks, with a particular focus on the banking sector in Kosovo. The primary objective is to assess the current level of awareness among bank employees and clients regarding these threats, as well as to evaluate the effectiveness of existing protective measures. Through a mixed-methods approach that includes quantitative data from surveys with users of banking services and the analysis of security reports, the study identifies the main weaknesses in the cybersecurity infrastructure. The findings reveal that, despite investments in security technologies, the human factor remains the weakest link in the chain of defense. The use of sophisticated techniques such as spear-phishing and smishing has significantly increased the success rate of attacks. This thesis emphasizes the urgent need for a comprehensive approach that combines advanced technology with continuous education and awareness programs for clients. The final recommendations provide a strategic framework for financial institutions in Kosovo to strengthen their resilience against cyber threats and to better protect the financial assets of citizens. In the digital era of 2026, the banking sector is characterized by two parallel realities: on one hand, rapid digitalization and the expansion of online services; on the other hand, the exponential growth of cyber threats. According to the ENISA Threat Landscape 2025 report, phishing constitutes approximately 60% of the initial attack vectors in the financial sector across Europe. In the Western Balkans, and particularly in Kosovo, this phenomenon is even more alarming due to the use of the Albanian language, familiarity with the local context, and the relatively low level of cybersecurity awareness. Social engineering attacks exploit the greatest vulnerability of any system the human element. Even the most advanced technical systems can be compromised if an employee or client clicks on a fraudulent link. This study aims to shed light on the Kosovo reality by combining the analysis of internal bank data, interviews with professionals, and a review of international literature. The importance of this topic is high because the banking sector is considered critical infrastructure. Any successful incident can result in direct financial losses, damage to customer trust, and regulatory sanctions.