Online Banking Security: Plain-English Steps to Stay Safe

Most money lost through online banking is not taken by hackers breaking into the bank, but by criminals who trick customers into sending money or handing over their details. UK Finance, the trade body for UK banks, reported over £1.1 billion lost to fraud in 2024. This guide explains, in plain English, how to set up your banking app and online account safely, how to spot the calls and messages that lead to most losses, and exactly what to do if something goes wrong, including your right to a refund. It is written for individuals, families, older people and very small businesses, with UK rules first and US rules after. Banking apps differ, so if a setting is not where we say, look in your app's security or settings menu or ask your bank.

Key takeaways

Your bank will never rush you. No genuine bank, police officer or official will ask you to move money to a "safe account" or read out a code. If they do, it is a scam.
Stop, Challenge, Protect. The Take Five campaign's advice: pause, question the request, and contact your bank on a number you trust if you have any doubt.
Call 159 if a call worries you. In the UK, hang up and dial 159 to reach your own bank safely.
Protect the app, not just the password. A phone screen lock, the official banking app, alerts and two-step sign-in do most of the work.
Report fast. In the UK most scam victims who pay by bank transfer should be refunded under rules set by the Payment Systems Regulator (PSR), but you must tell your bank, ideally straight away and within 13 months.

How people actually lose money

It helps to know the two main types of banking fraud, because the protections are different.

Type	What happens	Typical example	Main protection
Unauthorised fraud	Someone uses your card or account without your permission	Stolen card details used online; a criminal signs in to your banking with your password	Strong sign-in, alerts, reporting quickly
Authorised push payment (APP) fraud	You are tricked into sending a payment yourself	A caller pretending to be your bank's fraud team, a fake invoice, a romance or investment scam, a fake seller	Stop and check before paying; the UK reimbursement rules

The second type is the hardest to stop with technology, because you are the one pressing "send". That is why most of this guide is about recognising the trick. For the detail behind APP fraud, see the Authorised Push Payment (APP) Fraud Guide.

Set up your banking safely

Use the official app or website only. Download the app from the Apple App Store or Google Play, checking the developer name is your bank. Type the bank's web address yourself or use a bookmark, never a link from a text or email.
Lock your phone. Your banking app is only as safe as the phone it is on. Use a passcode of at least six digits plus face or fingerprint. See the Securing Your Smartphone Guide.
Turn on the app's own security. Most apps let you sign in with face or fingerprint and ask you to confirm new payees and larger payments in the app. Leave these on.
Use a unique password. If your bank uses a password for online banking, do not use it anywhere else. A password manager helps. See the Password Managers Explained for Everyone Guide.
Secure your email and mobile number. Criminals who control your email or phone number can often reset banking access. See the Securing Your Email Account Guide and the SIM Swap Fraud Guide.
Switch on alerts. Turn on notifications for every payment, new payee and sign-in so you see problems within minutes, not at month end.
Keep your contact details current. Your bank needs a working phone number to reach you about a suspicious payment.
Save your bank's number. Write the number from the back of your card somewhere other than your phone.

Many apps also let you freeze your card, set spending limits or block certain payment types. These are useful if you, or an older relative, want an extra layer of control.

Spot the scam before you pay

The Take Five to Stop Fraud campaign, run by UK Finance, sums up the defence in three words:

Stop: take a moment to stop and think before you hand over money or information.
Challenge: could it be fake? You can refuse or ignore any request. Scammers try to rush you or make you panic. Take Five even suggests that being impolite to someone pressuring you may be the safest response.
Protect: if you think you have been scammed, contact your bank immediately and report it.

Warning signs

A call, text or email you did not expect saying your account is at risk, a payment needs approving or your card has been cloned.
Pressure to act now: "your money will be lost unless you move it today".
A request to move money to a "safe account", or to lie to your bank about why you are paying. Banks never do this.
A request for a one-time code, PIN or your full password. These are for you only.
Changed bank details on an invoice, from a builder, solicitor or supplier, sent by email. Check by phone using a number you already have.
Returns that seem too good to be true, being told you were specially chosen, or asked to keep it secret. The Financial Conduct Authority (FCA) lists these as investment scam signs.

Caller ID can be faked, so a call can look as if it comes from your bank's real number. The How to Spot a Phishing Email Guide and the Romance and Investment Scam Awareness Guide go into these tricks in more depth.

Use 159 and check investment firms

159 is a UK phone number run through Stop Scams UK. If you get an unexpected call about money, hang up and dial 159 and you will be connected to your own bank. Stop Scams UK says it reaches customers of more than 99% of UK retail current accounts, including Barclays, HSBC, Lloyds, Nationwide, NatWest, Santander, Monzo, Starling and others. Use a different phone if you can, or wait a few minutes, so you are not still connected to the scammer.

Before investing, check the firm on the FCA's Firm Checker and the FCA Warning List, by typing the FCA's address yourself. Compare the firm reference number and contact details you were given with the official record. The FCA's helpline is 0800 111 6768.

Your right to a refund

UK: APP fraud reimbursement

The PSR states that for payments made on or after 7 October 2024:

What is covered: UK bank transfers sent by Faster Payments or CHAPS, for all types of APP fraud such as impersonation and romance scams. Individuals, microenterprises and charities can claim.
How much: up to £85,000 per claim, which the PSR says covers over 99% of claims. Larger losses can be taken to the Financial Ombudsman Service, which has a £430,000 compensation limit.
When to claim: as soon as possible and within 13 months of the payment.
How fast: you should expect a refund within 5 business days. Your bank can pause the clock to gather information but must reach an outcome within 35 business days.
Excess: your bank may deduct up to £100, but not for vulnerable customers.
Exceptions: you will not be refunded if you were complicit in the fraud or grossly negligent. The PSR says gross negligence is a high bar and the exception does not apply to vulnerable consumers.
Not covered: card, cash and cheque payments (which have their own protections), unauthorised fraud such as a stolen card, and genuine purchases that went wrong. Credit unions, municipal banks and national savings banks are outside the scheme.

If you are unhappy with your bank's answer, go to the Financial Ombudsman Service. The PSR itself cannot look at individual cases.

US: unauthorised electronic transfers

In the US, the Consumer Financial Protection Bureau's Regulation E (12 CFR 1005.6) limits how much you can lose from unauthorised electronic transfers, such as a stolen debit card:

When you tell your bank	Most you can lose
Within 2 business days of learning your card or access device was lost or stolen	$50 (or less, if less was taken)
After 2 business days	Up to $500
More than 60 days after the statement showing the transfer was sent	Potentially all later transfers the bank shows would have been stopped by a timely report

These limits are for unauthorised transfers. Payments you were tricked into making yourself are treated differently, so speed and checking before you pay matter even more.

What to do if it happens

Call your bank now, using the number on your card or 159 in the UK. Ask them to stop or recall the payment and secure your account. Minutes can matter.
Do not reply to the scammer or try to get the money back yourself.
Change passwords for your banking and your email if you shared any details, and remove any app you were asked to install.
Report it. In the UK, report to Report Fraud, or consent to your bank doing so for you.
Keep evidence: screenshots, phone numbers, emails, payment references and the time of each call.
Answer your bank's questions promptly, but check any follow-up call or email is genuine before you reply.
Watch for follow-up scams. Victims are often contacted by "recovery" services promising to get money back for a fee.
If personal details were stolen, follow the Identity Theft Recovery Guide.

Where to get help

UK, reporting: Report Fraud at reportfraud.police.uk or 0300 123 2040, as the NCSC and FCA both advise (England, Wales and Northern Ireland). In Scotland, call Police Scotland on 101.
UK, your bank: 159, or the number on the back of your card.
UK, investments: the FCA on 0800 111 6768, and its Firm Checker and Warning List.
UK, disputes: the Financial Ombudsman Service if your bank refuses a refund. Citizens Advice can help you through it.
US: report identity theft at IdentityTheft.gov, which gives you a free recovery plan, and scams at ReportFraud.ftc.gov. You can place a free one-year fraud alert with one of the three credit bureaus, which must tell the other two, or freeze your credit with each of Experian, TransUnion and Equifax.

Common failure patterns

Trusting caller ID: the number looks like your bank's, so the "fraud team" seems real. Hang up and call back on 159 or the number on your card.
Reading out a code: a one-time code from your bank is the last lock on a payment. Anyone asking for it is trying to steal from you.
Paying a changed invoice: a builder's or solicitor's "new bank details" email is a classic trick. Always confirm by phone using a number you already had.
Waiting too long: feeling embarrassed and not reporting. Quick reports give the best chance of stopping the money, and UK claims must be made within 13 months.
Banking on a borrowed or unlocked device: a shared computer or a phone with no screen lock lets others into your account.
Weak email security: the same password on your email and a breached website lets criminals reset banking access.

For organisations, see the Payment Fraud Guide.

Practitioner checklist

Install only your bank's official app and keep it and your phone updated.
Lock your phone with a passcode of at least six digits and use face or fingerprint sign-in for the app.
Use a unique password for banking and secure your email account with two-step sign-in.
Turn on alerts for payments, new payees and sign-ins.
Save your bank's phone number somewhere other than your phone.
Never move money to a "safe account" or share a one-time code, PIN or password.
For any unexpected call about money: hang up and dial 159.
Confirm any change of bank details by phone before paying.
Check investment firms on the FCA Firm Checker and Warning List.
If something goes wrong, call your bank at once, then report to Report Fraud.

Online Banking Security Guide: Plain-English Steps to Stay Safe