Re-register a banking app on a new phone safely

Moving a banking app to a new phone is more than copying an icon. The bank usually has to bind the new device to your account again, often with Strong Customer Authentication and checks against the phone number, card, old device or identity information it already holds.

Treat the new handset as a new security relationship

The FCA says Strong Customer Authentication is designed to establish that the person accessing the account or making a payment is permitted to do so. A new device removes some of the bank’s previous trust signals, so extra verification is normal.

Do not interpret a request for another authentication step as a sign that the migration failed. It is exactly when the bank should be cautious.

Practical checkpoint for re-registering a banking app on a new phone: establish the starting position before you change anything. Use a new phone using the same mobile number while the old device still has the banking app as a worked example and write down old-device status, registered number, new-device model, SIM status and activation reference. That turns 'Treat the new handset as a new security relationship' into a testable sequence rather than a vague problem.

Keep access to the old device and phone number during setup

If the bank sends an approval to the old app or an SMS to your registered number, losing both at once can turn a simple migration into an account-recovery process. Where practical, set up the new phone before wiping or trading in the old one.

If the number has changed as well, update it through the bank’s official process rather than asking a stranger online for a workaround.

Run the numbers or sequence on paper before repeating the action. In the example of a new phone using the same mobile number while the old device still has the banking app, separate the amount, date, channel and decision point, then mark which part is confirmed and which part is still an assumption. For 'Keep access to the old device and phone number during setup', the useful question is not simply whether something can work, but what result you should see next and how long you are prepared to wait before changing route.

Second check for section 2, 'Keep access to the old device and phone number during setup': use a new phone using the same mobile number while the old device still has the banking app and write a one-line expected result beside the actual result. Then verify old-device status, registered number, new-device model, SIM status and activation reference. If the two do not match, pause rather than creating another transaction or application. Remove the old device from banking access after the new one is working and review digital-wallet tokens separately.

Install from the official source only

Use the Apple App Store, Google Play or a link reached from the bank’s verified website. Do not install an app file sent through text, email or messaging because somebody claims it is a special migration version.

Check the developer/publisher and app history if anything looks unusual. A banking migration is a prime moment for phishing because customers expect security prompts.

Use a controlled process for 'Install from the official source only'. Gather old-device status, registered number, new-device model, SIM status and activation reference, take one deliberate action, and record the result before trying a second route. Do not wipe the old phone until the new registration is confirmed if the bank uses the old device for approval. If the first route clearly cannot complete the job, remove the old device from banking access after the new one is working and review digital-wallet tokens separately rather than improvising with an unverified workaround.

Read every registration approval before accepting

A fraudster can exploit the same device-registration flow by asking you to read out a code or approve a new handset they control. The code may be genuine and still be dangerous to share.

If the prompt says a new device is being registered and you are not holding that device, reject it and contact the bank.

Build a failure plan before the deadline matters. For re-registering a banking app on a new phone, decide what you will do if the normal route fails at the worst reasonable moment: a bill is due, a payment is time-critical, a phone is unavailable or verification will not complete. Keep enough time and money outside the process to recover. Under 'Read every registration approval before accepting', note the exact error or refusal wording because that is usually more useful to support than a general statement that it did not work.

Second check for section 4, 'Read every registration approval before accepting': use a new phone using the same mobile number while the old device still has the banking app and write a one-line expected result beside the actual result. Then verify old-device status, registered number, new-device model, SIM status and activation reference. If the two do not match, pause rather than creating another transaction or application. Remove the old device from banking access after the new one is working and review digital-wallet tokens separately.

Retire the old phone only after the account is stable

Confirm you can log in, see the correct account and receive expected security messages. Then follow the bank and device-maker instructions for removing banking data and wiping the old handset.

If the old phone is lost rather than simply replaced, tell the bank so it can assess whether the old device registration should be revoked.

Treat evidence as part of the solution, not paperwork added afterwards. For 'Retire the old phone only after the account is stable', keep old-device status, registered number, new-device model, SIM status and activation reference in one dated folder and write a two-line chronology of each contact. Do not wipe the old phone until the new registration is confirmed if the bank uses the old device for approval, and use only a channel you reached independently when security or fraud is involved.

For Re-register a banking app on a new phone safely, turn “Retire the old phone only after the account is stable” into one verifiable fact rather than a general impression. Record the amount, status, date or rule that matters, then compare it with the bank’s current information before you make the next transaction or account decision for “Retire the old phone only after the account is stable” on Re-register a banking app on a new phone safely.

Treat the phone change as a controlled migration

The safest time to move a banking app is while the old phone and registered mobile number still work. Update the operating system, confirm the bank holds the correct number, and make sure you know the fallback credentials before wiping or trading in the old device. Some banks require the old device, a card, a text message or a fresh identity check to trust the new phone; the exact sequence varies, but losing every recovery factor at once is what turns a normal upgrade into a difficult support case.

For example, if you move your SIM on Friday evening and factory-reset the old phone before opening the banking app on the new device, a failed registration can leave you without a trusted device over the weekend. A better sequence is to register and test the new phone first, confirm you can see balances and approve a low-risk action, then remove the old device through the bank's settings and finally erase it.

An unsolicited message saying 'new device detected - click here to cancel' deserves special caution during a real phone migration because the timing makes it believable. Open the banking app or website independently. If the bank shows no registration you recognise, contact it directly; never approve a new device or share a one-time code merely to cancel an alert sent by somebody else.

Finish with a decision rule for re-registering a banking app on a new phone. In the worked example of a new phone using the same mobile number while the old device still has the banking app, the safer next step is the one that preserves evidence and keeps essential money or account access recoverable. If the provider cannot explain the next step clearly, remove the old device from banking access after the new one is working and review digital-wallet tokens separately and keep the case reference until the outcome is reconciled.

Sources and verification

• FCA - Confirming your identity
• NCSC - Third-party applications and device security
• NCSC - phishing and independent verification

MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.