Secure your online banking after a scam

Assume your banking details may be known

If a scam involved you entering your banking login, a one-time password, or any screen your bank normally controls, treat those details as known to someone else. This applies even if you have not seen an unauthorised transaction yet.

Waiting to see if something happens gives whoever has your details more time to use them. Acting now costs little and closes the door early.

This is separate from whether money has already moved. Securing the login matters on its own.

Change your password and PIN from a safe device

Log in from a device you trust, not the one involved in the scam, and change your online banking password and any transaction PIN. Use a password you have not used anywhere else.

If the scam involved a suspicious app or link on your phone, avoid using that device again until it has been checked or reset. A compromised device can undo a password change almost as soon as you make it.

Change your email password too if it shares any login with your bank, since email is often the key to resetting everything else.

Check your registered phone number and devices

Open your banking app’s settings and check the registered phone number, email, and any devices listed as active. An unfamiliar entry here is a sign access already happened.

Log out of every session you do not recognise, and update the registered phone number immediately if it has been changed without your knowledge. Contact your bank directly if anything here looks wrong.

Turn on extra verification

Enable two-factor authentication or biometric login wherever your bank offers it, since this adds a step a scammer usually cannot complete without your device. It works even if a password alone becomes known later.

This single step closes off many of the ways a scam tries to reach your account again.

What to do next

Watch your account closely for the next few weeks, since some access can sit quietly before being used. Report anything unfamiliar to your bank immediately rather than waiting to see if it happens again.

If you are unsure whether the wider account has been compromised, account takeover walks through what else to check.