A Checklist for Judging Your Online Banking Security
Before you decide your online banking is safe enough, walk through these checks on passwords, two-step verification and login pages. Daniel Fortin explains each one in plain terms.
Daniel Fortin · · 6 minutes to read
Why a checklist beats a gut feeling
Most people judge their online banking security by feel. Nothing bad has happened yet, so it must be fine. I spent years in IT support before teaching, and that feeling is the least reliable measure I know. Problems rarely announce themselves, and the habits that protect you are small, boring and easy to skip when you are busy.
A checklist replaces that feeling with a short set of questions you can answer yes or no. You do not need technical knowledge to use one. You only need your phone, your usual device and about twenty minutes at a quiet moment, ideally not while standing in a queue.
This article is meant for the decision stage. Perhaps you are thinking about starting online banking, changing how you use it, or taking a course on the subject. Go through the points below honestly, and mark where you hesitate. Those hesitations show you where to learn next.
Check one: is your password worth keeping?
Start with the password you use for your banking login. Ask whether you use it anywhere else, even on a small shopping or newsletter site. If the answer is yes, treat it as weak, because a leak from any one of those sites can expose every account that shares it.
A strong password is long rather than clever. Three or four unrelated words strung together, with a number or two, is far harder to guess than a short mix of symbols you will forget. Avoid birthdays, pet names, street names and anything a person could find on your social media.
Then ask where the password lives. Writing it in a notebook kept at home is a perfectly reasonable choice for many adults. A sticky note on the monitor, or a file called passwords on your desktop, is not. Decide on one safe place and use only that.
- Is your bank password different from every other password you use?
- Is it long, ideally several unrelated words?
- Do you know exactly where your written record is kept?
Check two: is two-step verification switched on?
Two-step verification asks for something more than your password, usually a code sent to your phone or generated by an app. It means a stranger who learns your password still cannot walk in. Open your bank's security settings and see whether it is active. If you cannot find the setting, that alone is worth a call to your bank.
Think about how the code reaches you. A text message is better than nothing, but it depends on your phone number staying under your control. If you lose your phone or change carriers, make sure you know how to update the number with the bank before you need to.
Also ask what you would do if the code arrived when you had not tried to log in. That is a warning, not a nuisance. Never read the code aloud to a caller or type it into a page you reached from a message. Your bank will not ask you for it.
Check three: do you know a real login page from a fake?
Fake login pages are built to look identical to the real thing, so appearance alone settles nothing. What matters is how you arrived. If you reached the page by tapping a link in an email or text, treat it as suspect, even when the message looks official and mentions your name.
The safer habit is to type your bank's address yourself, or use a bookmark you saved on a day you were calm. Look at the address bar before you enter anything. Misspellings, extra words and odd endings are common signs of a copy. If anything feels off, close the page and start again from your bookmark.
Ask yourself whether you could explain this habit to a neighbour in one sentence. If you can, it is probably firm. If you are unsure, practise it a few times now, when nothing is at stake, so it feels automatic later.
- Do you reach your bank only through a typed address or saved bookmark?
- Do you read the address bar before signing in?
- Would you close a page that asked for your full PIN?
Check four: are your devices and alerts doing their share?
Your banking is only as safe as the device you use. Check that your phone and computer install updates, that the screen locks after a short time, and that nobody else knows the unlock code. A shared family tablet with a saved banking login is a risk worth fixing.
Next, look at your bank's alerts. Most let you receive a message for every login from a new device, every e-transfer and every large payment. These notices turn a silent problem into one you notice within minutes. Choose the ones that suit your habits and check that they go to a phone you actually carry.
Finally, think about public Wi-Fi. A café network is fine for reading the news and a poor place for banking. If you must check a balance away from home, your phone's own mobile data is the calmer choice.
Reading your answers honestly
Count the points where you answered no or were unsure. One or two gaps are normal, and nearly everyone who joins our classes has some. The aim is not a perfect score but a clear picture of what to fix first, starting with the item that would cause the most harm if it failed.
If the gaps cluster around passwords and verification, spend an evening on those settings and nothing else. If they sit around fake pages and messages, the skill is recognition, and that improves quickly with practice on real examples.
Notice, too, how you felt answering. If several questions made you anxious, that is useful information. It means structured teaching may serve you better than another round of reading, and there is no shame in wanting a guided path.
- Fix the single riskiest gap first.
- Revisit this list after any new phone or new account.
- Ask your bank directly about anything you cannot find.
A checklist will not make you immune to every trick, but it turns vague worry into a few concrete actions you can finish this week. Go through the four checks, note your gaps and fix them one at a time. If you would like guided practice with passwords, two-step verification and spotting fake login pages, the Online Banking Security course covers exactly these skills at an unhurried pace.
Write to us through the contact page with your questions about passwords, verification or fake login pages, and we will point you to the course module that fits.
Tell us which part of online banking security worries you most
ContactSend us a message
Email: hello@corpflowki.com