Banking App Security

One universal, easy-to-follow guide for every bank on your phone. Protect your savings, verify payments, enable real-time alerts, and guard against fraud.

Digital Security Centre / Banking App Security

Use this example for every bank

In this guide, we use the name MyBank as our example. It represents whichever bank or building society you use (such as Barclays, HSBC, Lloyds, NatWest, Santander, Monzo, or Nationwide). Menu names can differ slightly, but look for Profile, Security, Settings, Privacy, or Manage Devices.

Start with your phone's foundation: Your banking app is only as safe as the smartphone holding it. Before anything else, ensure your phone has a strong 6-digit screen lock PIN, active Face ID or fingerprint scan, the latest system updates, and tracking enabled via Find My (iPhone) or Find My Device (Android).

How criminals attempt to steal money

Bank robbers do not break through physical vault doors anymore; they use social engineering to trick you into opening the door for them. Understanding their exact playbook keeps you completely safe:

📞
1. Incoming Call
Pretends to be bank fraud team
🔗
2. Fake Link
Sends an urgent SMS link
🔑
3. Asks For Code
Wants your temporary 2FA
✅
4. Tricked Approval
Asks you to tap approve
💸
5. Money Gone
Authorised push payment

Legitimate bank staff will never phone you asking for your online password, full secret passcode, one-time SMS verification code, or screen-sharing access. Scammers can spoof caller ID numbers to match the real phone number of your local branch. Always hang up immediately and phone your bank back using the telephone number printed on the back of your debit card.

The Golden Security Rule: Never approve a login prompt, new payee request, or payment transfer notification on your phone that you did not initiate yourself. Never, under any circumstances, transfer money to a so-called "safe account". Real banks do not have safe accounts.

1Secure the app — repeat for every banking service

Follow these setup rules whether you have one current account or multiple finance apps:

A. Safe download & sign-in

  1. Open the official Apple App Store (iPhone/iPad) or Google Play Store (Android).
  2. Type your bank's exact name into the search bar and verify that the listed developer is the official corporate bank.
  3. Never tap download links inside text messages, emails, or internet pop-up ads.
  4. Complete initial registration over your secure home Wi-Fi or mobile data network. Never set up a banking app on unencrypted public Wi-Fi (such as cafes, airports, or trains).

B. Turn on biometrics & app locks

  1. Open your banking app.
  2. Tap on Profile, More, or the Settings gear icon.
  3. Select Security, Login Settings, or Biometrics.
  4. Toggle ON options for Face ID, Touch ID, or Fingerprint Login.
  5. Ensure the app is configured to lock immediately every single time you switch to another screen or minimize the app.
Double-Layer Phone Lock:
• On iPhone (iOS 18+): Go to your Home Screen, touch and hold your banking app icon for 1 second, and tap Require Face ID. This means your face is needed before the app icon will even launch!
• On Android: Open your phone's Settings > Security & privacy and enable Private Space, or use Samsung Secure Folder to store a secondary locked copy of your financial apps.

2Turn on real-time alerts and purge old devices

Instant push notifications act as a security siren. If someone attempts to spend even £1 from your account, your phone will alert you instantly.

MyBank → Profile / Settings → Notifications / Alerts
  1. Turn on instant transaction alerts: Enable push notifications for every payment, contactless tap, and direct debit.
  2. Turn on ATM cash withdrawal alerts: If offered, switch on instant notifications whenever cash is withdrawn from an ATM.
  3. Turn on payee & login alerts: Ensure you receive an alert whenever a new payee is added, your password is changed, or a new device signs in.
  4. Audit contact details: Check that the registered mobile number and recovery email listed in your bank profile are completely up to date and belong to you.
MyBank → Profile / Settings → Security → Manage Devices / Linked Hardware
  1. Open the registered devices dashboard in your banking app.
  2. Review every phone, tablet, and computer authorized to access your money.
  3. If you see an old mobile you traded in, a family tablet, or an unfamiliar model name, tap Remove Device or Deregister immediately.
  4. If you spot an active session you do not recognize, immediately freeze your account and ring the bank fraud team.

3Make payments safely and avoid fraud traps

Bank transfers happen in seconds and cannot be cancelled like credit cards. Treat sending money like handing physical cash out of your wallet.

A. Before pressing "Send Money"

  1. Pause and verify: Ask yourself: "Why am I sending this money?" Is someone rushing me?
  2. Check every number twice: Look at the 6-digit sort code, the 8-digit account number, and the full legal name of the person.
  3. Confirmation of Payee check: When you enter the name, UK banks will check if the account name matches. If the app warns "Name does not match", stop immediately and investigate!
  4. Never use contact numbers from messages: If a friend or tradesperson texts you new bank details, call their known phone number to verify verbally before sending a single penny.

B. Before tapping "Approve" in the app

  1. Read the prompt screen carefully: When a pop-up appears asking you to approve a transaction, do not just tap confirm.
  2. Inspect the exact amount and payee: Does the price match what you are actually buying?
  3. Only approve what you started: If you are browsing Instagram or cooking dinner and a bank notification pops up asking to approve a login or transfer, tap Cancel / Reject! An attacker is trying to push a payment through.
The "Hi Mum / Hi Dad" WhatsApp Scam: A text arrives from an unknown number saying: "Hi Mum, my phone broke so I'm texting from a friend's phone. I urgently need to pay my rent, please transfer £450 to this account." Never send money! Call your family member on their original number or speak to them in person first.

4How to recognise banking scam scripts

Scammers read from psychological scripts designed to panic you into bypassing your own bank's security warnings. Here is how to translate what they say:

What the scammer says What is actually happening Your immediate action
"Your account has been hacked! You must move your funds to our safe holding account right now." They are tricking you into voluntarily transferring your life savings directly to an account they control. Hang up immediately. Banks never have safe accounts. Call 159 or the number on your card.
"I have just sent an authorization code to your phone. Read it aloud so I can cancel the fraud." The scammer is trying to reset your password or set up Apple/Google Pay with your card details. Never read the code aloud. The text literally says "Never share this code with anyone".
"Download AnyDesk or TeamViewer onto your phone so our technical team can remove the virus." They want complete remote control over your phone screen to open your banking app and drain funds. Do not install it. Refuse remote access and disconnect the call.
"A notification just popped up on your banking app. Approve it to decline the fraudulent transaction." The prompt is an actual payment request. Tapping approve sends your money straight to the scammer. Tap Reject / Deny immediately and report the attempt.

5Emergency steps if your phone is lost, stolen, or broken

If your mobile phone goes missing, act swiftly to prevent thieves from attempting to access your banking apps:

  1. Lock your phone remotely: Borrow a family member's phone or computer immediately.
    • For iPhone: Go to icloud.com/find and mark your iPhone as Lost. This suspends Apple Pay cards and locks your screen with a passcode.
    • For Android: Go to google.com/android/find and click Secure Device to lock your phone remotely.
  2. Call your mobile network provider: Inform your network (EE, O2, Vodafone, Three, etc.) that your phone is missing. Ask them to block your SIM card and suspend the IMEI so thieves cannot receive SMS verification codes.
  3. Phone your bank fraud team: Look up your bank's fraud telephone line from another device and call them. Ask them to suspend mobile banking access on that specific device and temporarily freeze your payment cards.
  4. Reset your banking credentials: Sign into online banking from a known clean computer or tablet and change your password and secret passcode.
  5. Audit recent transactions: Review your recent account activity for any unfamiliar payments and immediately report unauthorized debits so your bank can file a fraud claim.
Fast action matters: Reporting a missing device within minutes allows your bank to freeze transactions before unauthorized transfers can clear.

Your master banking-app checklist

Every banking app: Turn on biometric Face ID, Touch ID, or fingerprint login.
Every banking app: Enable real-time push notifications for all payments and logins.
Every new payment: Confirm sort codes and account names independently.
Every unexpected phone call: Hang up and call the number on your plastic bank card.
Every few months: Purge old, unused phones from your linked devices list.
Immediately if lost: Remotely lock the phone and call your bank's fraud department.
The One Sentence You Must Remember

"My bank will never phone me to ask for a verification code, will never tell me to move money to a safe account, and will never ask me to approve a notification I did not initiate myself."