Secure online banking by using a long, unique password, turning on the strongest multifactor authentication (MFA) your bank supports, and protecting the email and phone number used for account recovery. Choose a passkey or security key when available; if not, use the best alternative offered. MFA adds protection, but it cannot prevent every form of account fraud, so never give a password or one-time code to someone who contacts you unexpectedly.
Secure your bank account in this order
- Open the bank’s official app or website. Use the app you already have or type a known web address yourself. Avoid links in unexpected messages. Find the bank’s security, sign-in, or authentication settings.
- Replace weak or reused passwords. Set a long password used only for this bank. The FTC recommends aiming for at least 12 characters; a random passphrase can also work if the bank accepts it. A password manager can help create and store unique passwords. See the FTC’s account-security guidance.
- Enable MFA and choose the strongest supported method. Prefer a passkey or security key if the bank offers it. Otherwise, choose an authenticator app or another stronger option the bank supports. If text or email codes are the only choices, turn them on rather than leaving the account password-only.
- Check remembered devices. Allow the bank to remember only devices you control. Do not save your login on a public or shared computer.
- Secure recovery routes. Give the email account used for bank recovery its own strong, unique password and MFA. Keep the phone number associated with the account under your control.
- Ignore unexpected requests for credentials or codes. Do not follow an unsolicited “account locked” or “verify now” link, and do not read a one-time code to an unexpected caller. Contact the bank through its official app, known website, or a trusted phone number instead.
What passwords, passkeys, and MFA each protect
Passwords: keep them long and unique
A password is something you know. Length and uniqueness help reduce guessing and credential-reuse risks: if a password exposed elsewhere is reused for banking, attackers may try it on the bank account too. A strong password does not stop phishing, however; a convincing fake site may still trick someone into entering it.
As an Amazon Associate I earn from qualifying purchases.
Passkeys: phishing-resistant when the bank supports them
A passkey is a FIDO/WebAuthn credential used by a service that supports it. CISA explains that FIDO/WebAuthn authentication is tied to the legitimate site, helping prevent a credential from being used on a lookalike site. This is why passkeys are a strong choice against fake-site login attempts. A phone’s fingerprint or face unlock does not by itself mean a bank passkey is enabled: the bank must offer the method and you must enroll it. See CISA’s More than a Password guidance (archived).
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Security keys: a physical authentication option
A security key is a physical device used as an authentication factor. It can offer phishing-resistant sign-in, but you need the key when logging in and must confirm that both the bank and your device support it before relying on one. The FTC describes security keys as a strong two-factor option; CISA also ranks them highly for phishing resistance.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Authenticator apps and approval prompts
An authenticator app may generate a one-time code or provide an approval prompt. These options are not all equally strong: CISA’s MFA comparison favors number matching over a simple push approval and ranks app-generated codes below number matching. An app code is useful, but it is not phishing-proof; a fake site can still ask you to type it in.
SMS and email codes: weaker, but better than no MFA
Text and email codes are convenient but weaker than security keys or stronger app-based options in FTC and CISA guidance. If your bank offers no better method, enabling its available code-based MFA still adds a layer beyond a password alone. Keep the email account receiving codes especially secure.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to choose among the bank’s available methods
| Method | What to know | Practical choice |
|---|---|---|
| Passkey or security key | FIDO/WebAuthn options are designed to resist phishing. Availability depends on the bank; a physical key also has to be with you. | Choose one if the bank supports it and you can enroll and recover access reliably. |
| Authenticator app or number-matching approval | Stronger than relying on a password alone; number matching is preferable to a simple approval prompt in CISA’s comparison. App codes can still be phished. | Use the strongest app option the bank provides if phishing-resistant sign-in is unavailable. |
| SMS or email code | Convenient, but weaker than the options above. Email-code security also depends on securing the email account. | Enable it if it is the strongest method your bank offers rather than using no MFA. |
There is no universal enrollment path or set of supported methods across banks. Check the current options in the bank’s official app or site, or contact it through a trusted channel. The CFPB’s August 2021 guidance notes that financial institutions may use risk assessments and layered security; it says MFA or controls of equivalent strength can better mitigate risks when single-factor authentication with layered security is inadequate. That guidance does not establish which method any particular bank currently offers.
Recognize and stop credential-stealing messages
Phishing messages impersonate trusted organizations to persuade people to reveal credentials or click deceptive links. Treat an unexpected request for a bank login, verification code, or urgent account action as suspicious. Do not use the message’s link or phone number; open the known app or site yourself and report the message to the bank. The FTC’s phishing guidance explains how deceptive emails and texts can steal account information.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
MFA reduces the chance that a stolen password alone is enough to sign in, but it does not guarantee protection from fraud. Keep recovery accounts secure and use the bank’s own channels to manage settings or respond to concerns.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
