Secure online banking by using a long, unique password, enabling the strongest multifactor authentication (MFA) method your bank supports, and protecting the email and phone number used for account recovery. If offered, choose a passkey or security key; otherwise, use an authenticator app or the strongest available alternative. Never share a password or verification code in response to an unexpected message or call.
Secure your bank account in this order
- Open your bank through a trusted route. Use its official app or type a web address you already know. Review the bank’s security, sign-in, or account-protection settings; labels and enrollment steps vary by institution.
- Replace reused or weak passwords. Create a long password used only for this bank. The FTC recommends aiming for at least 12 characters; a random passphrase is another option if the bank accepts it. Reuse is risky because credentials stolen from one service may be tried on other accounts. A password manager can help you create and keep unique passwords.
- Enable MFA and choose the strongest supported method. Prefer a passkey or security key when the bank offers one. If not, choose an authenticator app or another stronger option the bank supports. If codes by text or email are the only choices, enable them rather than leaving the account password-only.
- Review remembered devices. Allow sign-in to be remembered only on a device you control. Do not save your bank login on a public or shared computer.
- Protect recovery channels. Give the email account used for password resets a unique, strong password and MFA. Keep the phone number associated with recovery current and secure.
- Handle unexpected requests safely. Do not follow an unsolicited “account locked” or “verify now” link, or give a caller or sender your password or one-time code. Open the bank’s known app or site yourself and report suspicious messages through a trusted channel.
How passwords, passkeys, and MFA differ
A password is something you know. A passkey uses a FIDO/WebAuthn credential supported by the service and device. An authenticator device or security key is something you have; a fingerprint or face is something you are. MFA combines factors from separate categories. Two steps are not necessarily two factors if both rely on the same category.
Passwords
Length and uniqueness make a password harder to guess and prevent one stolen password from unlocking other accounts where it was reused. They do not stop phishing: a person can still be tricked into entering a strong password on a convincing fake site.
Passkeys
FIDO/WebAuthn passkeys are designed to resist phishing because authentication is tied to the legitimate service rather than a lookalike site. A phone’s fingerprint or face feature does not by itself mean a bank login is using a passkey: the bank must support the method, and you must enroll it.
Recommended Free Tools
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Security keys
A security key is a physical device used as an authentication factor. FTC guidance describes security keys as physical devices and identifies them as the strongest common two-factor method; CISA also rates them highly for phishing resistance. Before choosing one, confirm that your bank and device support it, and consider whether you can keep the key accessible when you need to sign in.
Authenticator apps
An authenticator app may generate one-time codes or provide approval prompts. CISA’s comparison favors number matching over a basic push approval and ranks app-generated codes below number matching. App codes are useful when stronger methods are unavailable, but they are not phishing-proof.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Text and email codes
Codes sent by SMS or email are generally weaker than security keys or authenticator apps in FTC guidance. They are still worth enabling if they are the bank’s only MFA option: an additional check is preferable to relying on a password alone.
Which MFA option should you choose?
| Method | Security and practical trade-off | What to check |
|---|---|---|
| Passkey | Phishing-resistant FIDO/WebAuthn authentication; convenient when enrolled on a device you use. | Your bank must support passkeys, and the device or account holding the passkey must be available. |
| Security key | Physical authentication option with strong phishing resistance; you need the key to complete sign-in. | Confirm bank and device compatibility and plan for secure access to the key. |
| Authenticator app | Stronger alternative to SMS or email codes in FTC guidance; codes require access to the enrolled device. Number matching is preferable to a simple approval prompt where offered. | Check which app-based methods the bank accepts and understand its recovery process if you lose the device. |
| SMS or email code | Convenient but weaker than stronger options. Still useful when it is the only supported MFA method. | Keep the recovery phone number or email secure and current. |
Banks choose which methods to offer, and some use risk-based authentication or layered security controls. Verify current options in the bank’s official app or website, or contact the bank using a trusted channel. CISA summarizes the distinction plainly: “Not all MFA methods gives you the same level of protection.”
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Protect against fake bank messages
Phishing messages impersonate trusted organizations to obtain passwords, codes, or other information. Treat an unexpected request for a bank login or one-time code as suspicious, even if it claims your account is locked or needs urgent verification. Do not click its link or reply with a code. Instead, navigate to the bank through its known app or web address and contact support from there. See the FTC’s guidance on recognizing and avoiding phishing scams.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why banks may use more than a second login step
MFA is an important layer, not a guarantee against every kind of account fraud. Financial institutions may combine authentication with other controls according to risk. In its August 2021 guidance, the CFPB says: “When a financial institution management’s risk assessment indicates that single-factor authentication with layered security is inadequate, MFA or controls of equivalent strength as part of layered security can more effectively mitigate risks.” This guidance describes institutions’ security controls; it does not establish that every bank offers the same MFA methods.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Sources and further guidance
- FTC: Use Two-Factor Authentication To Protect Your Accounts
- CISA: More than a Password (archived page)
- CISA: Require Multifactor Authentication
- CFPB: Authentication and Access to Financial Institution Services and Systems (August 2021)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
