Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Passkeys are generally the safest choice for online banking when the bank implements FIDO2/WebAuthn correctly. They cryptographically bind your sign-in to the bank’s real domain, making ordinary phishing and code-relay attacks far harder. A time-based one-time password (TOTP) from an authenticator app is the best practical fallback. SMS codes are the weakest option because they can be phished, intercepted, or defeated by a SIM-swap or mobile-account takeover.
The short answer: choose a passkey, then TOTP, then SMS
For a bank account, use the strongest method your institution genuinely supports, in this order:
- Passkey or FIDO2/WebAuthn security key: best resistance to phishing and man-in-the-middle relay.
- Authenticator-app TOTP: stronger than text messaging because it removes the mobile-carrier delivery channel, but the code can still be entered into a fake site.
- SMS one-time code: use only when the bank requires it or offers nothing stronger, preferably as a recovery method rather than your primary factor.
This ranking assumes the bank’s enrollment and account-recovery processes are also well protected. A bank that lets an attacker reset a passkey with a text message or weak support checks has made that fallback the effective security boundary.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat each method actually proves
SMS one-time codes
The bank sends a short-lived code to the phone number on your account. You type that code into a login page. The bank is therefore verifying possession of a telephone number at that moment, not possession of a cryptographic key tied to the bank’s website.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
That distinction matters. A criminal can place a convincing copy of the bank’s login page in front of you, collect your password and texted code, and immediately relay both to the real bank. A stolen phone number, compromised mobile account, or intercepted message can expose the code without the attacker ever touching your handset.
Authenticator-app TOTP
A TOTP app creates a code from a secret shared with the bank and the current time. Most implementations display a new six-digit value about every 30 seconds. Because the code is generated locally, the login does not depend on SMS delivery, a carrier account, or cellular coverage.
TOTP removes important delivery risks, but it still requires manual entry. If you type the code into an impostor site, that site can relay it to the real bank before it expires. For that reason, the National Institute of Standards and Technology (NIST) says authenticators requiring manual entry of an output, including one-time passwords, are not phishing-resistant: the value is not cryptographically bound to the particular session you intended to authenticate.
Passkeys
A passkey is a FIDO/WebAuthn credential based on a public/private key pair. The private key stays in an authenticator: a phone or computer’s secure hardware, a credential manager that synchronizes passkeys, or a dedicated hardware security key. During sign-in, the bank sends a challenge and the authenticator signs it only for the legitimate banking domain.
You do not copy a secret into the page. You unlock the authenticator with a device PIN, fingerprint, face recognition, or security-key gesture. A look-alike domain cannot normally obtain a response that the real bank will accept, because the credential is bound to the bank’s verified origin. NIST describes this verifier-name binding as the basis of WebAuthn phishing resistance.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Security comparison
| Method | Phishing resistance | SIM-swap or carrier risk | Relay and replay exposure | Recovery and device-loss considerations | Typical role |
|---|---|---|---|---|---|
| Passkey (synced or device-bound) | Strong when the bank correctly implements FIDO2/WebAuthn; the response is tied to the bank’s domain. | No SMS delivery is required for normal sign-in. | High resistance to ordinary phishing and man-in-the-middle code relay; a compromised device or credential-manager account remains a risk. | Synced passkeys can make replacement and cross-device use easier; device-bound keys require a spare key or documented recovery process. | Primary authentication. |
| Authenticator-app TOTP | Not phishing-resistant because the user types the code into a session that may be fraudulent. | No carrier or SIM delivery channel during login. | A phisher can relay a current code before its short validity window closes. | Loss of the phone requires recovery codes, a second enrolled device, or bank support. | Best fallback when passkeys are unavailable. |
| SMS code | Weak; the code can be requested by a fake site and relayed. | Exposed to SIM swaps, number-porting fraud, mobile-account takeover, and some interception scenarios. | Manual entry enables real-time relay; a stolen message can also be used directly. | Easy to replace when the number still works, but changing or recovering a number can become an attack path. | Last-resort login or recovery factor. |
The Cybersecurity and Infrastructure Security Agency’s practical hierarchy similarly places security keys at the top, authenticator-app codes below stronger phishing-resistant methods, and text or email codes at the bottom. Financial-sector guidance also warns that one-time codes can be intercepted in man-in-the-middle attacks.
Why passkeys stop the most common banking phish
A conventional phishing attack depends on persuading you to enter a password or code into the attacker’s page. With a passkey, the authenticator checks the site’s origin before signing the bank’s challenge. A page at a look-alike address cannot request a signature valid for the real bank.
This does not make every passkey scenario harmless. Malware that controls an already-unlocked device, a compromised browser, or a stolen credential-manager account can undermine any authentication method. A criminal who controls your email, bank recovery channel, or device-management account may also be able to reset access. Passkeys reduce the chance that a remote fake login page can steal a reusable factor; they do not replace basic device and account security.
Synced passkeys and device-bound passkeys both provide phishing resistance when implemented correctly. A synced credential can be available on multiple devices and can simplify replacement after loss. A device-bound credential stays on one authenticator, which limits duplication but makes a spare key or a carefully documented recovery route more important.
Why TOTP is safer than SMS but still phishable
TOTP’s main advantage is removing the public mobile network from the sign-in path. A carrier employee, SIM-swap attacker, or phone-number hijacker cannot receive a code merely by taking control of your number. The code is generated on your enrolled device instead.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The remaining weakness is human transfer. You read the digits and type them into a browser. A fraudulent site can ask for the same digits and pass them to the real bank in real time. A code that has expired normally cannot be reused, but expiry does not stop a live relay while the code is valid.
Use TOTP with the bank’s exact domain visible in the address bar. Do not approve an authenticator prompt or enter a code after following an unsolicited email, text, phone call, or advertisement. Open the bank’s app or type its known address yourself.
Why SMS should be a fallback, not your target
SMS is convenient and widely supported, but it combines the weaknesses of manual code entry with dependence on a phone number that can be transferred without your physical phone. Attackers may use social engineering or stolen identity data to persuade a carrier to move your number to their SIM. They may compromise your mobile-account password, exploit weak carrier recovery, or obtain the message through an interception route.
NIST’s government authentication framework restricts phone-network and SMS OTP authenticators and calls for risk assessment and migration planning. That policy does not mean every consumer bank has banned text codes; it signals that SMS is a relatively weak factor rather than a destination for stronger authentication.
If SMS is your only option, it is still better to enable it than to leave the account unprotected. Treat every text as an input to a login you initiated, never as proof that the page displaying the prompt is genuine.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to set up the strongest option your bank offers
1. Check the bank’s security settings
- Open the bank’s official app or type its known web address manually.
- Go to a menu labeled Profile, Settings, Security, or Sign-in and security.
- Look for Passkeys, FIDO2, WebAuthn, Security key, or a similarly named option. Some banks group these under “biometric sign-in,” but a local app unlock is not necessarily a WebAuthn passkey.
- Read the bank’s recovery and device-removal rules before enrolling. Confirm what happens if your phone is lost, replaced, or reset.
2. Enroll a passkey or hardware security key
- Select Add passkey or Register security key and authenticate with your existing bank factor.
- Follow the operating system or browser prompt. Unlock the phone or computer with its local PIN or biometric, or touch and unlock the hardware key when requested.
- Name the credential so you can identify the device later, such as “personal phone” or “spare key.”
- Add a second passkey or spare FIDO2 security key if the bank permits it. Keep the spare in a secure place that is separate from your everyday device.
- Sign out and perform a controlled test from the bank’s normal login page. Verify that the passkey prompt appears only on the bank’s real domain.
A hardware security key is useful when you want a credential that is not dependent on one phone or computer. Check the bank’s supported connectors, browser requirements, and whether it accepts FIDO2/WebAuthn before buying one.
3. Enroll an authenticator app when passkeys are unavailable
- In the bank’s security menu, choose Authenticator app, Two-step verification, or Time-based one-time password.
- Install a reputable TOTP authenticator from your phone’s official app store. Avoid copying the setup secret into notes, email, screenshots, or an unprotected cloud document.
- Scan the bank’s QR code, or enter its setup key manually if scanning is not possible.
- Enter the current six-digit code to confirm enrollment.
- Save the bank’s recovery codes offline in a place accessible when the phone is unavailable. Treat each code like a password and mark used codes so you do not rely on them twice.
- If the bank supports more than one authenticator, enroll a second device before removing the first.
4. Leave SMS enabled only as required
- If the bank requires a phone number for recovery, keep it current but do not use text codes as your preferred sign-in method when a stronger choice exists.
- Set a unique password and carrier account PIN, and enable the carrier’s number-porting or SIM-change lock where available.
- Ask the carrier how it notifies you about SIM replacements, eSIM activation, and number transfers.
- Never read a bank code to an unsolicited caller or enter one after clicking an unexpected link.
Recovery can become the real authentication factor
Security is determined by the weakest path into the account, not only by the factor used on a normal login. Review whether the bank can:
- Reset a passkey after an SMS code alone.
- Change the registered phone number through a call-center script with minimal identity checks.
- Disable all stronger factors after an email-link request.
- Enroll a new device without notifying existing devices.
- Approve a large transfer immediately after a factor reset.
Prefer banks that require strong verification for factor replacement, notify you on every enrollment or removal, impose a waiting period for risky changes, and let you review active sessions and trusted devices. Turn on transaction alerts and new-device notifications. Set transfer limits or additional approval requirements where the bank provides them.
Device and account hygiene still matters
- Keep your phone, computer, browser, banking app, and authenticator software updated.
- Use a strong device passcode; biometrics should unlock a device protected by that passcode, not replace it entirely.
- Enable full-device encryption and remote lock or erase features.
- Protect the account that synchronizes passkeys with a strong password and its own phishing-resistant factor when available.
- Remove lost devices and old passkeys from the bank’s security dashboard immediately.
- Do not install banking or authenticator software from links in messages.
- Use the bank’s official app or a manually entered address instead of search-ad links or embedded email buttons.
Choose by situation
If your bank supports passkeys
Enroll one on your primary phone or computer and add a second authenticator or spare key according to the bank’s documented process. Confirm recovery before relying on the passkey as your only route.
If your bank supports only TOTP and SMS
Choose TOTP for routine sign-in, store recovery codes offline, and keep SMS only for a recovery path the bank cannot remove. Check how the bank handles phone-number changes and authenticator resets.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
If your bank supports only SMS
Use SMS rather than disabling MFA, but harden the mobile account, set transaction alerts, and assume every code can be phished. Ask the bank whether it supports a security key, passkey, or authenticator app in your region; availability varies by institution and geography.
If you travel or use several devices
A correctly implemented synced passkey can provide cross-device convenience without turning a text-message channel into your security boundary. Device-bound keys offer stronger control over where the credential exists, but carry a greater spare-key and recovery burden.
Common problems and safe fixes
“The bank says my browser or phone is unsupported.”
Update the operating system and browser, use the bank’s official app, and retry from a supported device. Do not disable security warnings or install a browser extension offered by a pop-up. If the bank still lacks passkey support on your platform, use TOTP rather than downgrading all the way to SMS when possible.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →“I lost the phone with my passkey or TOTP app.”
Use a spare enrolled authenticator or an offline recovery code. If neither exists, contact the bank through the number printed on a statement or the official website. Ask the bank to revoke the missing device and review recent logins before enrolling a replacement.
“I received a code or passkey prompt I did not request.”
Do not approve it and do not disclose the code. Change the bank password from a known-clean device, revoke unfamiliar sessions, contact the bank, and ask whether a new device or recovery factor was added. A surprise prompt can indicate that someone already knows your password.
“A caller says the bank needs my code.”
Hang up. Banks and legitimate support staff should not need you to disclose a one-time code to prove your identity during an unsolicited call. Contact the bank using a trusted channel and report the attempt.
Bottom line for banking
Use a correctly implemented passkey or FIDO2 security key whenever your bank offers one, and maintain a second recovery authenticator or spare key. If passkeys are unavailable, use an authenticator-app TOTP and protect its recovery codes. Keep SMS for required recovery or legacy access, harden your mobile account, and never confuse receipt of a text with proof that a login page is genuine. The bank’s recovery rules, device security, and transaction controls determine how much protection any factor ultimately provides.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
