Safer Online Banking Without Becoming Paranoid

Where losses actually come from

Authorised push payment fraud — where you are talked into sending the money yourself — now dwarfs technical account compromise in most countries. The attacker's tool is a phone call and a plausible story, not an exploit.

The second largest category is credential theft through a lookalike login page, usually reached from a link in a message rather than a search.

Almost nobody loses money because their bank was hacked. They lose it because they were persuaded to help.

Six habits

Open banking only from the app or a bookmark you created yourself. Never from a link, never from a search result advertisement.

Turn on transaction notifications so an unfamiliar payment reaches you in seconds rather than at the end of the month.

Treat any request to move money to a 'safe account' as fraud by definition. No bank will ever ask this.

Use a unique password and app-based two-factor for both the bank and the email address attached to it.

Check the payee name on new transfers, not just the account number.

Never install remote-access software at the request of someone who called you.

What hardened mode adds

A hardened banking window opens the page isolated from browser extensions, screen capture and overlay windows — the three routes a compromised device uses to read what you type or draw a fake field on top of a real one.

It also verifies the domain against the institution's real one, so a convincing copy fails before you see it. You do nothing differently; you just see a small badge confirming the window is locked down.