Digital Bank Security: The Settings That Actually Protect You

Most people who lose money to bank fraud do not lose it because their bank was insecure. They lose it because they were persuaded to authorise a payment, or because a single reusable password gave someone access to everything at once.

The defences that work are unglamorous and take about twenty minutes to set up. What follows is that list, along with the fraud patterns they are designed to defeat.

The four fraud patterns that matter

Pattern	How it works	What defeats it
Authorised push payment fraud	You are persuaded to send money to an account you believe belongs to a legitimate payee	Verifying the recipient independently, through a number you looked up yourself
SIM swap	Your phone number is transferred to a SIM the fraudster controls, intercepting SMS codes	Authenticator apps or hardware keys instead of SMS
Credential reuse	A password leaked from another site is tried against your bank	Unique passwords and a password manager
Remote access fraud	You are talked into installing software that gives the fraudster control of your device	Never installing remote access software at anyone's request

The settings to configure today

1. 1
   Switch from SMS to an authenticator appSMS codes can be intercepted through a SIM swap. An authenticator app is not tied to your phone number.
2. 2
   Set a unique banking passwordNot shared with any other site, stored in a password manager rather than reused or written down.
3. 3
   Turn on transaction notificationsAn alert for every payment means you notice fraud in minutes rather than at month end.
4. 4
   Set a low-balance alertCatches unauthorised withdrawals that do not trigger a transaction notification.
5. 5
   Freeze your card by defaultMany apps let you lock the card and unlock it when you use it. This prevents card-not-present fraud entirely.
6. 6
   Lower your daily payment limitsSet them to what you realistically need. It limits the damage if someone does get access.
7. 7
   Use a separate account for high-risk paymentsKeep your main balance where a compromised card cannot reach it.

What your bank will and will not cover

The distinction that determines reimbursement is whether the payment was authorised by you.

Scenario	Usually reimbursed?	Why
Card cloned and used without your knowledge	Usually	Unauthorised — you did not approve it
Account accessed through a leaked password	Usually	Unauthorised, provided you did not share credentials carelessly
You were tricked into sending money	It depends	Authorised payment — rules vary by country and are changing
You gave someone your PIN voluntarily	Rarely	Gross negligence provisions usually apply
You installed remote access software	Often not	The bank will argue you authorised the access

If you think you have been defrauded

1. 1
   Contact your bank immediatelyUse the number on your card or the app, not a number from a message. Ask them to freeze the account.
2. 2
   Report to the policeIn many countries a police reference is required before a bank will process a fraud claim.
3. 3
   Change your passwordsAll of them, starting with email, since email is how most password resets are completed.
4. 4
   Check your credit fileLook for accounts or searches you do not recognise.
5. 5
   Follow up in writingKeep a dated record of every conversation. Written complaints create an evidence trail.

Frequently asked questions