Online Banking Security: A Checklist You Can Finish Today

The core of online banking security is a unique password, the strongest second factor your bank offers, alerts you actually see, and a habit of never acting on an unexpected call or text. If anyone contacts you claiming to be your bank, hang up and reach the bank yourself, on the number on your card or through its official app. The sections below take you through the setup, the scams to expect, and what to do in the first hour if money leaves your account. We do not name or favour any bank: menus and features differ, so check your own bank's help pages.

One honest limit first. What protects you after a loss, such as whether a bank refunds a payment you were tricked into making, differs between countries, banks and payment types. Nobody can promise it from a blog post. We point to the regulators at the end so you can check your own position.

Do this now: the 15-minute setup

1. Give the bank its own password. Make it long and unique, and keep it in a password manager. The FBI advises strong, unique passwords, and tells victims to reset any other account where a compromised password was reused. Our Password Strength tool lets you test a candidate.
2. Turn on the strongest second factor your bank offers. The FBI says to enable multi-factor authentication wherever it is offered and never to turn it off. If your bank supports a passkey or app-based approval, prefer it to a text code; try the Passkey Lab to see the difference. Which methods exist depends on the bank.
3. Switch on real-time alerts for payments, new payees, logins and changes to your contact details, delivered where you will see them first, usually the app.
4. Bookmark your bank's website and install the app only from your phone's official store, reached from the bank's own site. The FBI recommends bookmarks because multi-factor authentication does not help if you type your details into a fake login page.
5. Look at the card controls. Many banks let you lock a card, set limits and block certain payments. Set limits that fit how you really spend, so a stolen card or a tricked transfer has a ceiling.
6. Save your bank's real phone number from the back of your card in your contacts, so you can call it when something looks wrong.

How to tell it is a scam

The "fraud team" call and the safe account

The classic bank-impersonation scam is a call, often with a caller ID that looks right, saying suspicious payments are leaving your account and you must move your money to a "safe" account now. Scamwatch lists exactly these: requests to download software, move money to a "secure account" or hand cash to a courier. It says banks would never ask you to do any of these things, and that scammers may already know some of your details. The FBI adds that you should not trust caller ID; end the call, find the real number yourself and call that. Take Five, the UK campaign led by UK Finance, boils it down to stop, challenge, protect: only criminals will try to rush or panic you.

Never read out a code, PIN or password

The FBI says legitimate companies generally will not ask for your username, password or one-time passcode. Scamwatch lists requests for a one-time password or security PIN as warning signs even when the caller knows some of your details. A code is the last step in a login or payment. Giving it away hands the scammer the finish line.

Texts, emails and links

The FTC says scammers often pose as banks with claims of suspicious activity, account problems or a link to confirm details, and that a phishing email can use a real company's logo. Scamwatch warns that fake messages can appear in the same thread as genuine ones. If you have an account, do not use contact details in the message: contact the company through a number or website you know is genuine. In the US you can forward scam texts to 7726 (SPAM) and report to ReportFraud.ftc.gov, per the FTC.

Fake apps and fake sites

The FBI's November 2025 alert on account takeover describes criminals impersonating financial institutions, and advises avoiding search results or ads to reach banking sites. Use the bookmark or type the address yourself. Treat any request to install a "security" or "helper" app as a red flag, since Scamwatch lists downloading software as something banks would never ask.

Authorised push payment scams

In these scams you send the money yourself: a "landlord" with new bank details, a "supplier" invoice, a friend whose account was taken over. Because you authorised the payment, it is harder to reverse. Slow down, check the details through a contact you already trust and treat urgency as a warning. Whether you can claim money back depends on your country and bank, so check before you assume either way.

Trade-offs to weigh

• Passkeys and app approvals vs text codes: stronger in general, but not every bank offers them, and you need a recovery plan if you lose your phone.
• Low limits vs convenience: a low limit caps losses, but if you keep switching it off it is not protecting you.
• Alerts vs noise: too many alerts get ignored. Keep the ones for money moving, new payees, logins and contact-detail changes.
• Public Wi-Fi: mobile data or waiting costs a little data or time. Open networks are shared and can be imitated, so use the official app and never click past a security warning.
• Freezes: a credit freeze, free in the US per the FTC, stops new credit in your name but must be lifted when you apply for credit.

If a fraudulent transfer happens: the first hour

1. Call your bank immediately on the number on your card or in its official app. The FBI says to ask for a recall or reversal of transfers, and that acting quickly may reduce or eliminate losses. Scamwatch says to ask your bank to stop any transactions.
2. Change your credentials: the bank login, your email and any account that shared the password. Remove any software you were told to install; Scamwatch advises having a qualified technician do this.
3. Report it. US: the FBI Internet Crime Complaint Center (ic3.gov) and ReportFraud.ftc.gov. UK: your bank, then the police at reportfraud.police.uk, as Take Five advises. Australia: Scamwatch, and free help from IDCARE.
4. Consider a credit freeze if personal details were shared. The FTC says a freeze stops anyone opening new credit in your name, is free, does not affect your credit score and can be lifted when you need credit. You contact each of the three US credit bureaus. The FTC points to IdentityTheft.gov for exposed personal information.
5. Ignore "recovery agents". The FBI warns that IC3 will never ask for payment to recover lost funds.
6. Keep records: screenshots, dates, phone numbers and reference numbers help the bank and the police.

What varies by country

Rules on unauthorised transactions, bank-account fraud and payment scams are set nationally and change. In the US, the CFPB handles consumer complaints about banks and publishes guidance on electronic fund transfers. In the UK, regulators and ombudsman bodies such as the Financial Conduct Authority and the Financial Ombudsman Service are the places to check. In Australia, look at ASIC's Moneysmart and the Australian Financial Complaints Authority. Treat these as starting points, read your bank's terms, and do not assume any protection applies to your case.

Prevent it next time: a checklist

• Unique password in a manager, plus the strongest second factor on offer.
• Alerts on, and an eye on the account every few days.
• Bookmark or official app only; never a link from a message or an ad.
• A household rule: nobody moves money because of an incoming call.
• Your bank's real number saved in your phone.
• Help older relatives set up the same habits. The Voice Clone Fraud Defense Checklist helps families agree a way to verify each other.
• Rehearse the call in the Online Banking Security Lab. For a similar impersonation scam, read Amazon scams: how to spot them.

Frequently asked questions

What is the most important online banking security step?

Use a long, unique password with multi-factor authentication turned on, and never share a code or PIN with anyone who contacts you. The FBI advises strong, unique passwords and multi-factor authentication wherever it is offered, and says not to turn it off.

Would my bank ever ask me to move money to a safe account?

Scamwatch says banks would never ask you to move money to a "secure" account, download software or hand cash to a courier. If anyone asks, hang up and contact your bank on a number you find yourself.

Is it safe to bank on public Wi-Fi?

It is safer to use your phone's mobile data or wait. Open networks are shared with strangers and can be imitated, so use the official app and never click past a security warning. This is general caution rather than a rule from one agency.

Is a passkey better than a text code?

Where your bank offers passkeys or app-based approval, they are generally harder to intercept than a code sent by text. Which options exist depends on your bank, so check its security settings. No method helps if you enter a code on a fake page, which is why the FBI also recommends bookmarking your bank's site.

Will my bank refund me if I am tricked into sending money?

It varies by country, by bank and by how the payment was made, so no one can promise it. Contact your bank immediately and look up your national regulator: the CFPB in the US, the Financial Conduct Authority and the Financial Ombudsman Service in the UK, or the Australian Securities and Investments Commission and the Australian Financial Complaints Authority in Australia.

What should I do first if money leaves my account?

Call your bank straight away on the number on your card or in its official app, report the transfer and ask it to recall it. The FBI says acting quickly may reduce or eliminate losses. Then change your credentials, report the crime and consider a credit freeze.

Sources

• FBI Internet Crime Complaint Center: Account takeover fraud involving impersonation of financial institutions (I-112525-PSA, 25 November 2025)
• US Federal Trade Commission: How to recognize and avoid phishing scams
• US Federal Trade Commission: What to know about credit freezes and fraud alerts
• US Consumer Financial Protection Bureau: fraud and scams resources
• Take Five to Stop Fraud (UK Finance campaign)
• Australia's Scamwatch: Phishing, including bank impersonation

This is general guidance, not legal or financial advice. Bank features, menus and legal protections change and differ by country; follow your bank's help pages and your regulator for current rules.