Online banking password compromised: what to do next

A compromised banking password is urgent even if no money has moved. The attacker may be testing credentials, waiting for another authentication factor or using the same password against your email and other accounts.

Change the credential from a clean route

Do not use the link in the message that told you the password was compromised. Open the bank app or type the known website yourself. If you installed suspicious software or believe the device is controlled by someone else, use another trusted device first.

The NCSC advises changing any account passwords that use the same compromised password. Reuse turns one leak into several account takeovers.

Practical checkpoint for responding to a compromised online banking password: establish the starting position before you change anything. Use a password entered on a fake login page before the customer notices the domain was wrong as a worked example and write down time of disclosure, device used, recent logins, payees, transactions and email-account security. That turns 'Change the credential from a clean route' into a testable sequence rather than a vague problem.

Check what happened before and after the exposure

Review recent logins, payments, new payees, card-wallet registrations and profile changes. The timing matters: a £0 card verification, a new device and a changed phone number can be clues even before a large transaction appears.

If you find something you did not authorise, contact the bank immediately and explain the credential compromise rather than only disputing the individual payment.

Run the numbers or sequence on paper before repeating the action. In the example of a password entered on a fake login page before the customer notices the domain was wrong, separate the amount, date, channel and decision point, then mark which part is confirmed and which part is still an assumption. For 'Check what happened before and after the exposure', the useful question is not simply whether something can work, but what result you should see next and how long you are prepared to wait before changing route.

Second check for section 2, 'Check what happened before and after the exposure': use a password entered on a fake login page before the customer notices the domain was wrong and write a one-line expected result beside the actual result. Then verify time of disclosure, device used, recent logins, payees, transactions and email-account security. If the two do not match, pause rather than creating another transaction or application. Secure recovery channels first, then reset banking access from a trusted device and tell the bank what information was exposed.

Secure the email account that can reset everything else

Banking recovery messages often arrive by email. If the attacker controls the email account, changing the bank password alone may not end the risk. Change the email password, review recovery addresses and enable stronger authentication where available.

Do not approve repeated login prompts that you did not initiate. An attacker can deliberately generate them hoping you eventually accept one.

Use a controlled process for 'Secure the email account that can reset everything else'. Gather time of disclosure, device used, recent logins, payees, transactions and email-account security, take one deliberate action, and record the result before trying a second route. Do not change only the bank password if the email or phone used for recovery may also be compromised. If the first route clearly cannot complete the job, secure recovery channels first, then reset banking access from a trusted device and tell the bank what information was exposed rather than improvising with an unverified workaround.

Do not reveal replacement codes to anyone who calls

After a compromise, a fraudster may pose as the bank and say they need the new one-time code to finish securing the account. A real code can authorise a real action for the criminal.

Read the message around the code. If it says “do not share” or describes an action you did not start, do not provide it to anybody.

Build a failure plan before the deadline matters. For responding to a compromised online banking password, decide what you will do if the normal route fails at the worst reasonable moment: a bill is due, a payment is time-critical, a phone is unavailable or verification will not complete. Keep enough time and money outside the process to recover. Under 'Do not reveal replacement codes to anyone who calls', note the exact error or refusal wording because that is usually more useful to support than a general statement that it did not work.

Second check for section 4, 'Do not reveal replacement codes to anyone who calls': use a password entered on a fake login page before the customer notices the domain was wrong and write a one-line expected result beside the actual result. Then verify time of disclosure, device used, recent logins, payees, transactions and email-account security. If the two do not match, pause rather than creating another transaction or application. Secure recovery channels first, then reset banking access from a trusted device and tell the bank what information was exposed.

Keep monitoring after the password reset

Password change is a containment step, not proof that nothing happened. Watch the account for delayed or pending transactions and keep security alerts enabled.

If the compromise arose from phishing, report the message through the relevant channels. If money has gone, tell the bank immediately and preserve the payment and communication records.

Treat evidence as part of the solution, not paperwork added afterwards. For 'Keep monitoring after the password reset', keep time of disclosure, device used, recent logins, payees, transactions and email-account security in one dated folder and write a two-line chronology of each contact. Do not change only the bank password if the email or phone used for recovery may also be compromised, and use only a channel you reached independently when security or fraud is involved.

Treat “Keep monitoring after the password reset” as a check you should be able to prove later when dealing with Online banking password compromised: what to do next. Keep the relevant figure or status and the date you checked it. If support is needed, lead with that evidence and the outcome you want rather than a long reconstruction.

Change the password, then check what the attacker could change

A password reset is only the first repair. If somebody may have known the online-banking password, review recent payees, future-dated payments, standing orders, contact details and registered devices. Also secure the email account used for recovery: an attacker who controls email can sometimes reset financial services again after you have changed the bank password.

If the same password was reused elsewhere, change it on those services too, starting with email and mobile-network accounts. Use a different, strong password for banking and enable the bank's strongest available authentication. Do the changes from a device you trust; if the compromise followed a remote-access session or suspected malware, use another clean device until the original one has been checked or reset.

Write down the time you discovered the exposure and the first bank action you took. If an unauthorised payment later appears, that timeline helps distinguish activity before and after the bank was notified. Do not delete suspicious emails or login alerts until the account has been reviewed; they may show the route the attacker used.

Finish with a decision rule for responding to a compromised online banking password. In the worked example of a password entered on a fake login page before the customer notices the domain was wrong, the safer next step is the one that preserves evidence and keeps essential money or account access recoverable. If the provider cannot explain the next step clearly, secure recovery channels first, then reset banking access from a trusted device and tell the bank what information was exposed and keep the case reference until the outcome is reconciled.

Sources and verification

• NCSC - Phishing scams: what to do
• NCSC - How to spot a scam
• FCA - Fraudulent payments
• NCSC - recovering a hacked or infected device

MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.