Suspicious online banking login: immediate next steps

An unfamiliar login alert can be a false alarm caused by your own device, but it can also be the first visible sign of account takeover. Treat it as a security event until you can explain the device, time and location without relying on the alert link itself.

Verify the alert without following the alert

Phishing messages often imitate real security notifications. The NCSC advises contacting organisations directly rather than using suspicious message links or phone numbers. Open the installed banking app or navigate independently to the bank website.

If the alert does not appear in the official account and the message domain or sender looks unusual, report it as phishing rather than entering credentials into the supplied page.

Practical checkpoint for responding to a suspicious online banking login: establish the starting position before you change anything. Use an unfamiliar login alert at 02:14 from a device you do not recognise as a worked example and write down alert time, device list, session history, password changes, payees and transactions. That turns 'Verify the alert without following the alert' into a testable sequence rather than a vague problem.

Look beyond the login itself

Check recent payments, newly added payees, device registrations, contact details and security settings. A criminal may log in first and move money later, so “no missing money yet” is not a reason to ignore unexplained access.

For example, an unfamiliar login at 03:14 followed by a new mobile number on the profile is more serious than a location label that matches your own laptop after a browser update.

Run the numbers or sequence on paper before repeating the action. In the example of an unfamiliar login alert at 02:14 from a device you do not recognise, separate the amount, date, channel and decision point, then mark which part is confirmed and which part is still an assumption. For 'Look beyond the login itself', the useful question is not simply whether something can work, but what result you should see next and how long you are prepared to wait before changing route.

Second check for section 2, 'Look beyond the login itself': use an unfamiliar login alert at 02:14 from a device you do not recognise and write a one-line expected result beside the actual result. Then verify alert time, device list, session history, password changes, payees and transactions. If the two do not match, pause rather than creating another transaction or application. Open the bank independently, secure recovery email and phone, end unknown sessions and tell the bank immediately if any financial action is unfamiliar.

Change compromised credentials from a trusted device

If the login was not yours, follow the bank’s security process and change the password or passcode as directed. If the same password was used elsewhere, the NCSC advises changing it on those accounts too.

Email deserves particular attention because access to your email can help criminals reset banking and shopping accounts. Strengthen email authentication at the same time.

Use a controlled process for 'Change compromised credentials from a trusted device'. Gather alert time, device list, session history, password changes, payees and transactions, take one deliberate action, and record the result before trying a second route. Do not click the alert link to investigate the alert itself. If the first route clearly cannot complete the job, open the bank independently, secure recovery email and phone, end unknown sessions and tell the bank immediately if any financial action is unfamiliar rather than improvising with an unverified workaround.

Tell the bank immediately if any financial action is unfamiliar

If money has moved, a card was added to a wallet, or a payee appeared without your permission, contact the bank using a trusted route. Be precise about which actions you did and did not authorise.

The FCA notes that use of a password or PIN by itself does not necessarily prove that the customer authorised a payment. The bank should investigate the actual circumstances.

Build a failure plan before the deadline matters. For responding to a suspicious online banking login, decide what you will do if the normal route fails at the worst reasonable moment: a bill is due, a payment is time-critical, a phone is unavailable or verification will not complete. Keep enough time and money outside the process to recover. Under 'Tell the bank immediately if any financial action is unfamiliar', note the exact error or refusal wording because that is usually more useful to support than a general statement that it did not work.

Second check for section 4, 'Tell the bank immediately if any financial action is unfamiliar': use an unfamiliar login alert at 02:14 from a device you do not recognise and write a one-line expected result beside the actual result. Then verify alert time, device list, session history, password changes, payees and transactions. If the two do not match, pause rather than creating another transaction or application. Open the bank independently, secure recovery email and phone, end unknown sessions and tell the bank immediately if any financial action is unfamiliar.

Keep the evidence until the account is stable again

Save the alert, login time, device information and screenshots of changed settings or transactions. Do not keep clicking the suspicious email to collect evidence; one copy of the message is enough.

After the bank secures the account, continue monitoring for follow-up phishing or fraud calls that refer to the incident. A criminal may use what they learned to make the next approach more convincing.

Treat evidence as part of the solution, not paperwork added afterwards. For 'Keep the evidence until the account is stable again', keep alert time, device list, session history, password changes, payees and transactions in one dated folder and write a two-line chronology of each contact. Do not click the alert link to investigate the alert itself, and use only a channel you reached independently when security or fraud is involved.

A login alert should trigger an account audit, not only a password change

If the bank reports a login you do not recognise, first verify that the alert itself is genuine by opening the app or website independently. Then change the banking password or passcode through the official service and review registered devices, beneficiaries, future payments, contact details and recent transactions. An attacker may change recovery information before moving money, so the absence of a fraudulent debit does not mean nothing happened.

Secure the email account and mobile number used for banking recovery at the same time. If you reuse the compromised password elsewhere, replace it there too. A password manager can make unique credentials easier to maintain, but the immediate priority is cutting off the attacker's recovery routes and signing out unfamiliar sessions.

If you see a new payee or transfer you did not create, contact the bank as an unauthorised-access case rather than merely deleting it. Preserve the alert time and any IP/device information the bank shows. That evidence can help establish which changes occurred before and after you regained control.

Finish with a decision rule for responding to a suspicious online banking login. In the worked example of an unfamiliar login alert at 02:14 from a device you do not recognise, the safer next step is the one that preserves evidence and keeps essential money or account access recoverable. If the provider cannot explain the next step clearly, open the bank independently, secure recovery email and phone, end unknown sessions and tell the bank immediately if any financial action is unfamiliar and keep the case reference until the outcome is reconciled.

Sources and verification

• NCSC - Phishing scams: what to do
• FCA - Fraudulent payments
• NCSC - recovering compromised devices/accounts

MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.