Online banking has experienced a boom in the last few years, with many people moving away from traditional banks and onto digital platforms. But, with banking copycat websites and banking app scams also on the rise, you may be wondering just how safe your money is.
According to UK Finance, customers lost £18.7million to mobile banking scams in the first six months of 2023. This was up by 17% from the year before and was the biggest hike recorded since the trade body began collecting data in 2015.
New data from Which? has revealed the best and worst UK banks for online banking and mobile app banking. The data is tested on four parameters such as how it lets customers log in and access accounts, security features, account management and navigation, and logout.
Sign up to Money Morning
Don’t miss the latest investment and personal finances news, market analysis, plus money-saving tips with our free twice-daily newsletter
Don’t miss the latest investment and personal finances news, market analysis, plus money-saving tips with our free twice-daily newsletter
We look at which are the best UK banks for online banking and mobile app banking, and those that didn’t fare too well.
Online banking – how the banks rank
This is how the banks rank when it comes to online security for their customers.
1. NatWest/RBS and Starling Bank
Coming out on top for safest online banks were NatWest/RBS and Starling Bank. They received a total of 87% in all four categories and five stars for security best practices, account management and navigation.
2. HSBC Bank
The high street giant received a score of 80% and five stars for safe access to accounts, recovering usernames and passwords, navigation and logout.
3. Barclays
Barclays seems to be taking active measures to crack down on financial crime and recently announced a £20k cash deposit limit on its bank branches. Though it scored 78% for safe online banking, it still allows customers to access their accounts through multiple browsers, IP addresses and devices. Which? warns that this could potentially provide criminals with loopholes and target their money.
4. First Direct and Nationwide
The last time Which? Conducted this research in February 2024, Nationwide was poorly rated with 63%, however, it seems to have taken active measures to make improvements and now stands at 74%. While it received three stars for account management, navigation and logout, it received five out of five for login and security best practices.
First Direct has also improved by 1% and is now rated 74% for safe online banking.
5. Lloyds Bank
Faring just under 70%, Lloyds Bank scoured 69% for its safe online banking practices. It only received three stars for account management but was successful in implementing strict measures when it came to navigation and logout. However, it was the only bank that did not log out users after five minutes of being inactive, even though this is a regulatory requirement.
The bank told Which? that this makes it easier for vulnerable customers and businesses that may need longer periods to complete transactions.
6. Virgin Money
Virgin Money only scored two out of five stars when it came to navigation and logout, while receiving a total aggregate score of 68%. It came just two ranks below Nationwide, which has agreed to take over Virgin Money for £2.8billion. The Nationwide-Virgin Money takeover could potentially be the biggest UK bank takeover since the 2008 financial crisis.
7. Santander and TSB
While Santander scored a solid five in both security best practices and navigation and logout, it fell short of two stars in login and account management, bringing its average down to just 67%, the second-lowest of all online banks.
Though TSB only scored 67%, it was the only bank to receive two stars for online account management.
8. The Co-operative Bank
At the bottom of the barrel came the Co-operative Bank, which scored only 61%, marking a significant gap between the last and the second-last position. This is because it’s the only bank that failed to ask for two-factor authentication on a test laptop, thus scoring poorly in security measures.
Banking apps – how they rank
This is how the banks rank in terms of how safe their banking apps are for their customers.
1. HSBC Bank
HSBC again proved to be at the top, but this time as the best bank with mobile app security and scored 78%. Which? attributed this high score to HSBC’s non-reliance on SMS for login, and zero issues with logout and navigation.
2. Barclays
Though Barclays is yet to face a few hiccups when it comes to online banking safety, it ranks second best for mobile banking app security and received a total of 74%.
3. Santander and Chase
Santander and Chase received 73% and averaged four out of five stars for almost all sections except login and account access, where Santander fell short of just one star. However, it made up for that in navigation and logout. Both banks scored five out of five in security best practices.
4. Starling Bank
While Starling was at the top for online banking security, it fell down a bit in mobile banking due to its account management systems. However, it received full stars for security best practices, navigation and logout.
5. NatWest/RBS
NatWest/RBS have scored similarly to Starling after both came out on top for online banking but not for mobile banking. Scoring 71%, the main function that required improvement was account management, such as setting up a new payee and security systems for editing account details.
6. First Direct and Nationwide
First Direct and Nationwide received the same aggregate scores again but this time it tumbled down from 74% to 68%. However, Nationwide received an extra star in navigation and logout, otherwise both have four stars in all other categories.
7. Virgin Money
In Which?’s report about online mobile banking apps from February, Virgin Money was rated the poorest of all banks for customer safety, having scored 54% and just two stars for encryption. Significant improvements have been made to the app which has resulted in a 67% rating and five stars for login procedures.
8. Lloyds Bank
Further down in the list is Lloyds, with a 63% aggregate score and three stars for login methods. It received four stars for security best practices, account management and navigation and logout.
9. Monzo
Monzo’s ratings have dipped from 65% in February to 60% now, pushing it to the third-last ranking for online security. It’s received mixed reviews after earning only two stars for navigation and logout methods while achieving five out of five for login authentication methods.
10. The Co-operative Bank
Similar to the Co-operative Bank’s online banking website, its mobile app also failed several security checks such as letting customers set up weak passwords or log in through different IP addresses at the same time. Other issues included phone numbers being visible in alerts and security codes sent on SMS. This plunged the bank to second-last with a score of 57%.
11. TSB
TSB received the worst rating of 54% for mobile app security. The most serious issue flagged by Which? was that it didn’t store users’ sensitive credentials safely and securely. It meant that other apps could read this data if they were running on the user’s phone. TSB told Which? that the matter was under review and that a fix would be considered in the future.
There were also encryption issues, weak support for devices that run on Android 8.0 or less, only six character requirements for passwords and no way for users to ‘distrust’ the TSB app after clicking on ‘trust’ once. SMS texts also included the users’ phone numbers, which scammers could take advantage of. TSB told Which? that they had removed phone numbers from most of the SMS alerts.
How to protect yourself from online banking scams
Fraudsters are getting more sophisticated and are finding new ways to trick people out of their money, such as through holiday scams, Amazon cold calls, recruitment scams on WhatsApp, crypto scams and creating fake dating profiles. But there are ways that you can protect yourself.
Secure your mobile phone: In the worst case that your phone gets stolen, you should make sure that scammers can’t easily access your money. Do this by having a long unique passcode and a fingerprint scan. Set your device to auto-lock after a few minutes, and register for Find My Device on Google or Apple.
Choose strong passwords: It’s best to choose strong, unique passcodes that are not easy to guess. Try using a combination of lowercase and uppercase letters, numbers and symbols and don’t repeat it for any other accounts.
Secure your social media accounts: Adjust your privacy settings on your social media accounts. You can do this by limiting the personal data you share online, such as your email, date of birth and mobile number. Enable two-factor authentication and choose a strong password that is different from what you use on each account you have.
Be alert: In case any suspicious activity occurs on your bank account, like a payment or log-in from a device that you don’t recognise, immediately report it to your bank. Usually, banks allow you to freeze your debit card online so that fraudsters can’t scam you.
