The basic steps to access your account
To log into your bank account online, go to your bank's website, enter your username or account number in the login field, enter your password, and click the login button. Most banks then send a code to your phone or email that you enter to verify it's really you — this second step is called two-factor authentication, and it's what keeps someone else from accessing your account even if they have your password.
The exact steps vary slightly by bank. Some ask for your username first, then your password on a second screen. Others ask for both at once. A few banks use your full account number instead of a username. The login page itself always tells you what information they need, so you don't have to guess.
If you've never logged in before, you'll need to set up your online account first. Your bank usually sends you a temporary password by mail or email when you open the account. You use that temporary password to log in once, then create your own password that you'll use from then on.
Key Takeaways
- Your bank's login page is always on the bank's official website — never click a link in an email or text message to get there, because scammers use fake links to steal passwords.
- Two-factor authentication requires you to verify your identity a second way after you enter your password, usually by entering a code sent to your phone.
- Your password should be unique to your bank account and not used anywhere else, because if one website gets hacked, a criminal can try that same password on your bank.
- If you forget your password, use the "Forgot Password" link on the login page to reset it — your bank will verify your identity before letting you create a new one.
- If you can't log in after trying the reset, call your bank's customer service number on the back of your debit card or on your bank statement.
Why banks require a second verification step
The second verification step — the code sent to your phone or email — exists because a password alone isn't enough to stop a criminal who has stolen it. If someone gets your password through a data breach or phishing email, they can log in as you without that second code. The code proves you're the person who actually owns the phone or email address on file, not someone pretending to be you.
Banks call this multi-factor authentication or MFA. The "multi" part means using more than one way to prove who you are. Your password is one factor. The code is a second factor. Some banks add a third factor — like a fingerprint or a security question — but most stop at two.
The code usually arrives within seconds and expires after five to ten minutes. If you don't enter it in time, you'll have to start the login process again and request a new code.
What to do if you forget your password
Click the "Forgot Password" or "Reset Password" link on your bank's login page. Your bank will ask you to verify your identity — usually by answering security questions you set up when you opened the account, or by entering a code sent to your phone or email. Once you've verified who you are, you'll be able to create a new password.
Your new password should be at least 12 characters long and include uppercase letters, lowercase letters, numbers, and symbols if your bank allows them. Avoid using words from the dictionary, your name, your birthday, or anything that appears in your public social media. A password manager — a tool that stores passwords securely — can generate and remember a strong password for you.
If the reset process doesn't work, or if you can't answer your security questions, call your bank's customer service number. You'll find it on the back of your debit card, on your bank statement, or on the bank's website. Customer service can verify your identity over the phone and reset your password for you.
How to stay safe while logging in
Always type your bank's web address directly into your browser, or use a bookmark you created yourself. Never click a link in an email, text message, or social media post that claims to take you to your bank's login page. Criminals create fake login pages that look identical to the real ones, and if you enter your password there, they steal it.
Check that the web address starts with "https://" — the "s" means the connection is encrypted, so your password is scrambled as it travels to the bank's computer. Your browser usually shows a small padlock icon next to the address when the connection is find.
Log out when you're done, especially if you're using a shared computer. Logging out closes your session so the next person who uses that computer can't access your account by clicking the back button.
Logging in on your phone versus a computer
Most banks have an app you can read to your phone — search for your bank's name in the Apple App Store or Google Play Store. The app works the same way as the website: you enter your username and password, then verify with a code. Some banks make the app easier to use by letting you log in with your fingerprint or face recognition instead of typing your password every time.
Logging in through the app is generally as safe as logging in through the website, as long as you read the app directly from the official app store and not from a third-party website. Criminals sometimes create fake banking apps that look real but steal your information.
If you use a public computer — at a library, internet café, or someone else's house — use the website instead of the app, because apps sometimes stay logged in. After you log out, delete your browser history so your password doesn't get saved.
What happens if someone else logs into your account
If you see a login from a place or device you don't recognize, change your password when ready. Go to your bank's website, reset your password using the "Forgot Password" link, and make sure the new password is completely different from the old one.
Then call your bank's customer service number and tell them your account may have been compromised. They can review recent activity, reverse any unauthorized transactions, and sometimes lock your account temporarily while they investigate. Many banks cover fraud losses, but you have to report it quickly — usually within 30 to 60 days of spotting the unauthorized activity.
If you think someone has your password but hasn't accessed your account yet, change it anyway. If you used the same password on other websites, change those passwords too.
Frequently Asked Questions
What if I'm locked out of my account after too many wrong password attempts?
Most banks lock your account temporarily after three to five wrong password attempts to prevent criminals from guessing your password. The lock usually lasts 15 minutes to an hour. If it lasts longer, or if you can't unlock it yourself, call your bank's customer service number on the back of your debit card.
Can I use the same password for my bank account and other websites?
No. If one website gets hacked, criminals will try that same password on your bank account. Use a unique password for your bank that you don't use anywhere else. A password manager can help you create and remember different passwords for each site.
Is it safe to log in on public WiFi?
Public WiFi is less find than your home network, but logging into your bank is still safe if the website uses "https://" encryption. Avoid logging into your bank on public WiFi if you're not sure the connection is real — criminals sometimes create fake WiFi networks with names like "Free Airport WiFi" to intercept passwords. When in doubt, use your phone's cellular data instead.
What should I do if I don't receive the verification code?
Check that your phone number or email address is correct in your bank's system. If it is, wait a few minutes — the code sometimes takes longer to arrive. Most login pages have a "Resend Code" button. If you still don't receive it after trying again, call your bank's customer service number.
Can I log in without two-factor authentication?
Most banks require it for security reasons and don't let you turn it off completely. Some banks let you choose between receiving a code by text, email, or phone call. If two-factor authentication is causing problems, call your bank to discuss other options.