The safest setup combines strong multi-factor authentication, a unique password, a fully updated device, restricted network connections, and transaction controls that alert you or block unusual transfers. Turn on those protections for your bank first, then apply the same approach to your email, card accounts, tax account and payment apps. No setting prevents every fraud attempt, but layered controls can stop a stolen password, phishing message or compromised device from becoming an unauthorized payment.
Start with these settings
Open your bank by typing its address yourself, using a bookmark you created, or opening the official mobile app. Menu names vary by institution and country, but the relevant controls are usually under Security, Profile, Privacy, Alerts, Payments or Transfer settings.
As an Amazon Associate I earn from qualifying purchases.
- Enable multi-factor authentication (MFA) for sign-in and, if offered, for transfers, new payees, password changes and new-device enrollment.
- Choose the strongest factor available: a passkey or FIDO2/WebAuthn security key first, an authenticator app next, and SMS only when stronger methods are unavailable.
- Replace reused passwords. Create a long, random password used only by that bank and save it in a reputable password manager.
- Turn on automatic updates for your operating system, browser, banking app and security software.
- Require a screen lock and biometrics on every phone, tablet and computer used for financial accounts.
- Disable automatic connection to public Wi-Fi and avoid banking or shopping on networks you do not control.
- Activate instant transaction alerts and set conservative transfer, payment and daily limits.
- Restrict new recipients, devices and payment methods where your bank allows it; business users should enable dual approval.
- Store recovery codes safely and maintain a backup factor so a lost phone or security key does not lock you out.
Apply the same MFA and password rules to the email account that can reset your bank login. An attacker who controls that inbox may be able to bypass otherwise strong banking settings.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Pick the strongest MFA method your bank supports
MFA adds a verification step beyond a password. The Federal Trade Commission says, “Security keys are the strongest method of two-factor authentication.” Passkeys and security keys use public-key cryptography and are designed to resist phishing; an authenticator app generates time-based codes without relying on the mobile phone network. SMS codes are preferable to no MFA, but they are more exposed to SIM-swap and account-takeover attacks.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Method | Phishing resistance | SIM-swap exposure | Recovery and portability | Setup effort | Availability |
|---|---|---|---|---|---|
| Passkey | High; the credential is bound to the legitimate site or app | None while the passkey is used | Depends on the device ecosystem and synced or backup passkeys; keep another factor | Low to moderate | Only where the bank, device and browser support passkeys |
| FIDO2/WebAuthn security key | Very high; the key will not authenticate to a look-alike site | None | Portable between compatible devices; losing the only key creates recovery risk, so register a spare | Moderate | Bank support varies; check before buying a key |
| Authenticator app | Better than SMS, but a phished code can still be used immediately | Low, because codes are generated on the device | Migration and backup depend on the app; keep recovery codes offline | Moderate | Common, but not universal |
| SMS text message | Low; criminals can imitate a bank and ask for the code | Higher, because a number can be transferred to another SIM | Very portable when the number works, but vulnerable during carrier fraud or loss of service | Low | Widely supported |
How to enable a passkey or security key
- Sign in through the official bank app or a manually entered web address.
- Open Security or Sign-in and security, then select Passkeys, Security keys or Two-step verification.
- Choose Add or Register and follow the device prompt. A passkey normally uses the phone or computer’s screen lock, fingerprint or face recognition. A physical key normally requires a tap and, for some models, a PIN.
- Give each credential a recognizable name, such as “Personal phone” or “Spare key,” so you can remove one that is lost.
- Test a sign-in in a private window or on another registered device before disabling your previous factor.
- Register a backup passkey or key and print or download recovery codes. Store codes offline or in a secure password manager; do not keep the only copy in the same phone that could be lost.
Never read a one-time code to an unexpected caller, text sender or “fraud department.” The FTC warns that you should not share a verification code when you did not initiate the contact. If someone claims your account is under attack, end the conversation and contact the institution using the number on your card or an official statement.
Use a unique password and protect the recovery path
Do not reuse a banking password on email, shopping, social or work accounts. Criminals buy breached username-and-password lists and try the same combinations elsewhere. The FTC recommends unique passwords, and the National Institute of Standards and Technology (NIST) lists password managers as a supporting control.
- Generate a random password of at least 16 characters when the bank permits it. A long passphrase is acceptable if the site rejects generated symbols.
- Save the password in a password manager rather than a browser note, spreadsheet or paper kept beside the computer.
- Turn on MFA for the password manager itself. Its master password should also be unique.
- Review Trusted devices, Remember this device and Active sessions. Remove old phones, shared computers and sessions you no longer recognize.
- Use a separate email address for financial accounts if practical, and secure that email with a passkey or security key.
- Check your bank’s recovery options. Remove obsolete phone numbers and email addresses, and make sure a criminal cannot reset the account using an abandoned channel.
A password manager cannot prevent a fraudulent transfer after you approve it, so pair it with transaction alerts and limits. Its role is to stop credential reuse and make phishing-resistant sign-in practical.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep the device and browser patched
Automatic updates close vulnerabilities that criminals may already know how to exploit. The FTC notes that “Software updates often contain critical patches and protections against security threats,” and the Consumer Financial Protection Bureau also emphasizes timely updates.
Phone and tablet settings
- Enable automatic operating-system and app updates, including updates over cellular data if you rarely connect to trusted Wi-Fi.
- Use a strong device passcode, not a four-digit pattern that someone can observe. Enable fingerprint or face unlock for convenience, but keep the passcode confidential.
- Turn on the device-finding and remote-erase feature. Record the account recovery method separately so a stolen device can be disabled quickly.
- Install the banking app only from the official app store. Remove sideloaded apps you do not recognize and review accessibility, screen-recording and device-administrator permissions.
- Enable notifications for app installs, SIM changes and account changes when your mobile carrier offers them. Add a carrier account PIN to make unauthorized number transfers harder.
Computer and browser settings
- Use a supported operating system and browser with automatic updates enabled.
- Keep built-in anti-malware and firewall protections active. Do not install “security” software offered by a pop-up or an unsolicited caller.
- Create a separate browser profile for financial accounts, with minimal extensions. Remove extensions you do not need, especially those that can read or change every webpage.
- Sign out of the bank when finished on a shared computer and never select Remember me there.
- Lock the screen whenever you step away. A banking session left open is an authorization opportunity even when the password is strong.
Use safer network habits
The FBI advises avoiding public Wi-Fi for sensitive financial activity. A network name that appears to belong to a café, airport or hotel can be copied by an attacker, and you cannot verify who controls the access point. Modern banking sites normally encrypt traffic, but encryption does not protect you from a fake login page, a malicious device or someone viewing your screen.
- Use cellular data or your trusted home network for banking. If you must connect elsewhere, use a personal hotspot rather than an open network.
- Disable Auto-join or Connect automatically for public networks. Forget networks you no longer use.
- Do not install a certificate, “Wi-Fi helper,” remote-support tool or browser extension at the request of a stranger or pop-up.
- Check the address bar before signing in. The connection lock only indicates encrypted transport; it does not prove that the site is your bank.
- Never conduct a transfer while screen-sharing with technical support, a supposed bank employee or a romance or investment contact.
Turn on transaction controls, not just sign-in protection
A stolen session, malware infection or social-engineering call can lead to a payment even when MFA protected the original login. Transaction controls add friction at the point where money moves. Federal Reserve guidance describes alerts, limits, recipient restrictions and approval workflows as layered controls.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Control | Recommended setting | What it stops or reveals | Typical availability |
|---|---|---|---|
| Instant alerts | Push notification, text or email for every login, card purchase, transfer, payee change and profile change | Shows unauthorized activity immediately, when cancellation is still more likely | Common for consumer and business accounts; event choices differ |
| Transfer and payment limits | Set the lowest daily and per-transaction amounts that meet your needs; use a separate limit for external transfers | Caps the loss from a compromised account | Often available for consumer accounts; business accounts may offer granular rules |
| Recipient controls | Require a waiting period or additional approval before a new payee can receive money | Blocks a criminal from adding a recipient and sending funds immediately | More common in business banking; consumer options vary |
| Device controls | Notify or require approval when a new phone, browser or token is enrolled | Exposes account takeover and unauthorized device registration | Availability varies by bank and region |
| Dual approval | Require two authorized people for wires, ACH payments or high-value transfers | Prevents one stolen credential from releasing business funds | Primarily business banking |
| Card controls | Freeze a card when unused, disable online or international purchases when unnecessary, and set merchant or spending limits if offered | Reduces exposure from a stolen card number | Common in mobile apps, with issuer-specific options |
Configure alerts without creating notification blindness
Start with every event, then adjust only after you understand the volume. Use a channel that is separate from the bank session: a push alert on a locked phone plus email can give you redundancy. Make sure alerts display enough information to identify the transaction without exposing a full account number on a lock screen.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Set limits around your real use
Estimate your largest legitimate bill, transfer and cash withdrawal. Set a daily limit slightly above that amount, not the maximum the bank offers. Lower limits before travel or when an account is normally idle; raise them temporarily through the official app and lower them again after the payment clears. A limit is not a guarantee: some transactions may be exempt, delayed or processed through a different rail, so read the bank’s terms.
Recognize and handle phishing
Unexpected texts, emails and calls often create urgency: a “fraud alert,” a refund, a locked account or a request to confirm a transfer. Treat the message as untrusted even when it contains your name or partial account details.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Do not click the message link, call its number or open an attachment.
- Open the official app or type the bank address yourself. Use a bookmark you created rather than a link supplied in the message.
- Review alerts and recent activity inside the account. A genuine alert should also appear there, but an in-app message is not proof that a phone caller is legitimate.
- Refuse requests for passwords, MFA codes, card PINs, remote access or a transfer to a “safe” account. Banks do not need your one-time code to cancel fraud.
- Report the message through your bank’s official fraud channel and your country’s relevant cybercrime or consumer-protection service.
Look-alike domains, misspellings, shortened links and pressure to act immediately are warning signs, but polished messages can also be fraudulent. Your decision should be based on using an independent contact path, not on how professional the message appears.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Prepare for loss, theft and account takeover
If your phone or security key is lost
- Use another trusted device to sign in and revoke the missing device or key under Security, Devices or Passkeys.
- Contact the bank through the number on your card and ask whether any sessions, payees or credentials should be blocked.
- Ask your mobile carrier to suspend the SIM and verify that a carrier account PIN is active.
- Use your backup factor or recovery codes, then enroll a replacement and test it.
If you see an unauthorized login or payment
- Use the bank’s official app or phone number, not the contact information in the suspicious message.
- Freeze the affected card or account, change the password from a clean device and revoke unknown sessions.
- Remove unfamiliar recipients and devices, lower transfer limits and disable outbound payments until the bank advises otherwise.
- Ask what dispute, recall or fraud-report deadlines apply. Save confirmation numbers, dates, transaction amounts and copies of relevant messages.
- Change any other account that reused the exposed password, beginning with email and payment services.
Fast reporting improves the chance that a transfer can be stopped, but reimbursement rules depend on the payment type, your country, the bank’s investigation and whether you authorized the transaction. Do not assume an alert or MFA enrollment makes every loss automatically refundable.
A practical security review schedule
- Today: enable MFA, replace reused passwords, turn on automatic updates, require a screen lock and activate transaction alerts.
- This week: register a passkey or FIDO2 key if supported, add a backup factor, review trusted devices and set transfer limits.
- Monthly: inspect logins, payees, linked accounts, card settings and recent transactions; remove anything you no longer recognize.
- After travel, a new device or a major payment: check that temporary limits, extra recipients and remembered devices were removed or reduced.
- After a breach notification: change the affected password immediately, ensure it was not reused, and review bank and email sessions even if no fraud is visible.
What the numbers say about everyday habits
Security settings matter because many people still do not use basic protections consistently. The National Cybersecurity Alliance reported in 2023 that 84% of people considered online safety a priority, yet only 38% used unique passwords for all their accounts and only 36% always installed software updates when available. CISA reproduced these figures in its 2024 toolkit. The gap between concern and routine behavior is why automatic updates, password-manager generation, MFA prompts and transaction alerts are worth enabling: they turn occasional good intentions into defaults.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Limits and account-specific differences
Feature names, supported MFA methods, transfer rails, notification timing and recovery rules differ by bank, card issuer, payment app, device and country. A passkey that works for one institution may not yet be accepted by another; a bank may support an authenticator app for sign-in but require SMS for a high-risk change. Confirm the exact options in your own account and keep a backup factor.
No universal setting guarantees fraud prevention. Keep reviewing activity, question unexpected requests, and contact the institution through an official channel whenever something looks wrong. Layered controls reduce the chance and potential size of a loss without replacing attention to the transaction you are approving.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches
