Online banking allows for real-time access to your financial information. You can transfer money, pay bills and manage your accounts through a website or mobile app at any time. While it makes banking easier, it can also create opportunities for fraud and unauthorized access. Threat actors may try to steal your login information, redirect payments or trick you into approving transactions. As technology evolves, including the use of artificial intelligence (AI) in banking and online scams, it is important to understand how these risks can affect you.
Being aware of how online banking works and the risks involved can help you use it securely. This publication explains common risks and steps you can take to stay safe when banking online.
On this page
Common risks in online banking
Online banking is generally safe, but threat actors may still try to access your account in various ways. They may use a combination of several methods, which can lead to unauthorized bank account access or activity.
Phishing and social engineering
Phishing and other social engineering attacks try to manipulate you into sharing sensitive information or approving transactions. A threat actor may contact you by text message, email, phone call or through social media while pretending to be a trusted source, such as your bank.
Common examples include:
- messages claiming there is urgent or unusual activity on your account
- requests to confirm login details, one-time codes or personal information
- links or QR codes that lead to fake websites designed to look like your bank’s website
- messages that appear to come from real phone numbers or email addresses
- repeated sign-in approval requests designed to pressure you into accepting a login attempt you did not initiate
Malware
Malware is software designed to access or control a device. If malware is installed on your phone, tablet or computer, a threat actor may be able to steal login information or redirect payments.
This can happen when:
- phishing messages include links or attachments that install malware
- fake or modified banking and money-transfer apps are downloaded from unofficial sources
- compromised websites or ads prompt you to install software or browser extensions
Third-party apps and services
Online banking accounts can be linked to third-party apps or services, such as budgeting tools and payment services. They can also connect to retail store apps and digital wallets. These connections can be convenient but may introduce risks if access is not properly managed.
This can happen when:
- a connected app or service is compromised, exposing your personal and financial information that could then be used for scams
- your access remains active even after you are no longer using the app or service
- the permissions you set allow a third party to view your account information or initiate actions you did not expect
- you mistake messages from a connected service for legitimate communication from your bank
SIM swapping
Subscriber identity module (SIM) swapping is a type of fraud in which a threat actor takes control of your mobile number by transferring it to a SIM card they control. The threat actor can then receive your calls and text messages, including one-time passcodes used for account access and verification. Once they control your number, they may be able to reset passwords, access your online banking and make unauthorized transactions.
This can happen when a threat actor:
- gathers personal information through phishing, data breaches or social media
- impersonates you and convinces your mobile provider to transfer your number to a new SIM card
Someone may have swapped your SIM card if:
- your device suddenly loses mobile service, preventing you from receiving calls or messages
- you stop receiving expected text messages, including one-time passcodes or account recovery messages
- you are locked out of your banking, email or other accounts while fraudulent activity occurs
How AI is changing online banking scams
AI is helping banks improve security by detecting unusual activity and preventing fraud. At the same time, threat actors are using AI to make scams more convincing and harder to detect.
Threat actors can use AI to:
- create realistic emails, text messages or chat conversations that appear to come from your bank
- generate fake websites or apps that look like legitimate services
- impersonate voices or trusted contacts to request money or sensitive information
- tailor scams using publicly available information about you
- automate attacks and target more people quickly
Understanding how these AI tactics are used in scams can help you spot warning signs and make safer decisions when banking online.
How to protect your banking information
You can take actions to reduce the risks associated with online banking. Good security habits help protect your account, personal information and money, especially when you bank on mobile devices and use real-time payments.
Understand how your bank protects you
Recognize normal activity and spot anything unusual by learning what your bank offers.
- Learn about your bank’s security features, alerts and notification options
- Understand how your bank will contact you about suspicious activity
- Review your account settings and online banking terms so you know what you’re responsible for and what your bank will cover if an incident occurs
Secure your devices and access
Protecting the devices you use for banking is one of the best ways to prevent unauthorized access.
- Lock your devices with a personal identification number (PIN), passphrase or biometric feature
- Use a strong, unique password or passphrase for your bank account
- Use multi-factor authentication to provide an extra layer of security if your passphrase is compromised
Keep your systems and apps up to date
Regular updates help fix security issues that threat actors often exploit.
- Use security software where appropriate and enable built-in device protections
- Update and patch your device and software to fix security vulnerabilities
- Download banking apps only from official app stores or your financial institution’s website
- Use trusted Internet connections like your home network, mobile data and trusted VPNs, as they provide more protection than public Wi-Fi
Monitor your account and activity
Checking your account regularly helps you spot and respond to issues quickly.
- Regularly review transactions, alerts and account changes
- Turn on notifications for account logins, payments and updates
- Pay attention to unexpected alerts or blocked transactions, as these can be early signs of fraud
Recognize and avoid common risks
Being aware of common tactics used by threat actors can help you avoid mistakes.
- Never share your login details, one-time codes or security answers with anyone, including third-party apps and services
- Do not use personal details such as your birthdate or pet’s name in passphrases or security questions
- Do not store banking information in unsecured places like notes or plain text files. If you do need to store or save banking information, make sure you protect it with encryption
- Do not open links, attachments, QR codes or pop-ups in a message unless you have confirmed that the message is legitimate
- Do not access your bank account from public or shared computers or networks
- Only approve sign-in or payment requests that you initiated
If you receive a message or call claiming to be from your bank and you are unsure whether it is legitimate:
- do not reply to the message or open any links
- contact your bank directly using the phone number on the back of your bank card or through your official banking app or website
- check your account activity and alerts for anything unexpected
When in doubt, always use a trusted way to contact your bank rather than responding to the message you received.
Steps to take if fraud occurs
If you believe your online banking account has been compromised, or you think you have mistakenly approved or sent a payment, act quickly to reduce further harm.
Step 1: Contact your bank
- Contact your bank right away using the phone number on the back of your bank card or through an official banking app or website
- Ask the bank to secure your account, which may include locking access, stopping or reversing transactions and resetting your login details
Step 2: Review your accounts and information
- Check your recent transactions for anything you do not recognize
- Review your contact information, security settings and linked devices or services to make sure no changes were made without your approval
- Watch for follow-up messages or calls, as additional scams may occur after a fraud attempt
Step 3: Report the incident and monitor your accounts
- Report fraud or attempted fraud via the Canadian Anti-Fraud Centre website or by calling 1-888-495-8501
- File a report with local law enforcement if your accounts were accessed without your permission
- Monitor your accounts and alerts closely in the days and weeks following the incident
- Report any new or suspicious activity to your bank immediately
Learn more
- Don't take the bait: Recognize and avoid phishing attacks (ITSAP.00.101)
- Protect your organization from malware (ITSAP.00.057)
- Best practices for passphrases and passwords (ITSAP.30.032)
- Secure your accounts and devices with multi-factor authentication (ITSAP.30.030)
- Preventative security tools (ITSAP.00.058)
- How updates secure your device (ITSAP.10.096)
- Artificial intelligence in banking - Canada.ca
- Security considerations for SIMs (ITSAP.10.021)