We will never phone, email or text you asking for a password, a full PIN, a one-time code, or to move money to a "safe account". Anyone doing so is not us, whatever the caller ID says.
What protects your account
Security is layered: no single control is expected to hold on its own, which is why losing one does not lose the account.
- Encryption
- AES-256 at rest and TLS in transit, on every channel including the mobile app.
- Two-factor authentication
- A second factor on sign-in and again on sensitive actions. An authenticator app is stronger than SMS, because a SIM can be swapped.
- Device recognition
- A sign-in from an unrecognised device triggers a challenge and a notification to you.
- Behavioural monitoring
- Transactions are scored continuously. Unusual patterns raise an alert or a hold rather than sailing through.
- Session controls
- Sessions expire on inactivity, and every active session is listed so you can end one you do not recognise.
- Change notifications
- Any change to your password, contact details or beneficiaries is notified to your existing details, not the new ones.
The settings worth turning on today
- 1Switch two-factor authentication to an authenticator app rather than SMS.
- 2Turn on alerts for large transactions and for any payment to a new beneficiary.
- 3Set your own card and transfer limits below the maximum. Most people never need the ceiling.
- 4Review your trusted devices and remove anything you no longer own.
- 5Use a unique password for this account. A password manager makes that painless.
The single highest-value change
A unique password plus an authenticator app defeats almost every credential attack, including the ones that start with a breach at some unrelated website.
What we will never do
- Ask for your full password, your full PIN, or a one-time code, by any channel.
- Ask you to move money to a "safe", "holding" or "secure" account. No such thing exists.
- Ask you to install remote-access software so someone can "help" you.
- Send you a link to sign in and approve a payment. Reach us by typing the address or using your own bookmark.
- Pressure you to act immediately or keep a payment secret from anyone.
Caller ID can be faked
A call that appears to come from our number can be spoofed. If a call worries you, hang up, wait a minute, and call back on the number from this website or the back of your card.
If you cannot get in
| Problem | What to do |
|---|---|
| Forgotten password | Reset it from the sign-in screen. The link goes to your registered address only. |
| Forgotten username | Recover it from the sign-in screen using your registered details. |
| Account locked | Locks release after a cooling-off period, or sooner once your identity is verified. |
| One-time code not arriving | Check signal and the number on file. An authenticator app removes the problem entirely. |
| New phone | Re-enrol the authenticator from a trusted device, or verify your identity with us. |
| You think someone else has access | Change your password, end all sessions, and report it immediately. |
Documents you may also need
Inside Online Banking
Everything the platform does, screen by screen: accounts, payments, cards, statements, insight and the controls you hold yourself.
Online BankingWays to Move Money
Every transfer type on the platform: which to use, what it costs, how long it takes, and what to do when one goes wrong.
Online BankingBanking on Your Phone
How to get the app, or install the web app to your home screen in ten seconds — and what works differently on a phone.
This document was last updated on 1 August 2026. We publish the current version here at all times; superseded versions are available on request.
If anything on this page is unclear, write to us and we will explain it.