Is Online Banking Safe? (Your Guide to Internet Banking Security)

First Things First – What Is Online Banking?

Online banking is an electronic payment system that lets you make payments using your account or credit card on the web by using your bank’s website or dedicated application. The whole online banking system will either be part of your bank’s core banking system, or will just connect to it.

Online banking is more than just financial transactions, though. It can also represent the act of just logging into your account to check your balance or download statements.

So, Is Online Banking Safe?

Generally, yes it is. It’s true that banks are very often targeted by cybercriminals, and they sometimes manage to steal a lot of money from them too. However, that’s not exactly the kind of online banking we’re referring to now since hackers aren’t targeting you – the bank client – but the bank itself. Also, there’s not much you can do to prevent that other than picking a reliable bank that takes security very seriously.

With that out of the way, online banking tends to be pretty secure. Of course, that’s only the case if you follow the proper security procedures – something not all banks are willing to talk about. We’ll tell you about Internet banking security tips in a bit, but first – let’s see exactly which security threats can ruin your online banking experience:

1. Compromised/Fake Banking Apps

Dedicated online banking apps can be pretty secure, but they’re not without their faults. Back in 2017, it was actually discovered that many banking applications had security flaws that would have allowed cybercriminals to steal user data.

Not only that, but hackers can also use seemingly-innocent apps that are actually malicious to compromise the banking apps that are already installed on your device. Basically, the malicious app downloads a secondary app which then inserts an overlay window over your banking apps. The moment you enter your login credentials in your bank’s app, they will be as good as gone.

What’s more, online banking apps don’t just have their fair share of security problems. They can also be impersonated with enough effort. Back in 2018, big-name banks (like SBI, Axis Bank, and ICICI) had their dedicated apps impersonated by cybercriminals who used them to steal data from thousands of people.

2. Public WiFi

We mostly use digital money nowadays instead of just cash, so doing online banking over public WiFi is pretty much second nature to us. Sometimes you just have to access your account on the spot to move some money to your credit card so that you can pay the restaurant bill, right?

That’s when public WiFi really comes in handy, true, but there’s just one problem with using it: Your online banking security can easily be compromised. Why? Because most public WiFi networks aren’t encrypted – in fact, around 24.7% of worldwide WiFi networks (so around 106 million networks by 2020) aren’t secured at all.

What does that mean for you? That any would-be hacker can see everything you do on the Internet when using unsecured public WiFi. They can see the login credentials you enter when accessing your bank account, and what your credit card numbers are.

“Okay so I’ll just use secured networks – like the one I have at home. Problem solved, right?”

Not exactly. Currently, pretty much any secured WiFi network uses WPA2 encryption for security. The problem with that is that WPA2 isn’t exactly foolproof. In fact, it’s vulnerable to a specific type of hacker attack called the KRACK attack. Luckily, WPA3 will fix that problem, but according to sources, it will take years for widespread WPA3 adoption to take place.

3. Errors on the Bank’s Side

Sometimes, it’s not just cybercriminals who make life hard for online banking users. It’s actually the banks themselves. And we’re not just talking about security errors on their behalf, though that kind of stuff belongs here too.

No, what we’re talking about is banks suffering data breaches or losing access to sensitive customer data, and not letting their customers know about them. Yes, that kind of stuff has happened before, and the Australian CBA bank is the latest example, losing around 20 million customer records back in 2016 without alerting anyone about it.

It can be a bit understandable why banks might not immediately notify users about stuff like that. After all, they want to avoid mass panicking and account closures while they fix the problem. However, there’s always a chance something will go wrong again, and that your financial and personal data will be exposed because of human or software error. If it already happened once, it can happen twice.

In situations like that, you end up being kept in the dark without realizing cybercriminals could get access to your financial and personal information any day.

4. Phishing

Phishing can be defined as a cybercriminal’s attempt at confusing or tricking you into sharing sensitive information with them, like your credit card numbers, bank account numbers, and online banking login credentials. Phishing normally uses email and social media as distribution channels, but it can also be done over the phone.

When it comes to online banking, scammers behind phishing attacks will sometimes try to pretend they’re someone from your bank, and use their position of authority to get you to disclose various data. They’ll very likely tell you there’s a problem with your finances, or that they noticed suspicious activity on your account.

More often than not, though, they’ll just try to convince you to access a shortened link. Said link will lead to a fake website they set up to resemble your bank’s website. Back in 2017, phishing messages that directed users to bank-related malicious websites were the most common, and it’s not very likely that that trend has disappeared.

Overall, if you fall for a phishing scam, you can rest assured that:

• The login credentials for your bank account will be stolen.
• Your online bank account will be emptied.
• Your account information (email address, physical address, full name, mobile number, etc.) will be sold on the deep web.

5. Pharming

Pharming is similar to phishing, but instead of relying on tricks and deceit, it automatically redirects you to malicious websites. Basically, you type in your bank’s website address, and you’re redirected to a fake website posing as it without you even knowing. Obviously, the hacker behind this will get access to all your bank-related info once you start typing it in.

Pharming either relies on malware to alter the Hosts files (the files that link an IP address to a website domain) on your computer, or on poisoning your ISP’s DNS servers so that all users who use them to connect to a specific website are redirected to the cybercriminal’s own site.

6. Keyloggers

A keyloggers is a type of malware that infects your device, and starts logging all your keystrokes on it. All that info is compiled into a log file which a hacker can retrieve any time. So, basically, whoever exposes you to a keylogger will know every single thing you type on your computer – including your online banking login credentials.

Your device can get infected with keyloggers if you interact with phishing messages and malicious websites, but someone can place the keylogger on your device if they have direct access to it as well.

Other types of malware might be used to compromise your Internet banking security too (like spyware and viruses, for example), but keyloggers are normally the most dangerous ones in this situation.

Does a Virtual Keyboard Help?

Some people claim that a virtual keyboard keeps you 100% safe from keylogging malware. That is true since there is no signal sent to the physical keyboard, as you’ll just be using a software-powered keyboard that shows up on your desktop to type in your login credentials.

However, we don’t recommend using a virtual keyboard as the ultimate solution. While keyloggers might not be able to steal your login credentials (and other data), spyware would manage to do that. How? By taking screenshots of your desktop, essentially seeing what you type on the virtual keyboard.

Here’s How to Boost Your Online Banking Security

1. Don’t Do Online Banking on WiFi

Now that you know the dangers of both unsecured and secured WiFi, it’s pretty obvious you’re better off doing your online banking without using it. Of course, that’s easier said than done, and it can definitely be pretty inconvenient.

Overall, your best bet is to either use your mobile data plan to check your bank accounts, or to make sure your Internet connection at home comes directly from the router, not from a WiFi connection.

Of course, there’s another thing you can try to completely eliminate the risk of WiFi putting your Internet banking security in danger, which we’ll discuss below.

2. Use a VPN for Online Banking

“Wait – is VPN safe for online banking?”

Yes, it certainly is. A VPN is an online service that encrypts your online traffic, making sure that nobody can monitor it to see what you’re doing on the Internet. That also means cybercriminals won’t be able to eavesdrop on your Internet connections to steal sensitive online bank account data from you.

A VPN is so secure in fact that you can even use it to do online banking while conveniently using public, unencrypted WiFi. You can even set up a VPN on your router to make sure you don’t need to worry about online banking security threats at all.

3. Enable Multi-Factor Authentication on Your Account

Multi-factor authentication is a great way to offer your bank account an extra layer of security. Normally, this feature requires you to enter an extra code when logging into your account online – right after you type in your login credentials. The code will either be generated on your mobile device (through an app like Google Authenticator), or you’ll receive a text message with it.

“What if my bank doesn’t offer multi-factor authentication?”

That’s a pretty big red flag, honestly. You’re better off changing banks in that case. Otherwise, there will be nothing standing in the way of hackers if they ever manage to steal your login credentials.

4. Learn How to Spot Fake Banking Apps

How can you tell whether or not your bank’s app is legit? Well, here are some things you should try out:

• Look at the developer’s name. Normally, a bank won’t have a person’s name there – just the bank’s name. If that’s not the case, you’re likely dealing with a fake application. Also, make sure the bank’s real website is present there too.
• Read the description – don’t just scan it. Fake apps normally won’t have detailed explanations of how the application works and what features it has. Also, you’ll likely spot some typos or weird phrasing as well.
• Check the number of downloads. If it’s too low, that can be a problem – especially if the app has been available on the app store for a while.
• Look for reviews. Normally, an online banking app should have a decent number of them – especially if there were some bugs with it. If it’s a fake app, you’re very likely to find many people complaining about that in the reviews.
• If the app description claims to offer you rewards and prizes (especially money) for downloading, installing, and using it, it’s very likely a fake application just trying to steal your login credentials.
• Check the logo. If it seems very low-res, or is slightly different from the bank’s normal logo, the app is likely fake.
• And lastly – check with someone at your bank that the app you found is the real deal. If you don’t have time for that, double-check it’s the same app by visiting the bank’s official website. It should normally have links to its apps over there.

But if you’re still not 100% sure the banking app you found is not compromised or fake, then just use the bank’s website instead.

5. Use a Powerful Password for Your Online Banking Accounts

Your bank will probably tell you this anyway, and most banks make it mandatory for you to create strong passwords. Still, if you’re not sure how to do it, here are some pointers:

• Use numbers, symbols, and mix up lowercase and uppercase letters.
• Don’t use short passwords. Most people and banks say that 8 characters is enough, but we recommend aiming for 15 characters or more.
• If you’re low on ideas, just make your password an acronym for a phrase (“WvSe10y“ for “We visit Spain every 10 years,” for example).
• Don’t use dictionary words. If you really need to use words, reverse them.
• Stay away from substitutions that are a dead giveaway (“0” instead of “o” or “$” instead of “s”).
• If your bank allows it, insert a few space characters.
• Try using a password generator if you don’t have time to come up with multiple secure passwords.

Learn more about password security.

6. Don’t Keep Automatic Login Enabled on Browsers

Sure, automatic login can be convenient – especially if you use a strong password, and you have multiple bank accounts. It sure beats having to manually type your long password while double-checking the notebook or paper you wrote them on every 2-3 seconds, right?

That’s true, but it also opens you to other potential dangers. For example, if somebody were to steal your phone or laptop, or break into your home and access your computer, they’d have instant access to your bank accounts.

So, it’s best to avoid automatic login. But that doesn’t mean you’ll have to manually enter your passwords every time you want to check your account balances. If you use a password manager (like Bitwarden, KeePassX or LessPass), it will auto-complete any login forms you allow it to.

“But isn’t that the same thing as someone having access to my phone or PC with automatic login turned on on my browsers?”

No, because a reliable password manager will authenticate you every time you want to autofill your login credentials for a certain account. Yes, that means you’ll still be typing in a password, but at least it will be a single master password.

7. Don’t Do Online Banking on Public Computers

Just like you shouldn’t do online banking on public WiFi without using the proper protection, you shouldn’t do that on public computers either. Why? Because there’s always a risk the computer has been infected with spyware, or had keyloggers uploaded on it.

If that’s the case, and you access your bank account, whoever placed the malware on the computer can always just come at the end of the day and retrieve the logs containing your login credentials – that’s if they don’t have remote access to the computer, in which case they just need to monitor what you do while you use it.

8. Ignore, Delete, and Report Phishing Messages

Phishing is one way cybercriminals aim to steal your online bank account login credentials. Basically, phishing represents a hacker’s attempt to trick you into revealing that info.

They will usually send fake messages claiming to be a representative or an IT support technician from your bank asking you to confirm your account by providing them with information like account name, account holder, password, or credit card number. Alternatively, they could do the same thing, but ask you to access a link, or download an attachment. If you do any of that, you’ll either be redirected to a phishing website, or have your device infected with malware (spyware or keyloggers, most likely).

Those are just some possible scenarios, but you get the idea. Basically, if you receive any message from someone claiming to be working for your bank asking you for sensitive information or access to your account, don’t respond to them. Your bank will never ask you for something like that. To be 100% sure, contact your bank to ask them about the message to see if it’s legit.

In case it isn’t, delete them, report them as spam, block the sender address, and get in touch with the local authorities if your country’s laws allow that.

If you’d like to learn more about phishing (especially how to protect yourself from it), here’s a guide we wrote about it, alongside other threats too.

9. Make Sure Your ISP Takes Security Seriously

What does your ISP have to do with online banking? It’s simple – an ISP that has lax security standards will likely fall victim to DNS poisoning, a form of pharming attack that will change the tables on the DNS server. Basically, the DNS server your ISP uses will be hijacked and, as a result, you and all other users accessing websites through it will be redirected to fake, malicious websites instead.

You won’t ever be able to take a tour of your ISP’s server rooms, and monitor how their IT security teams maintain the servers and data, of course, but you can always ask your ISP what measures they take to protect their DNS servers from pharming attacks. If they take the time to explain what procedures they follow, and don’t try to blow you off with generic jargon, that’s a good sign.

In case you’d like to learn more about pharming, just check out the article we linked above.

10. Install Reliable Antivirus/Antimalware Software

Malware and viruses can often endanger your bank account. So, it’s important to keep your device safe from them. After all, it doesn’t matter if your ISP and bank are doing everything they can to offer you top-notch online banking security. If you aren’t doing that too, and your device is infected with malware, it’s game over.

There are plenty of antivirus/antimalware software providers to choose from, but our recommendations are Malwarebytes and ESET.

Oh, and be sure to install their dedicated apps on your mobile device(s) too.

11. Keep Everything (OS, Antivirus/Antimalware, Browser) Up-to-Date

Regular updates can be a bit annoying since they always seem to get in the way of what you’re doing. But without those regular updates, you’d be at the mercy of cybercriminals.

You see, updates can often contain critical tweaks that patch minor vulnerabilities in an OS or browser, vulnerabilities which a hacker could exploit. Also, regular updates make sure your antivirus/antimalware program can keep up with the new forms of malware that keep popping up almost every 10 seconds according to security experts.

12. Secure Your Mobile Device

If you use your mobile phone to do online banking, and end up losing it or having it stolen, there’s a chance the person who ends up finding it/stealing it could use the info on your device to compromise your bank accounts.

That’s why you need to make sure your mobile device is properly secured, so that it can’t be accessed by anyone but you. Here are three ways to do that:

1. Use a strong passcode for your iOS devices, and a powerful password for your Android devices. There are tools that can crack short passcodes/passwords (like 6 digits), so make them over 10 digits, and try using invented words or random letters instead of numbers.
2. Use a Fingerprint Scanner feature or app if it’s available for your device.
3. Turn off Lock Screen Notifications, so that the person who has your phone but still can’t unlock it can’t see any important notifications that pop up.

Besides that, you should also keep Bluetooth turned off when you’re not using it. This isn’t something that will secure your phone if it’s lost or stolen, but it will help keep it safe otherwise. Why? Because Bluetooth actually has had serious vulnerabilities over the past years. One of them made it possible for cybercriminals to silently hack mobile devices that had Bluetooth turned on. Another one allowed hackers to compromise your device’s cryptographic keys with MITM attacks.

13. Work With a Reliable Bank

This isn’t much of an advice since it’s pretty obvious, but what exactly does a “reliable bank” mean? Well, it should be one that meets the following requirements:

• It has its dedicated app, which it advertises on its website, and updates regularly.
• It allows you to use multi-factor authentication to log into your account. Password-protected transactions are also a good sign.
• The bank lets you set up text message notification for account transactions. That makes it easier to monitor your account activity.
• The bank’s representatives are able (at least to a certain degree) to explain how they ensure your online banking security.
• It requires you to use a strong password when logging in. Also, a bank that makes it mandatory to change your password regularly (every month, for example) is trustworthy too.

Is Online Banking Safe? The Bottom Line

So, how safe is online banking?

Generally, it’s pretty secure, but there are plenty of risks associated with it, such as phishing, pharming, data breaches or errors the bank doesn’t mention, fake or compromised banking apps, keyloggers (and other types of malware), and WiFi vulnerabilities.

Fortunately, there are some things you can do to make sure you get to enjoy decent Internet banking security:

• Use your data plan instead of WiFi when doing online banking.
• Use a secure VPN for online banking – especially on WiFi.
• Install strong antivirus/antimalware software on your device, and keep it (alongside your OS and browser) up-to-date.
• Only work with a bank you can trust.
• Activate multi-factor authentication for your bank account.
• Make sure your mobile device is 100% secured.
• Take the time to see if your ISP knows how to protect its DNS servers from pharming.
• Do not reply to or interact with any phishing messages.
• Never do any online banking on public computers.
• Come up with a strong password for your bank account.
• Don’t enable automatic login on browsers.
• Learn what the signs of fake banking apps are, and avoid them.