Forgot your banking app passcode: safe recovery steps

Forgetting a banking-app passcode is an access problem, not a reason to create a new account or hand security codes to support callers. Banks normally provide a reset or re-registration route that may ask for another factor because the forgotten passcode was one of the things protecting the account.

Use recovery, not trial-and-error

Repeated guesses can trigger a lock or stronger security check. Once you know you do not remember the passcode, move to the bank’s recovery option rather than cycling through old numbers.

A deliberate reset is easier to explain than a series of failed login attempts followed by an emergency support call.

Practical checkpoint for recovering a forgotten banking app passcode: establish the starting position before you change anything. Use a customer who knows the account details but has forgotten the app-only passcode as a worked example and write down official recovery screen, registered phone, identity document and any recovery reference. That turns 'Use recovery, not trial-and-error' into a testable sequence rather than a vague problem.

Second check for section 1, 'Use recovery, not trial-and-error': use a customer who knows the account details but has forgotten the app-only passcode and write a one-line expected result beside the actual result. Then verify official recovery screen, registered phone, identity document and any recovery reference. If the two do not match, pause rather than creating another transaction or application. Start recovery from the bank app or official website and use telephone or branch support only through a trusted number.

Expect the bank to ask for another proof of identity

The FCA’s Strong Customer Authentication framework is designed so account access is not dependent on one secret alone. Recovery may therefore use a registered device, SMS, card information, biometrics or a fuller identity check.

That extra step protects you from someone who steals the phone and simply taps “forgot passcode”.

Run the numbers or sequence on paper before repeating the action. In the example of a customer who knows the account details but has forgotten the app-only passcode, separate the amount, date, channel and decision point, then mark which part is confirmed and which part is still an assumption. For 'Expect the bank to ask for another proof of identity', the useful question is not simply whether something can work, but what result you should see next and how long you are prepared to wait before changing route.

Second check for section 2, 'Expect the bank to ask for another proof of identity': use a customer who knows the account details but has forgotten the app-only passcode and write a one-line expected result beside the actual result. Then verify official recovery screen, registered phone, identity document and any recovery reference. If the two do not match, pause rather than creating another transaction or application. Start recovery from the bank app or official website and use telephone or branch support only through a trusted number.

Do not let a caller perform the reset for you

A fraudster can claim they need to read back the recovery code or approve a notification to reset your passcode. A genuine one-time code can instead be registering their device or authorising a transaction.

Follow the wording in the official app and keep recovery codes private unless the bank explicitly designs a secure process otherwise.

Use a controlled process for 'Do not let a caller perform the reset for you'. Gather official recovery screen, registered phone, identity document and any recovery reference, take one deliberate action, and record the result before trying a second route. Do not guess repeatedly until the app locks or follow a recovery link sent by an unknown caller. If the first route clearly cannot complete the job, start recovery from the bank app or official website and use telephone or branch support only through a trusted number rather than improvising with an unverified workaround.

If the phone or number also changed, treat it as a device migration

You may need to re-register the banking app rather than merely reset a local passcode. Keep the old device or number available if possible until access on the new handset is confirmed.

If both were lost, use the bank’s formal account-recovery support rather than unofficial online advice.

Build a failure plan before the deadline matters. For recovering a forgotten banking app passcode, decide what you will do if the normal route fails at the worst reasonable moment: a bill is due, a payment is time-critical, a phone is unavailable or verification will not complete. Keep enough time and money outside the process to recover. Under 'If the phone or number also changed, treat it as a device migration', note the exact error or refusal wording because that is usually more useful to support than a general statement that it did not work.

Second check for section 4, 'If the phone or number also changed, treat it as a device migration': use a customer who knows the account details but has forgotten the app-only passcode and write a one-line expected result beside the actual result. Then verify official recovery screen, registered phone, identity document and any recovery reference. If the two do not match, pause rather than creating another transaction or application. Start recovery from the bank app or official website and use telephone or branch support only through a trusted number.

After recovery, choose a code you can keep private

Avoid obvious sequences or a code reused from something visible to other people. Enable biometrics if the bank supports them and they suit you, but keep the fallback passcode secure because it may still be needed after device updates or biometric failures.

If the forgotten-passcode event followed suspicious login alerts, review the account after regaining access rather than assuming memory was the only problem.

Treat evidence as part of the solution, not paperwork added afterwards. For 'After recovery, choose a code you can keep private', keep official recovery screen, registered phone, identity document and any recovery reference in one dated folder and write a two-line chronology of each contact. Do not guess repeatedly until the app locks or follow a recovery link sent by an unknown caller, and use only a channel you reached independently when security or fraud is involved.

Recover access without creating a second security problem

Before resetting anything, establish what you still control: the registered mobile number, email address, physical card, another trusted device and any online-banking route. Banks deliberately make passcode recovery stricter than an ordinary app setting because a thief with an unlocked phone should not be able to reset banking access merely by tapping 'forgot'. Follow the bank's own recovery journey rather than a link sent by text or a person offering to help by phone.

If an essential payment is due today, separate the payment problem from the login problem. Contact the bank through a verified route and ask what alternative channel is available. Giving a friend your account details or allowing somebody to remote-control the phone may solve the deadline but creates a much larger fraud risk. Keep evidence of any late fee caused by a genuine access failure in case a service complaint later becomes necessary.

After access returns, check recent transactions, registered devices, phone number and notification settings before carrying on as normal. If you received unexpected password-reset or device-registration messages while locked out, treat them as possible account-takeover evidence. A forgotten passcode is routine; an unexplained recovery attempt at the same time is not.

Finish with a decision rule for recovering a forgotten banking app passcode. In the worked example of a customer who knows the account details but has forgotten the app-only passcode, the safer next step is the one that preserves evidence and keeps essential money or account access recoverable. If the provider cannot explain the next step clearly, start recovery from the bank app or official website and use telephone or branch support only through a trusted number and keep the case reference until the outcome is reconciled.

Sources and verification

• FCA - Confirming your identity
• NCSC - Phishing scams: what to do
• NCSC - spotting and reporting phishing

MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.