Safe Online Banking: How to Protect Your Account and Money

The settings that carry most of the protection

Three settings do most of the work: transaction alerts, two-step verification, and a password used on no other site. Everything else on a bank’s security page is useful, but these three are the ones that change what happens when something goes wrong.

They cover different failures. Alerts shorten the time between an unauthorized transaction and your phone call, which is the thing federal protections are actually built around. Two-step verification means a password on its own does not open the account. A unique password means a breach at some unrelated website does not become a banking problem.

The FDIC puts the same short list to consumers: use a strong and unique passphrase or password for each online account, and set up multi-factor authentication on all accounts that allow it, which it notes provides an additional layer of security even when your password has been compromised.

Turn them on in that order if you are doing this now: alerts first, because it is the fastest and it starts working immediately.

Transaction alerts, and why they matter more than they look

Turn on an alert for every card transaction and every transfer, with the dollar threshold as low as your bank allows. This is the single setting that most changes the outcome of a fraud problem, because the federal protections on a bank account are written around how quickly you report.

The CFPB describes the debit card schedule: reporting within two business days of learning about a lost or stolen card caps your responsibility at $50, reporting later can raise it to $500, and failing to report within 60 days after the statement was sent can leave you paying for everything taken after that period. A push notification arrives in seconds. A statement arrives in a month. The gap between those two is the whole reason to switch alerts on.

Set these if your bank offers them:

• Every card purchase, with no minimum amount, or the lowest minimum available.
• Any ATM withdrawal or cash advance.
• Any transfer to an external account or a new payee.
• Any change to your login credentials, phone number, email address, or mailing address.
• Any login from a new device, and any failed login attempt.
• Balance below a threshold you choose, which catches slow drains that individual alerts do not.

The alerts about profile changes are the underrated ones. A criminal taking over an account usually changes the contact details first so the victim stops receiving the notifications. An alert that fires as the address changes is often the only warning there is.

Two-step verification, and which method to pick

Turn on two-step verification on the bank and on the email account behind it, and use the strongest method the bank offers. Two-step verification means a stolen password alone does not open the account, because a second piece is needed.

The methods are not equally strong. The FTC notes that a passcode by text message or email is the most common type, and that security keys are the strongest method of two-factor authentication because they do not use credentials that hackers can steal. An authenticator application sits between the two. If your bank only offers codes by text message, turn that on anyway: it is better than nothing, and the FTC advises starting with your most sensitive accounts, naming bank, credit cards, and email.

Codes by text message have a specific weakness worth naming, which is that the phone number itself can be moved to someone else’s device. Our guide to SIM swap scams covers the warning signs and the port-out protections carriers offer. Where a bank supports an application or a security key, that weakness goes away.

Save the backup codes the bank gives you somewhere that is not the phone, because losing the second factor with no backup is its own problem. Some banks and services now support passkeys, which replace the password entirely rather than adding to it; our guide to passkeys vs. passwords explains what changes and what happens if you lose the device.

A unique password on the bank and on the email behind it

Give the bank a password used nowhere else, and give the email account a different one, also used nowhere else. Reused passwords are how a breach at an unrelated company becomes a banking problem, because stolen combinations get tried everywhere.

The FTC recommends at least 12 characters and suggests a passphrase of random words as an easier way to reach that length, while warning against common phrases, song lyrics, and movie quotes that a guessing program handles easily. It also explains why email comes first: password reset links often go to your email inbox, and a hacker who takes over the email account can get reset links for your other accounts.

Nobody remembers a dozen unique long passwords, which is what a password manager is for. We do not rank products, and the comparison criteria are in our guide to password managers. The alternative that also works is writing them on paper kept somewhere private at home. What does not work is one password with a number on the end.

The FDIC adds a point people skip: do not put personal details in public profiles, because birthdates, pets’ names, family members’ names and locations can give criminals the hints they need to guess your passwords, and the same details often answer security questions.

The weekly habit that finds what alerts miss

Open the account once a week and read the transactions, not just the balance. Alerts catch what the bank flags. Reading catches the small, plausible, recurring things that no alert was configured for.

Look for merchant names you do not recognize, amounts slightly different from what you expected, and very small charges. The CFPB warns that criminals might make low-dollar withdrawals or charges as a way to test a counterfeit card before using it for big-dollar transactions, and advises making a habit of monitoring accounts because online or mobile access makes checking frequently easier.

Once a month, widen it: look at the list of linked external accounts, saved payees, standing transfers, and devices with saved logins. Remove what you no longer use. Check that the phone number and email on file are still yours.

A charge you cannot place is worth a phone call even when it turns out to be a subscription you forgot. A copied card is one of the ways an unfamiliar charge starts, and our guide to card skimming covers how that happens at a pump or ATM. If something on the account is clearly wrong, go straight to what to do when a bank account is hacked, because the order of the first hour matters.

The phone and the network you bank on

The device is part of the account. A phone with the banking application, the email account, and the text messages that carry login codes holds every piece needed to take over the account, which is why keeping it current matters as much as the password.

The FDIC’s advice is to make sure operating systems and applications are up to date, because older and unpatched versions are the target of many attacks, and to run software providing antivirus, firewall, and email filter services. It also warns not to assume an application is legitimate just because its name resembles a company you know, so install the banking app from the official store listing reached through the bank’s own website.

On public networks, the FDIC advises avoiding sensitive transactions including purchases, and says you may consider using a virtual private network. Cellular data is usually the simpler answer: if you need to check the account from an airport, use the phone’s own connection rather than the free network.

Lock the phone with a passcode or biometrics, and turn on remote lock and erase. If the phone starts behaving in ways you cannot explain, our guide to telling whether a phone is hacked separates the symptoms that mean something from the ones that do not.

What a bank will not ask you to do

A real bank will not call you and ask for a one-time code, a password, or a PIN, and it will not ask you to move your money to a safe account to protect it. Those two requests are the signature of an impostor, and knowing them is more useful than trying to judge whether a caller sounds official.

Caller ID can be faked, so the number on your screen proves nothing. The reliable move is the same every time: hang up and call the number printed on your card or on a statement. A real bank employee will wait. Someone who insists you stay on the line, or who creates a reason the call cannot be ended, is telling you what they are.

The same goes for messages. The FTC’s guide on how to recognize and avoid phishing scams covers the patterns: an unexpected message about a problem with your account, a link, and pressure to act now. Reach the bank through the application or an address you typed yourself, never through the link.

Nobody from a bank will ask you to install screen-sharing software so they can fix something. If that has already happened, disconnect the device and call the bank on another one.

What these settings do not cover

None of this prevents a breach at a company that holds your data, and none of it stops a payment you were persuaded to make yourself. Those are the two biggest gaps, and they are worth naming rather than implying that a checklist closes everything.

A transfer you authorized, after a convincing story, is treated differently from a transaction nobody in your household initiated. The protections described by the CFPB and the FTC are built around unauthorized transactions. That is why slowing down before sending money to someone you have not met matters more than any setting, and why a wire in particular deserves its own care, covered in our guide to wire transfer scams.

Card details can also be captured in the physical world, on a terminal you had no way to inspect. A disposable card number helps with some online risks and not with others; our guide to virtual credit cards covers where they fit and where they get in the way.

When something does go wrong and the bank does not resolve it, its federal regulator takes complaints: the OCC through HelpWithMyBank.gov for national banks, and Federal Reserve Consumer Help when you do not know which agency supervises yours. Fraud itself goes to the FTC at ReportFraud.ftc.gov.

Safe online banking FAQ