Bank fraud is now one of the most common crimes in the US, the UK, and across Europe, and most successful attacks do not involve “hacking” in the movie sense. Criminals steal a password, trick a person into handing over a code, or persuade someone to send money voluntarily. The good news is that a handful of settings and habits stop the large majority of these attacks. This guide walks you through them and links to detailed step-by-step articles for each area.
Last updated: October 2026. Features and rules differ by bank and country, so check your own bank’s help pages for exact steps. This article is general information, not legal or financial advice.
Can you really “lock” a bank account?
Most banks do not have a single button that locks an entire account. What they offer instead is a set of controls that together do the same job: locking or freezing your cards, blocking certain types of payment, setting transaction limits, requiring extra approval for new payees, and sending instant alerts. We cover exactly how to use them in our guide to locking your bank account and cards. If you ever need a full freeze, you can phone your bank and ask them to restrict the account.
How criminals actually get into bank accounts
Understanding the main routes makes it easier to block them:
- Phishing: Fake emails, texts or websites that look like your bank and steal your login details.
- Impersonation calls: Someone claiming to be from your bank’s fraud team, often from a number that looks genuine, who pressures you to act.
- Reused or weak passwords: Passwords leaked in one data breach are tried on banking sites.
- SIM swapping: A criminal takes control of your phone number to receive your text message codes.
- Malware and remote access: Software on your device that records what you type, or a scammer persuading you to install a screen-sharing app.
- Authorised payment scams: You are tricked into sending the money yourself.
The 10-step bank security checklist
1. Use a unique, strong password for your bank
Your banking password should be long, random, and used nowhere else. The easiest way is a password manager, which creates and stores these for you. See our guide to the best password managers to pick one.
2. Turn on the strongest two-factor authentication
Two-factor authentication means a stolen password alone is not enough. Where possible, use an authenticator app, a passkey or a hardware security key rather than text messages. Our guide on two-factor authentication and passkeys for banking explains the options and how to protect against SIM swapping.
3. Turn on instant alerts
Set up push notifications or text alerts for every transaction, login, password change and new payee. Fast alerts let you catch fraud within minutes instead of days.
4. Use your bank’s official app
Download the app only from your phone’s official app store, and keep it updated. Log in through the app or by typing your bank’s web address yourself, never by clicking a link in a message.
5. Lock cards when you are not using them
Many banks let you freeze a debit or credit card instantly in the app and unfreeze it when needed. It is a quick way to shut out a thief if your card details leak.
6. Set sensible limits and block what you do not use
Lower your daily transfer limit and card limits to a level that matches your normal spending. Switch off overseas payments, contactless payments or online purchases if you do not need them.
7. Secure your email account
Your email is the key to every other account, because password reset links go there. Protect it with a unique password and strong two-factor authentication. If a criminal controls your email, they can often reset your bank password.
8. Keep your devices updated
Install system and app updates promptly, use a screen lock, and only install apps from official stores. Never install software at the request of someone who contacts you.
9. Avoid public Wi-Fi for banking
Use your mobile connection or a trusted network for banking. If you must use public Wi-Fi, avoid logging in to financial accounts.
10. Know the scam warning signs
The biggest risk today is being persuaded to approve a payment. Learn the common patterns in our guide to common bank scams in 2026.
The golden rules that stop most fraud
- Your bank will never ask you to move money to a “safe account.” Any request like that is a scam.
- Never share a one-time code, even with someone who says they are from your bank.
- Hang up and call back. If a call, text or email worries you, end it and phone the number on the back of your card or on your bank’s official website.
- Be suspicious of urgency. Pressure to act “right now” is a classic manipulation tactic.
- Never give remote access to your phone or computer to someone who contacted you.
Protect your identity too
Bank security is part of a wider picture. If criminals steal your personal details, they can try to open accounts or take out credit in your name. In the US, a credit freeze is a free and powerful defence, and other countries have their own options. Read our guide on how to freeze your credit for the details.
What protections do you have if fraud happens?
Your rights depend on where you live and how the fraud happened, but the key point everywhere is to report it quickly.
- United States: For unauthorised debit card or electronic transfers, federal rules limit your liability, but the amount depends on how fast you report. Reporting within two business days of learning about the loss generally caps your liability at $50, while waiting longer can increase it significantly. For credit cards, federal law generally caps liability for unauthorised charges at $50, and many banks offer zero-liability policies.
- United Kingdom: Banks generally refund unauthorised payments. Since October 2024, mandatory rules require banks to reimburse many victims of bank transfer scams, up to £85,000 per claim for Faster Payments and CHAPS, provided you report within 13 months. Some exceptions apply, so check with your bank.
- European Union: Rules on payment services generally require banks to refund unauthorised transactions promptly, with limited exceptions, and strong customer authentication is required for many payments. Rules vary by country.
If you suspect fraud, follow our step-by-step guide on what to do if your bank account is hacked.
Quick reference table
| Risk | Best defence |
| Stolen or reused password | Unique password from a password manager |
| Stolen login details | Authenticator app, passkey or security key |
| SIM swapping | Avoid text-message codes and add a PIN with your phone carrier |
| Phishing links | Use the official app, never click message links |
| Fake bank calls | Hang up and call back on the official number |
| Card theft or leaks | Freeze the card in your app and enable alerts |
| Identity theft | Credit freeze and monitoring |
Frequently asked questions
Can hackers get into my bank account with only my account number?
An account number alone is not usually enough to log in, but it can be used for some payment fraud. Protect it and watch for unusual activity.
Is mobile banking safe?
Mobile banking is generally safe when you use the official app, a screen lock, an updated phone and strong two-factor authentication.
What is the safest form of two-factor authentication?
Hardware security keys and passkeys are the strongest options, followed by authenticator apps. Text messages are better than nothing but are more vulnerable.
Should I freeze my debit card when I am not using it?
It is a good habit if your bank offers an instant freeze, because it blocks fraudulent card payments until you unfreeze it.
What should I do first if I think my account is hacked?
Contact your bank straight away using its official number, and follow the steps in our guide to what to do if your bank account is hacked.
Strong security does not need to be complicated. Start with a unique password, a strong second factor, and instant alerts, then work through the rest of the checklist. Each step makes your account a harder target.
