Is online banking safe in the UK?

Yes, when done correctly. UK banks use multiple layers of security: end-to-end encryption, two-factor authentication (2FA), real-time fraud monitoring, biometric login, and automatic session timeouts. The risk comes from user behaviour — weak passwords, clicking phishing links, or banking on public Wi-Fi. Follow basic security practices and online banking is very safe. If an unauthorised transaction does occur, the Payment Services Regulations 2017 require your bank to refund it promptly unless you acted fraudulently or with gross negligence.

What security features should my online banking have?

All reputable UK banks provide: two-factor authentication (2FA) using an app, SMS code, or card reader; biometric login (fingerprint or face recognition); real-time transaction alerts by push notification; the ability to instantly freeze your card via the app; trusted payee verification for new bank transfers; and automatic logout after inactivity. Enable every security feature your bank offers — these are your primary line of defence against account takeover.

Can my bank refund money stolen through online fraud?

Usually yes. For unauthorised transactions (where you did not authorise the payment), banks must refund you under the Payment Services Regulations 2017 unless you acted fraudulently or with gross negligence. For Authorised Push Payment (APP) fraud — where you were deceived into sending money yourself — the PSR's mandatory reimbursement rules (in force from October 2024) require banks to refund victims up to £85,000 in most cases within 5 business days. If your bank refuses to refund, escalate to the Financial Ombudsman Service free of charge.

What should I do if my online banking is hacked?

Act immediately: call your bank's fraud line using the number on the back of your card (or dial 159, the Stop Scams UK hotline). Report every recent unauthorised transaction. Your bank will freeze affected accounts and issue replacement cards. Change your online banking password and any accounts sharing the same password from a clean device. Report to Action Fraud (0300 123 2040 or actionfraud.police.uk). Do not log back in from any device you suspect may be compromised until it has been cleaned.

What is APP fraud and how does the UK reimbursement scheme work?

Authorised Push Payment (APP) fraud is when criminals trick you into transferring money to a fraudulent account — by impersonating your bank, HMRC, a solicitor, or a supplier. You authorise the payment yourself, which is why it was historically harder to reclaim. From October 2024, the Payment Systems Regulator (PSR) made reimbursement mandatory for APP fraud up to £85,000 per claim for consumers using Faster Payments. Banks must reimburse within 5 business days in most cases, split between your sending bank and the receiving bank. Exceptions include cases where the victim acted with gross negligence or ignored clear fraud warnings.

Does the 159 Stop Scams hotline work?

Yes. Dialling 159 connects you directly to the fraud department of your bank — without you needing to find or type the number. It works for most major UK banks including Barclays, HSBC, Lloyds, NatWest, Nationwide, Santander, TSB, and others. Use 159 if you receive a suspicious call claiming to be from your bank and want to verify whether it is genuine, or if you think you have been targeted by a scam. The service operates 24/7 and is free to call from UK landlines and most mobiles.

Safe Online Banking UK — How to Protect Your Money | PocketWise

Part of the Bank Security UK 2026 guide.

Online banking is among the safest ways to manage your money — but it requires security awareness. UK banks invest heavily in fraud detection and customer protection; the weak point in almost every successful attack is human behaviour, not the bank’s systems. This guide covers exactly what your bank does to protect you, what you must do yourself, and your rights if something goes wrong.

How Banks Protect You

Security Features

UK banks are required to implement Strong Customer Authentication (SCA) under the Payment Services Regulations 2017 — meaning at least two of three factors must be verified for sensitive operations.

Protection	What It Does
End-to-end encryption	Scrambles all data in transit — the padlock symbol confirms it
Two-factor authentication (2FA)	Second verification step via app, SMS, or card reader
Biometrics	Fingerprint or face recognition — faster and more secure than passwords
Real-time fraud monitoring	Automated systems flag unusual patterns and can block suspicious payments
Automatic session timeout	Logs you out after inactivity — limits exposure if you forget
Secure in-app messaging	Encrypted communication — safer than email for sensitive queries

Authentication Methods

Method	How It Works
Password + memorable information	Something you know
Card reader device	Something you have
Mobile app push notification	Something you have
SMS one-time passcode	Something you have (weaker — can be SIM-swapped)
Biometrics (fingerprint/face)	Something you are — strongest option

Account Protection Features

Feature	What It Prevents
Real-time transaction alerts	Unknown transactions spotted immediately
Instant card freeze via app	Limits damage if card stolen or lost
Spending limits	Caps daily ATM and payment amounts
Trusted payee list	Additional confirmation required for new recipients
Cooling-off periods	Delays large transfers to new payees — gives time to spot scams

Your Security Responsibilities

Strong Passwords

Do	Don’t
Use 12+ characters	Use pet names, birthdays, or addresses
Mix letters, numbers, and symbols	Use the same password on multiple sites
Use a password manager	Write passwords in a notebook or phone note
Make it unique to your bank	Share it with anyone — including family
Change it immediately if you suspect compromise	Tell it to callers claiming to be your bank

Secure Logins

Best Practice	Why It Matters
Type your bank’s URL directly into the address bar	Phishing sites use near-identical URLs
Check for the padlock symbol and correct domain	Confirms you are on the real encrypted site
Use your bank’s official app, downloaded from the App Store or Google Play	Third-party apps may be malicious
Log out fully after each session — don’t just close the tab	Active sessions can be hijacked
Never log in from links in emails or text messages	These are the primary phishing vector

Device Security

Protection	Action Required
Keep your operating system updated	Security patches close vulnerabilities
Use reputable antivirus software	Particularly important on Windows
Lock your phone with a PIN, fingerprint, or face	Prevents access if lost or stolen
Do not root or jailbreak your phone	Removes security protections
Only install apps from official stores	Sideloaded apps may contain malware

Avoiding Common Risks

Phishing — What It Looks Like

Phishing is the most common method used to steal online banking credentials. Fraudsters send emails or texts that appear to be from your bank, creating urgency to make you act without thinking.

Phishing Sign	What to Do
Unexpected email or text from “your bank”	Do not click any links
Urgent message: “Your account has been suspended”	Creates panic — log in directly via the app instead
Link to “verify your details”	Leads to a fake site — check the URL carefully
Generic greeting: “Dear customer”	Your bank uses your full name
Sender address doesn’t match the bank’s domain	Check carefully — fraudsters use slight misspellings

What Banks Will Never Ask For

No genuine UK bank will ever ask you for:

They Will Never Ask	Why It Matters
Your full password	They cannot see it and do not need it
Your PIN	Never, under any circumstances
One-time passcodes to read out to them	You use the code; you do not share it
To transfer money to a “safe account”	There is no such thing — this is always fraud
To allow remote access to your computer	Not for security purposes

Public Wi-Fi

Never access online banking on public Wi-Fi — coffee shops, hotels, airports, and other shared networks can be monitored, and fraudsters sometimes set up fake networks with convincing names. Use your mobile data connection instead. If you must use a shared network, a reputable VPN adds a layer of protection.

Recognising Fraud Attempts

Phone Scams (Vishing)

Vishing — voice phishing — involves callers impersonating your bank’s fraud department. This is one of the most effective scams because callers can be highly convincing. For a comprehensive breakdown of the most common scam types and how to spot them, see our bank scams and fraud guide.

Common Approach	The Red Flag
“We’ve detected fraud on your account”	Banks monitor fraud without needing to verify via cold calls
“Please confirm your security details”	They would not need to ask — they already hold them
“Transfer your money to a safe account for protection”	Classic APP fraud setup — no safe account exists
“Don’t tell other bank staff — this is confidential”	Any instruction to conceal is a scam
They know your name and partial account details	Fraudsters buy personal data — knowledge is not proof of identity

What to do: Hang up. Wait at least 5 minutes (fraudsters can hold the line open). Then call your bank directly using the number on the back of your card, or dial 159 — the Stop Scams UK hotline that connects you to your bank’s fraud team.

Email and Text Scams (Phishing and Smishing)

Warning Sign	Check
Unexpected contact about your account	Did you initiate this?
Urgency — “act within 24 hours”	Pressure to bypass rational thinking
Link to click	Hover over it to see the real URL
Request for personal or financial information	Banks do not ask for this by email or text
Poor spelling or grammar	Often present, though sophisticated scams may not have this

If Something Goes Wrong

Unauthorised Transactions

Step	Action
1	Call your bank’s fraud line immediately — use the number on your card or dial 159
2	Do not use any device you suspect may be compromised
3	Your bank will freeze affected accounts and issue replacement cards
4	Report to Action Fraud: 0300 123 2040 or actionfraud.police.uk
5	Change all passwords from a clean, trusted device

Your Rights

Under the Payment Services Regulations 2017, UK banks must refund unauthorised transactions promptly — typically by the next business day — unless they can prove you acted fraudulently or with gross negligence. “Gross negligence” is a high legal bar: forgetting to log out or being deceived by a sophisticated scam generally does not meet it.

For APP fraud (where you transferred money under false pretences), the PSR’s mandatory reimbursement rules from October 2024 require your sending bank to reimburse you up to £85,000 in most cases within 5 business days.

Scenario	What Your Bank Must Do
Unauthorised transaction (you didn’t approve it)	Refund promptly — typically next business day
Card fraud	Almost always refunded
Account takeover	Should be refunded unless gross negligence
APP fraud (deceived into transferring money)	Mandatory reimbursement up to £85,000 (PSR rules, Oct 2024)

If Your Bank Refuses to Refund

If your bank denies your refund claim or does not resolve it within 8 weeks, you can escalate to the Financial Ombudsman Service free of charge. The FOS can order your bank to pay compensation and is the most effective route if your bank is being unreasonable.

Step	Action
1	Request a written explanation of the refusal
2	Submit a formal complaint to your bank in writing
3	If unresolved within 8 weeks, escalate to the Financial Ombudsman
4	The FOS adjudicates free of charge and can order refunds

Safe Online Banking Checklist

One-Time Setup

Action	Done
Enable two-factor authentication	☐
Set a strong, unique password	☐
Enable biometric login on the app	☐
Turn on real-time transaction alerts	☐
Register your device properly	☐
Save your bank’s fraud line number	☐

Regular Habits

Action	Frequency
Check transactions for anything unfamiliar	Weekly
Update your banking app	When available
Review account security settings	Quarterly
Monitor for data breach notifications	When notified

What Never to Do

Never	Why
Share your password or PIN with anyone	Including family — your bank will not ask
Click email or text links to reach your bank	Go direct via the app or type the URL
Bank on public Wi-Fi	Risk of interception — use mobile data
Read out one-time codes to callers	Codes are yours to use, not share
Allow remote access to your computer for “security”	Always a scam

Key Fraud Contacts

Organisation	Contact
Stop Scams UK (any major bank)	159
Action Fraud	0300 123 2040 or actionfraud.police.uk
Barclays fraud line	0800 400 100
HSBC fraud line	0800 783 8330
Lloyds fraud line	0800 072 8805
NatWest fraud line	0800 161 5149
Nationwide fraud line	0800 030 4057
Santander fraud line	0800 171 2171

Always use the number on the back of your card or statement — never a number given to you by a caller or found in an email.

More from the Bank Security guide:

Safe Online Banking UK — How to Protect Your Money

Contents