Banking on a Phone: What Is Safe and What Is Not

The common assumption is that doing anything financial on a phone is riskier than doing it on a computer or over the counter. For most people the opposite is true, and it is worth understanding why before deciding.

The bank's app is generally the safest of the available options — safer than a browser, and considerably safer than a phone call, because the overwhelming majority of losses come from people being persuaded to authorise things themselves rather than from anything being broken into.

Why the app is the safer option

It removes the fake website problem. A browser can be sent to a convincing counterfeit of your bank. An app installed from the official store connects to the bank directly, and there is nothing to mistype.

It uses your fingerprint or face rather than a password, which cannot be phished, reused, or read over your shoulder.

It alerts you immediately. A notification the moment a payment leaves is the fastest fraud detection available, and it costs nothing.

It reduces the reason to answer calls. If you can see your balance and transactions in ten seconds, a caller claiming there is a problem is easy to check against reality. See the call from your bank.

What actually creates risk

Not the phone. Four specific things:

Authorising something yourself because someone asked you to. This is where nearly all money is lost. No security measure prevents it, which is why the advice about never moving money to a "safe account" matters more than any setting.

Installing something you were told to install. Remote access software hands over the screen and everything on it. Banks never ask for this.

A phone with no lock. Rare, and catastrophic if the phone is lost.

Reusing a password that has leaked somewhere else. Relevant if you use a browser rather than the app.

Public wi-fi is mostly a red herring. Banking traffic is encrypted, and the practical risk is far lower than the attention it receives. If it concerns you, use mobile data instead — that is the whole fix.

Getting set up safely

Install the app from the official store only — the App Store or Google Play. Never from a link in an email, a text or a search advertisement.

Check you have the right one. Search results contain lookalikes. Confirm the developer name matches the bank and that the app has a long history and a large number of reviews.

If in doubt, get the link from the bank's own printed material or by calling the number on your card.

Turn on fingerprint or face unlock within the app.

Turn on notifications for transactions. The single most valuable setting available to you.

Set a phone lock if you have not: a passcode of six digits or more, not four, and not a birthday.

What is safe to do

Effectively everything: checking balances and transactions, paying bills, transferring between your own accounts, paying someone already set up, freezing and unfreezing a card, updating a limit, depositing a cheque by photograph.

The one to treat with care is adding a new payee. Not because the mechanism is unsafe, but because that is the step fraudsters need you to take. When you add one, do it because you decided to — never during a phone call, and never at someone's prompting.

Habits worth having

Check the app rather than a message. If a text says there is a problem, open the app. If there is a problem, it will be there. If not, the text was a fraud.

Never follow a link in a message about your bank. Open the app.

Look at your transactions weekly, briefly. Small unfamiliar amounts often precede large ones — testing a card with a minor charge is standard practice.

Log out of the browser version if you use one on a shared computer.

Do not save card details in shops you rarely use.

Losing the phone

Worth arranging before it happens, and it takes fifteen minutes.

Turn on Find My iPhone or Find My Device, so you can locate, lock or erase it remotely.

Know that a locked phone is largely useless to whoever has it. The screen lock is what makes this true.

Have your bank's number written down somewhere other than the phone, along with your carrier's.

If it goes missing: lock it remotely, call your carrier to suspend the line, and call your bank. In that order.

For someone helping a parent

Two things worth saying, because this arrangement often creates the problem it was meant to solve.

Do not share credentials. If a parent needs help managing money, banks offer proper arrangements — joint access, third-party mandates, power of attorney. These are designed for it, they are reversible, and they leave a record. Shared passwords do not.

Do not set the app up and leave. The value is in the person using it themselves: seeing their own balance, getting their own alerts, being able to check a suspicious call against reality. An app they cannot open independently provides none of that.

The single thing worth doing

Turn on transaction notifications.

It costs nothing, it takes a minute, and it means you find out about a fraudulent payment within seconds rather than at the end of the month — which is frequently the difference between money that can be recovered and money that cannot.

For additional public information on consumer fraud and scam prevention, see Federal Trade Commission.