With a broad statement like this, I would usually just suggest this is inflammatory and surely overstated.

However, I've also worked at a financial institution which used core systems by Harland Financial Systems. Their "encryption" for data in transit from teller workstations to the core system was just a two byte XOR, and they sent the key at the beginning of the connection!

Was so unbelievable to be able to crack this in under a half-hour after noticing patterns in a PCAP. Wouldn't have believed it if I hadn't seen it with my own eyes.

That fraud was good enough for our regulators and theirs, so I have no doubt the industry is filled with rotten incompetence through and through.