Banking App Security Settings Everyone Should Turn On

Your banking app probably has a dozen security settings you have never opened. Most banks ship them switched off or set to loose defaults, because every extra prompt adds friction. That trade-off makes sense for the bank’s sign-up numbers. It makes less sense for you when someone gets into your account at 2 a.m.

The good news: about 15 minutes in your app’s settings menu closes most of the gaps criminals use. This checklist covers the settings found in most US bank and credit union apps, what each one does, and how to set it.

Why your bank app settings matter more than you think

Account takeover rarely looks like movie hacking. It usually starts with a stolen password, a fake text that captures a one-time code, or a phone grabbed out of someone’s hand while unlocked. The settings below are designed to break each of those paths.

There is also a money reason. Under the Electronic Fund Transfer Act and Regulation E, your liability for unauthorized debit card and electronic transfers depends on how fast you report them. The Federal Trade Commission lays out the tiers:

For credit cards, federal law caps your liability at $50, and you owe nothing if only your card number was stolen. Alerts are what get you inside those short windows. This is general information, not legal or financial advice.

Key takeaway: Real-time alerts are the cheapest insurance you can buy. They turn “I noticed it on my statement 6 weeks later” into “I called the bank in 5 minutes”, and with debit cards that speed directly changes how much you can lose.

The banking app security checklist

Work through these in order. Names vary by bank, so search your app’s settings for the keyword in bold.

1. Login and identity

• [ ] Biometric login (Face ID, Touch ID or fingerprint). Faster than a password and much harder to shoulder-surf.
• [ ] Multi-factor or two-step verification. Make sure it is on for logins from new devices, not just password resets.
• [ ] Passkey, if your bank offers one. Passkeys can’t be typed into a fake website, which defeats most phishing.
• [ ] A unique, long password. Store it in a password manager rather than reusing one from another site.
• [ ] Remove SMS as your only backup method if the app offers an authenticator app or passkey instead.

The Cybersecurity and Infrastructure Security Agency (CISA) describes FIDO-based authentication, the technology behind passkeys and security keys, as the only widely available phishing-resistant form of MFA. Any MFA is better than none, but stronger methods matter most on the account that holds your money. If you need a refresher, see our guides to setting up two-factor authentication and what passkeys are.

2. Alerts

• [ ] Transaction alerts for every debit and credit card purchase, or above a low threshold such as $1.
• [ ] Card-not-present alerts for online and phone purchases.
• [ ] Transfer alerts for outgoing ACH, wire and Zelle payments.
• [ ] New payee or recipient added alerts.
• [ ] Login from a new device alerts.
• [ ] Profile change alerts for email, phone number, address and password changes.
• [ ] Low balance alerts, which also help you spot drained accounts quickly.

Push notifications arrive fastest. Add email as a second channel for profile changes, because an attacker who takes over your phone number can intercept texts.

3. Card controls

• [ ] Card lock or freeze. Most apps let you temporarily turn a card off and back on in seconds. Use it whenever a card goes missing, even briefly.
• [ ] Merchant and transaction-type controls. Some apps let you block online, international, ATM or specific merchant category transactions.
• [ ] Location-based controls, if offered, which decline in-person purchases far from your phone.
• [ ] Virtual card numbers for online shopping and subscriptions, if your card issuer supports them.

4. Transfer and payment limits

• [ ] Lower daily transfer limits to the amount you actually move. A thief can only take what the limit allows.
• [ ] Lower Zelle and P2P limits if you rarely send large payments. Read is Zelle safe for why these payments are so hard to reverse.
• [ ] Hold or review for new payees, which some banks offer as a waiting period before the first payment.
• [ ] Mobile deposit limits. Usually set by the bank, but worth knowing. See how mobile check deposit works.

5. Devices and sessions

• [ ] Review trusted or remembered devices and remove any you don’t recognize or no longer own.
• [ ] Sign out of other sessions after a scare.
• [ ] Auto-logout timer set to a short window.
• [ ] Hide balances on the login screen if your app shows them without signing in.

6. Contact details and statements

• [ ] Confirm your email, phone and mailing address are current. Fraud alerts are useless if they go to an old number.
• [ ] Paperless statements with a monthly reminder, then actually skim them.
• [ ] A verbal password or account PIN for phone banking, if your bank offers it.

Settings outside the bank app that protect it

Your banking app is only as safe as the phone it runs on.

Apple’s Stolen Device Protection requires Face ID or Touch ID for certain sensitive actions and adds a security delay to others when you are away from familiar places, so a thief who learned your passcode can’t instantly lock you out. Google rolled out Android theft protection features, including Theft Detection Lock and Offline Device Lock, starting in 2024, with availability that varies by device and region.

A credit freeze doesn’t protect your existing bank account, but it stops the identity theft that often follows a phone or wallet theft.

Habits that settings can’t replace

Settings stop technical attacks. Most bank fraud today is social engineering, where you are tricked into doing the work yourself.

• Your bank will not ask for a one-time code. A caller asking you to read back a code is almost always a scammer. Hang up and call the number on your card. Our guide to bank impersonation scam calls walks through the scripts they use.
• Don’t tap links in texts about your account. Open the app yourself instead. See how to spot a scam text.
• Never “move money to a safe account”. No real bank asks you to do this.
• Use the official app only, downloaded from the Apple App Store or Google Play via your bank’s website link.
• Avoid banking on public Wi-Fi without a trusted connection, and never on a shared computer.

Where to start: a 15-minute setup routine

1. Update the app and your phone’s operating system.
2. Open the app’s security settings and turn on biometric login and MFA for new devices.
3. Turn on alerts for all card transactions, transfers, new payees, new devices and profile changes.
4. Find the card lock and test it once so you know where it is in an emergency.
5. Lower transfer and P2P limits to match your real needs.
6. Remove old devices from the trusted list.
7. Turn on your phone’s theft protection and set a carrier PIN.
8. Save your bank’s fraud number in your contacts under a name you’ll recognize.

Repeat steps 3, 5 and 6 every few months, or after any new phone. If you also manage business accounts, the same principles appear in our small business cybersecurity basics.

What to do if something looks wrong

If an alert shows a charge or transfer you didn’t make:

1. Lock the card in the app immediately.
2. Call your bank’s fraud line using the number on your card or the official website, not a number from a text.
3. Change your password and sign out of all other sessions.
4. Follow up in writing and keep notes of every call, as the FTC recommends.
5. Check your phone for signs of compromise, using our guide on how to tell if your phone is hacked.
6. Report identity theft at IdentityTheft.gov if new accounts were opened.

Conclusion

Banks have quietly built strong security tools into their apps. They just don’t switch most of them on for you. Biometric login, MFA, alerts, a card lock and sensible transfer limits cover the vast majority of what can go wrong, and your phone’s own theft protection covers much of the rest. Spend 15 minutes today, and set a reminder to check again when you get a new phone.

Sources

• Federal Trade Commission: lost or stolen credit, ATM and debit cards — liability tiers and reporting advice
• Consumer Financial Protection Bureau: getting money back after debit card theft — Regulation E time limits and extensions
• CISA: multi-factor authentication — phishing-resistant FIDO authentication and MFA guidance
• Apple: Stolen Device Protection for iPhone — requirements and how the security delay works