How safe is online banking?

We rated banks on the information they require for you to access accounts and how easy it is to recover usernames or passwords.

We checked whether they allow you to choose insecure passwords or if they prevent the use of password managers (these help you keep track of multiple passwords securely and avoid bad practices such as using weak/common passwords).

Passwords alone aren't enough. We awarded top marks if banks ask customers to use a card reader or their mobile banking app to log in every time. Many send a one-time passcode via SMS, but we view this as the least secure way to authenticate customers because criminals are increasingly intercepting such texts.

We tested whether banks have best-practice security headers are in place as these protect against a range of cyberattacks by telling your browser how to behave when it communicates with the website.

Banks were penalised if they support any outdated versions of 'Transport Layer Security (TLS)', where data is scrambled so that only you and your bank can read it, or whether they have weak ciphers (algorithms for encrypting and decrypting data).

We searched for bank domains or subdomains (eg computing.which.co.uk is a subdomain of which.co.uk) that use outdated – and therefore potentially vulnerable – software or internal sites that shouldn't be accessible on the internet.

And we noted where scripts (programming language) were loaded from external sources. We prefer this to be kept to an absolute minimum because while banks have rigorous due-diligence processes, hackers might compromise third parties.

A bank's mobile app needs to be able to detect whether it's running in a safe environment or not so we checked if their apps would detect and refuse to run on ‘rooted’ phones and tablets (where in-built protections have been compromised to install unapproved apps) and analysis tools. These tools are useful to security researchers, but hackers could use them to find vulnerabilities. 

We counted the number of ‘risky permissions’ users were asked to agree to. These permissions allow bank apps to carry out big changes such as activating the microphone, obtaining your contacts and changing network settings.

Banks also had to meet the latest email security standards as these help your email provider block malicious messages claiming to be from ‘your bank’. 

Setting up a new payee and editing account details should require additional checks to verify it's really you making changes.

We want banks to send instant notifications when details are altered to alert you to a potential breach.

We marked them down if these messages included a phone number or web link, as scammers often replicate texts and emails to trick you into calling them or entering your details on a fake website.

If banks never included numbers or links in communications, it would make scam attempts easier to spot.

You should only be able to log in to your bank from one computer at a time. Banks were penalised for poor 'session management' if they let us access accounts from multiple browsers or computer networks at the same time – this should be flagged as a potential attack.

Banks should log you out after five minutes of inactivity, but not all of them did in our test. We also want them to allow one-click logout rather than ask you to confirm the decision first. While asking for confirmation meets industry guidance, we think it's safer to instantly close the session.

Banks must identify every customer using at least two of these independent factors:

• something only you know (a password or Pin)
• something only you possess (a card reader or registered mobile device) and
• something only you are (a digital fingerprint or voice pattern).

Some banks offer a physical device to generate unique one time passcodes (OTPs) that serve as evidence of 'possession'.

The Barclays PINSentry and Nationwide card reader require you to insert your debit card to generate the OTP, while the HSBC/First Direct Secure Key devices generate codes when you enter a Pin. These banks also offer digital versions of their card readers/devices for mobile users.

Most banks also let you authenticate yourself at login via the mobile banking app (you can usually simply use fingerprint or face ID to let them know it's you logging in).

Another option is OTPs sent via text message (SMS) to a mobile phone but we want providers to phase these out as SMS is vulnerable to Sim-swap attacks, where criminals intercept messages.

Nationwide, NatWest, Santander, The Co-operative Bank, TSB and Virgin Money all dropped points in our 2024 analysis for continuing to use SMS to verify customers at login. 

Which? has previously raised concerns that banks could exclude some customers because they don't own a mobile phone or have decent signal.

It's up to each bank and card issuer which methods they use, however, the Financial Conduct Authority (FCA) has said that customers without phones or mobile reception should not be excluded.

Your bank must make it clear that they offer alternative ways to authenticate yourself.

If you are struggling to receive codes sent by your bank via SMS due to bad reception, some networks offer Wi-Fi Calling which lets you connect via your wireless broadband.

A number of providers – Lloyds and TSB – ask if you want to 'trust' your device to avoid extra security checks at login. Others do the 'trusting' without you realising.

Banks should still monitor your accounts for unusual activity and make regular security checks in case your device has been compromised, for example, Lloyds asks you to reconfirm trusted status when you use a new browser or clear your browser history.

Many providers now let you instantly 'distrust' or deregister a mobile phone, in case it is mislaid or stolen, though this still isn't offered by Lloyds Banking Group, Santander, or The Co-operative Bank.

Chase also doesn't offer this feature but you can only log in to your Chase app via one registered device. 

None of the banks tested currently let customers instantly revoke trust for laptops or desktop computers, though Barclays users can click profile>device history to see the devices which have been used to log on to online banking and follow instructions if they don’t recognise a device. Barclays says you wouldn’t see registered app devices on the web channel and vice versa, though it is currently working on enhancements that will allow you to see everything in one place. 

Previously, all banks processed online transfers using the account details only and took no notice of the name entered.

This flaw causes misdirected payments if people accidentally enter the wrong digits and can be abused by criminals who impersonate trusted organisations to trick people into transferring money directly into accounts they control.

If CoP is in place, your bank checks if the full name matches the details held by the recipient's bank. If the name entered doesn't match - or only partially matches - the account details, you'll know something is wrong.

You can still choose to ignore these warnings and authorise the payment regardless, though banks make a point of stating that you do so at your own risk.

There are four possible CoP messages, though not all banks use identical wording:

1. Yes, exact match - the details match and you can proceed with the payment.
2. Partial or close match - some of the details are incorrect so look for spelling mistakes or typos.
3. No match - the details don't match so cancel the payment until you've made further checks
4. No name check - it has not been possible to check the name eg because the receiving bank doesn't offer CoP.

CoP checks payments using the Faster Payments system (including standing orders) and CHAPs (high-value payments), whether they are made online, via your mobile banking app or in a branch.

It doesn't apply to payments that are not in pounds sterling or BACS payments (including direct debits).

The most obvious benefit to CoP is that it significantly reduces the risk of you making a bank transfer to the wrong account.

Our most recent current account survey of the general public, in September 2020, found that 12% of people paid into the wrong account by accident in the past 12 months. We hope to see this figure drop when we ask again next year.

If your own bank or the receiving bank doesn't yet have CoP in place, be extra vigilant when adding payment details, particularly for large transfers.

Banks and building societies who offer Faster Payments must follow the credit payment recovery process if you do make a mistake, by contacting the receiving bank on your behalf within two days of you reporting the mistake.

As long as the recipient of the misdirected payment does not dispute your claim, you'll be refunded within 20 working days of notifying your bank.

However, there are no guarantees you'll recover the misdirected money - if the recipient claims the money is rightfully theirs, you should seek legal advice and may need to take court action against them.

It is hoped that CoP will also protect people from losing money to bank transfer fraud, also known as authorised push payment (APP) fraud.

A common tactic used by impersonation scammers is to trick victims into moving money to a 'safe' account. CoP can help 'break the spell' by highlighting when the name entered isn't as expected.

Fraudsters will try to convince targets to ignore these warnings, for example, by claiming that a business name is different because it's a related trading name, or they could set up a new business with a name that's deceptively similar to a legitimate one.

But banks will never ask you to disregard CoP warnings so it's important that customers take these messages seriously.

The payments regulator told the six biggest UK banking groups to implement CoP: Barclays, Lloyds Banking Group, NatWest Group (including RBS), Santander, HSBC (including First Direct) and Nationwide Building Society.

Monzo and Starling were the first banks to sign up for CoP voluntarily. Revolut, an e-money firm, started offering CoP checks in January 2021.

Later in 2021, we saw The Co-operative Bank (April) and TSB (June) follow suit. More recently, Triodos, Virgin Money and Cambridge Building Society have implemented CoP.

Yet many names are still missing this vital layer of protection, so take extra care if your payment provider doesn't yet offer this. 

New systems can have teething problems so don't assume CoP will always work.

In November 2020, Which? Money discovered that certain Starling customers had missed out on these checks for an entire month following a system update.

We expect banks to follow Starling's lead and reimburse any customers who lose money as a result of CoP failures.

Treat unsolicited phone calls, letters, emails and texts with caution.

Fraudsters use pressure tactics to persuade you to share personal and financial details so don't let anyone rush you and never share your Pin or online passwords (your bank will never ask for these in full).

If you're in any doubt as to who's calling, hang up. Make sure the line is clear, and then call the organisation on a phone number you trust, such as the one on the back of your payment card.

Make sure your computer or laptop is protected with a good security program and antivirus software.

Keep all devices, apps and browsers up to date. Updates contain security patches for new vulnerabilities. It's important not to carry on using an old device that's not getting updates: Windows 7 won't be getting any more updates after January 2020, for example, and you will be at risk if you carry on using this for online banking after this date.

Visit our guide to choosing antivirus software so you can find the best package to keep you safe.

It's tempting to use the same password for lots of different websites and accounts, but this is a bad move: passwords get stolen in data breaches and sold to other hackers, who use software to try them on lots of websites in what's called a password stuffing attack.

Don't write your passwords down in full or share them with anyone. Consider using a password manager such as LastPass or Dashlane to generate unique passwords.

Find out how to create the perfect password.

If you have a wireless network at home, activate the security settings on your router and replace the default password so no one else can access it.

Avoid logging in to your bank account from a public computer or unsecured wireless network. If you do use a public computer, never leave it unattended and always log out when you’ve finished.

Avoid clicking links and downloading attachments from emails and texts.

Phishing emails are sent by criminals posing as genuine companies such as a bank or HMRC. Clicking on a link takes you to a fake website where fraudsters steal financial or personal details.

Or, the link might install malware on your computer as another means to capture details. Thieves can steal your password by tricking you into installing a program on your computer that secretly records your password when you type.

Type web addresses into the address bar of your browser manually instead.

Look for a padlock symbol in or next to the address bar in your browser and that the web address changes from starting with 'http' to 'https'.

This doesn't guarantee a site can be trusted, but it does mean the website is encrypted, so no one else but that website can read any card details or passwords you enter.

Some sites have an extended validation (EV) certificate, shown as a padlock alongside the company name. Again, it's not perfect, but it requires the company to undergo more rigorous checks.

Don't leave your email address, date of birth, or phone number on sites such as Instagram, Facebook and Twitter – it increases your risk of identity theft. 

Only accept friend requests from people you know. Someone posing as an interesting person asking to become your friend may actually be an ID thief.

Check your privacy settings carefully and make sure only people you trust can view your profile.

Regularly check your bank account and credit card statements for suspicious transactions.

If you spot something unfamiliar, report it to your bank or card provider as soon as you can.

Try to shield your Pin in case there are cameras fitted by criminals above the keypad. Or, stick to in-branch machines, which are less likely to have been tampered with than one on the high street.