The core steps to protect your account from theft and fraud

Online banking is safer than it was ten years ago, but your account is still a target. Banks now use encryption to scramble data in transit, and most offer fraud monitoring that catches unusual activity. Your job is to make sure a thief cannot get in even if they have your password.

The three things that matter most: use a password no one else knows and no website has seen before, turn on two-factor authentication so a password alone cannot unlock your account, and never enter your banking details on a link someone sent you. These three practices stop the vast majority of account takeovers. Everything else is reinforcement.

The rest depends on which threats you face. If you use public WiFi, a thief on the same network can intercept unencrypted traffic. If you reuse passwords, a breach at one website gives a thief your banking password. If you click a link in an email that looks like it came from your bank, you might land on a fake site that steals your login. Each threat has a specific defense.

Key Takeaways

  • Create a unique password for your bank account that you have never used anywhere else, and store it in a password manager so you do not have to remember it.
  • Turn on two-factor authentication through your bank's settings so that logging in requires both your password and a code sent to your phone or generated by an app.
  • Never click a link in an email or text to reach your bank; instead, go directly to the bank's website by typing the address yourself or using a bookmark.
  • Check your account and statements regularly for charges you did not make, and report them to your bank within 60 days to limit your liability.
  • Use a password manager to generate and store strong passwords so you do not have to create them yourself or write them down.

Create a password that only you know

Your password is the key to your account. If someone has it, they can log in from anywhere and drain your money. A strong password is long, random, and unique to your bank—meaning you have never used it on any other website.

The best way to create and store a strong password is to use a password manager. A password manager is software that generates random passwords, stores them encrypted on your device or in the cloud, and fills them in automatically when you log in. Popular password managers include Bitwarden, 1Password, Dashlane, and LastPass. You only have to remember one master password to unlock the manager itself.

If you create your own password, make it at least 16 characters long and mix uppercase letters, lowercase letters, numbers, and symbols. Avoid words from the dictionary, your name, your birthday, or anything someone could guess from your social media. "Tr0pic@lSunset#2024" is weak because it uses a common phrase. "7kQ$mP2xL9vN&wR4" is strong because it is random.

Write your password down only if you keep the paper in a locked drawer at home, not in your phone, email, or a notebook you carry. Better yet, use a password manager and do not write it down at all.

Turn on two-factor authentication to block password theft

Two-factor authentication (often called 2FA or two-step verification) means your bank requires two pieces of proof before letting you in: your password and something else only you have. Even if a thief steals your password, they cannot log in without the second factor.

The second factor is usually a code sent to your phone via text message (SMS), a code generated by an authenticator app on your phone, or a push notification that asks you to approve or deny the login attempt. Text message codes are the easiest to set up. Authenticator apps like Google Authenticator, Microsoft Authenticator, or Authy are more secure because a thief cannot intercept them the way they can intercept a text.

To turn on two-factor authentication, log into your bank's website or app, find the security or account settings section, and look for an option called "Two-Factor Authentication," "Two-Step Verification," or "Additional Security." Your bank will walk you through the setup. You will choose whether to receive codes by text or use an app, and you will test it by logging out and logging back in.

Save the backup codes your bank gives you during setup. These are one-time codes you can use if you lose access to your phone. Write them down and store them somewhere safe, separate from your phone.

Recognize and avoid phishing emails and fake websites

Phishing is a fake email or text that looks like it came from your bank and asks you to click a link and log in. The link takes you to a fake website that looks almost identical to your real bank's site. When you enter your login, the thief captures it and uses it to access your real account.

Your bank will never ask you to click a link in an email to log in or verify your account. If you receive an email that says "Click here to confirm your identity" or "Your account has been locked—log in to unlock it," do not click the link. Instead, go to your bank's website by typing the address directly into your browser or using a bookmark you created earlier. Then log in and check your account. If there is a real issue, your bank will tell you inside your account.

Phishing emails often have small clues that they are fake: a sender address that is almost but not quite your bank's real address (like "bankofamerica-secure.com" instead of "bankofamerica.com"), spelling mistakes, or a generic greeting like "Dear Customer" instead of your name. But sophisticated phishing can be hard to spot, so the safest rule is: never click a link in an email to reach your bank.

The same rule applies to text messages. If you receive a text claiming to be from your bank with a link, do not click it. Call your bank's customer service number (the one on your debit card or statement) and ask whether they sent the message.

Monitor your account for unauthorized charges

Even with strong passwords and two-factor authentication, fraud can still happen. A thief might use your debit card number at a store, or a data breach at a retailer might expose your card details. Catching fraud early limits how much money you lose.

Check your account at least once a week. Log into your bank's website or app and look at your recent transactions. If you see a charge you did not make, report it to your bank immediately. Most banks have a fraud reporting option in their app or website, or you can call the number on your debit card.

Your bank is required by federal law to investigate unauthorized charges and return your money if the charge was fraudulent. The timeline depends on the type of account and the type of fraud, but you are generally protected if you report within 60 days of the charge appearing on your statement. Report sooner rather than later.

Many banks also offer fraud alerts or purchase notifications that send you a text or email every time someone uses your debit card. Turning these on means you will know immediately if your card is used, and you can report it right away if it was not you.

Protect yourself on public WiFi and shared devices

Public WiFi at a coffee shop or airport is not encrypted, which means anyone on the same network can see the data you send. If you log into your bank account on public WiFi without extra protection, a thief on that network might be able to intercept your password.

The safest approach is to avoid banking on public WiFi altogether. Wait until you are home on your own WiFi network. If you must bank on public WiFi, use a VPN (virtual private network), which encrypts all your internet traffic so no one on the network can see it. A VPN routes your connection through a secure server before it reaches the internet. Popular VPN services include ExpressVPN, NordVPN, and Proton VPN, though some charge a monthly fee.

If you use a shared device—a family computer, a work computer, or a library computer—do not save your password in the browser. Log in each time, and log out when you are done. Do not check the "Remember me" box. This prevents the next person who uses the device from accessing your account.

Keep your devices and software up to date

Banks and device makers release security updates to fix vulnerabilities that thieves can exploit. If you do not install these updates, your device stays vulnerable.

Turn on automatic updates for your phone's operating system (iOS or Android) and for your computer (Windows or Mac). This way, security patches install without you having to remember. You can usually find this setting in your device's Settings app under "System" or "Software Update."

Also keep your banking app up to date. Banks release new versions to fix security issues and add fraud protections. Check your phone's app store (Apple App Store or Google Play) every few weeks and install any available updates for your bank's app.

Use antivirus or anti-malware software on your computer. Windows Defender (built into Windows) and macOS's built-in protections are adequate for most people. If you want additional protection, Malwarebytes offers a free version that scans for threats.

What to do if your account is compromised

If you notice unauthorized charges, someone logs into your account from an unfamiliar location, or you suspect your password has been stolen, act immediately.

First, call your bank's customer service number (on your debit card or statement) and tell them you suspect fraud. Do not use a number from an email or text. Your bank will freeze your account, cancel your debit card, and issue a new one. They will also investigate the unauthorized charges and return your money if they were fraudulent.

Second, change your password to something completely new and unique. Use your password manager to generate a strong one. If you used the same password anywhere else, change it on those sites too.

Third, turn on fraud alerts with the credit bureaus. You can place a free fraud alert by contacting Equifax, Experian, or TransUnion. A fraud alert tells creditors to verify your identity before opening new accounts in your name. You can do this online at IdentityTheft.gov, which is run by the Federal Trade Commission.

If your identity was stolen and accounts were opened in your name, you may also want to place a credit freeze, which prevents anyone from opening new accounts without your permission. A credit freeze is free and can be lifted when you need to apply for credit yourself.

Frequently Asked Questions

Is it safe to use my bank's mobile app instead of the website?

Yes, the mobile app is generally as safe as the website, and sometimes safer because apps do not fall for phishing tricks the way browsers do. Download the app directly from your phone's official app store (Apple App Store or Google Play), not from a third-party source. Keep the app updated.

What if I forget my password and need to reset it?

Use your bank's password reset option on the login page. You will usually be asked to verify your identity by answering security questions, entering a code sent to your email or phone, or confirming recent transactions. This is a legitimate bank process. Do not click a link in an email to reset your password; instead, go to your bank's website directly.

Can my bank see my passwords or personal information?

Your bank cannot see your password because it is encrypted. Your bank stores only a scrambled version of your password and checks it against what you type when you log in. Your bank does see your personal information (name, address, account balance) because they need it to run your account, but they are required by law to keep it private and secure.

What happens if someone uses my debit card number but not my online account?

If someone makes a purchase with your debit card number (in a store, online, or over the phone) but does not access your online account, you are still protected. Report the unauthorized charge to your bank within 60 days and they will investigate and return your money. Your liability is usually zero if you report it promptly.

Should I use biometric login (fingerprint or face recognition) instead of a password?

Biometric login is convenient and adds security on top of your password, but it does not replace your password. Use both: a strong unique password for your account, and biometric login on your phone or computer so you do not have to type the password every time. If your phone is stolen, the thief still cannot access your account without your password.