Free tools Windows power users keep installed
One-click scans. No signup required.
To secure online banking, sign in through your bank’s official app or website, enable the strongest available multi-factor authentication (MFA), set alerts for activity you would want to investigate, and review transactions regularly. Banks offer different sign-in methods and settings, so check your institution’s current instructions rather than assuming it supports passkeys or security keys.
What to do first: use your bank’s official settings
- Open your bank’s official app or type its known website address into your browser. Avoid links in unexpected messages.
- Sign in and look under Profile, Account, or Security settings for “two-factor authentication,” “two-step verification,” or “multi-factor authentication.” Services may use different labels, as CISA notes in its MFA guidance.
- Follow the bank’s current setup and recovery instructions. The available methods and exact steps vary by institution.
MFA adds a second authentication factor beyond a password. Factors can be based on something you know, possess, or are, such as a password, a device, or a biometric. The Consumer Financial Protection Bureau (CFPB) says phishing-resistant methods based on the Web Authentication standard are especially important for protecting against credential phishing. CFPB Circular 2022-04
As an Amazon Associate I earn from qualifying purchases.
Choose the strongest sign-in method your bank supports
When a bank offers more than one option, consider its resistance to phishing, whether it depends on SMS or cellular service, compatibility with your devices, and how you can recover access if you lose a phone or key. The right choice is one that your bank supports and that you can use reliably.
Passkeys and other WebAuthn-based methods
If your bank offers passkeys or another Web Authentication (WebAuthn)-based sign-in method, consider enabling it and follow the bank’s directions for enrolling devices and recovering access. WebAuthn-based methods are important for phishing resistance, but availability and recovery support are bank-specific. Check your institution’s current security settings and help pages; support at one bank does not establish support at another.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Authenticator apps
If the bank offers an authenticator app as a second factor, the Federal Trade Commission (FTC) recommends it over text or email codes when those are the alternatives. The app can generate a code without relying on SMS delivery, which avoids the same exposure to SIM-swap attacks as texted codes. FTC guidance on two-factor authentication
Text or email codes
If the bank’s only second-factor option is a code by text or email, using it is better than leaving MFA off. Never read a verification code to a caller or forward it in response to an unexpected text, email, or call. A request for a code is not proof that the person contacting you is from your bank. The FTC also advises consumers not to share codes in response to unexpected requests. FTC account-protection advice
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Physical security keys
A USB or NFC security key may be an option if your bank supports it. Before buying one, check that the bank accepts security keys and that the key’s connector works with the devices you use. The FTC describes physical security keys and their connection types; CISA names YubiKey as an example in business-oriented MFA guidance. Neither source verifies compatibility between a particular key model and a particular bank. FTC guidance · CISA MFA guidance
Protect recovery access and trusted devices
Set up account recovery according to your bank’s instructions, and protect access to the email address and phone number used for recovery. If the bank lets you mark a device as trusted, use that option only for a personal device you control. Do not save a login or mark a computer as trusted on a public or shared machine; the FTC cautions against remembering a login on a public computer. FTC guidance on two-factor authentication
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Set transaction alerts you can act on
In the bank’s official app or website, look for alerts under account, notification, or security settings. Turn on the triggers that matter to you and that the bank offers, such as:
- Transactions above an amount you choose
- Deposits
- Large card charges
- Low balances
- Other activity or risk-based notices offered by the bank
CFPB materials describe alerts based on transaction size or risk parameters, as well as consumer examples such as deposits, large charges, and low balances. CFPB/FFIEC guidance on authentication and access · CFPB online and mobile banking tips
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose thresholds that will surface activity you would want to investigate. If you set too many alerts, you may start ignoring them. Alerts provide notice; they do not authenticate you or guarantee that a transaction will be blocked.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check activity and respond to anything unfamiliar
Review recent and pending activity in the official app or on the bank’s known website. Pending debit-card amounts may differ from the final posted amount, so do not treat a pending figure as final. CFPB online and mobile banking tips
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If an alert or transaction looks unfamiliar, open the bank’s app directly or type its known web address instead of following a link in a message. Contact the bank using a verified phone number or other official channel, and report suspicious or erroneous activity promptly.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
