A banking password is better protected than any other: the bank limits login attempts, requires confirmation and watches for suspicious activity itself. That is precisely why money is not stolen by guessing the password but around it.
Someone is persuaded to read out a code themselves, to move money to a “safe account”, or to install remote access software. The password stays untouched — it simply stops meaning anything.
What to set up once
-
A unique long password
It must not repeat anywhere, including your email. Take sixteen characters and put it in a manager: you will never type it by hand.
-
A second factor that is not SMS, if the bank allows
Confirmation in the bank's app beats a code in a message: messages are intercepted by reissuing the SIM card. If there is no choice, keep SMS — still better than nothing.
-
Notifications for every transaction
Not only large ones. Fraud often starts with a small charge to see whether you react.
-
Limits on transfers and online payments
The most underrated setting. A limit does not get in your way, but it turns a potential loss of everything into a loss of one day's limit.
-
A separate card for the internet
A virtual card with a small balance you top up per purchase. A leak of its details does not touch your main account.
-
A separate email address
An address you do not leave in shops and forums. The less it circulates, the smaller the chance it ends up in a breach alongside a password. More in the email password.
Good afternoon. Bank security department. We have recorded an attempted transfer of 87,000 in another region. Was that you?
Fear from the first sentence. From here the person is saving money rather than checking who is speaking.
No, that was not me
The transfer goes through in two minutes. We must cancel it now. Do not hang up, I will stay on the line
The key moment. Asking you not to hang up is not help but containment. A pause breaks the script, so no pause is offered.
A cancellation code is coming now. Read it out to me
A code cancels nothing — it signs an operation. A real employee sees the operation in the system without you.
I will call back on the number on my card
One action that defeats the entire script. A real bank will not mind; a scammer hangs up.
Telling a fraudulent call apart
| Technique | How it sounds | What is really happening |
|---|---|---|
| Urgency | “The transfer goes in two minutes, we must cancel it now” | You are given no time to think, because thinking ruins it |
| Fear | “A loan is being taken out in your name”, “your account is at risk” | A frightened person stops checking who they are talking to |
| Secrecy | “Do not tell anyone, an investigation is under way” | Isolation from the people who would ask questions |
| A safe account | “Move your money to a protected account” | No such account exists; it belongs to the caller |
| Help with an app | “Install this program, a specialist will assist you” | Remote access to your phone and every app on it |
What to check monthly
If someone already has access
-
Call the bank and block
The first action, not the last. Blocking the card and the account stops transactions that have not gone through yet.
-
Change the password and end sessions
After blocking, not before: while transactions are running, stopping them matters more.
-
Check your email
If access came via recovery, the mailbox is compromised. Follow the signs of a break-in: forwarding rules, recovery contacts, unknown devices.
-
File reports and record everything
A report to the bank the same day and one to the police. Timing affects the chance of getting the money back.
- The password repeats with email or a shop
- Confirmation by SMS only
- Notifications switched off to avoid noise
- No limits; the main card linked to every service
- A unique password in a manager
- Confirmation in the bank's app
- Notifications for every transaction
- Limits and a separate card for the internet
If your banking password matched another one, check it against breach databases and follow what to do when a password leaks.