Updated October 2026. This page started in 2019 as a summary of the security frameworks large banks follow. That summary is kept, shortened, because it answers a question customers rarely get a straight answer to: what does my bank actually do? The second half is new, and it is about the part of account security that no bank can do for you.

The short answer: banks protect data with a formal risk framework, encryption, monitoring and staff training, and that side rarely fails. Most account losses now start with a person: a text, a call, a copied password or a lost phone. Four habits close those doors, and the first is to stop using text-message codes. Our passkey guide explains the replacement.

What your bank does on its side

The parts of a bank's security program, what each one does and the standard behind it

Layer	What it does	Where it comes from
Governance	The board owns a written security program, funds it and reviews it at least yearly	FFIEC Information Security booklet
Risk identification	Threats are modelled, vulnerabilities mapped and third parties audited	NIST Cybersecurity Framework: Identify
Protection	Encryption in transit and at rest, access controls, patching, staff training	NIST: Protect
Detection and response	Monitoring, incident playbooks and reporting to regulators within set deadlines	NIST: Detect, Respond, Recover
Customer authentication	Strong sign-in, device checks and transaction alerts shared with the customer	FFIEC authentication guidance

The NIST Cybersecurity Framework, revised as version 2.0 in 2024, added a sixth function, Govern, which simply made explicit what the banking regulators' Information Security booklet had required all along: someone at the top is accountable. Encryption itself is not where banks are breached. People are.

Where the losses actually happen

The Verizon Data Breach Investigations Report for 2025 found a human element in about 60% of breaches: a credential reused, a link clicked, a code read out to a caller. That matches what banks see. The vault holds; the customer is talked into opening the door.

Three patterns cover most of it. A message that looks like the bank asks you to "verify" a code, and the code is the one-time passcode for a transfer the attacker just started. A caller claiming to be the fraud team walks you through "moving money to a safe account". Or a phone is lost, the SIM is swapped, and every text-message code now goes to someone else.

Four things only you can do

1. Replace text-message codes. Turn on a passkey or an authenticator app wherever the bank offers one. A code sent by SMS can be intercepted or simply read out to a caller; a passkey cannot be given away.
2. Set up recovery before you need it. Add a second device or a recovery contact now. Our guide to what happens when you lose your phone walks through the order.
3. Never move money on a call you did not start. Hang up, wait a minute, and call the number on the back of the card. A real fraud team will never ask you to transfer funds.
4. Turn on alerts for every transaction. An instant notification is the fastest breach detection system there is, and it is free.

None of these needs the bank's permission. All of them work with the bank's own controls rather than around them.

If something has already gone wrong

Call the bank from a number you trust, freeze the card or account, change the password from a device you control, and ask the bank to note the date and time of your report. In most countries the clock on your liability starts when you tell the bank, so report first and investigate second.

Frequently asked questions

Is online banking safer in the app or in a browser?

The app, slightly. It is tied to one device, checks the phone's integrity and cannot be sent to a look-alike website. A browser is fine if you type the address yourself.

Are bank websites encrypted?

Yes, everywhere. The padlock in the address bar proves the connection, not the identity of whoever sent you the link, so the padlock is not a reason to trust a page you arrived at from a message.

Why does the bank still send SMS codes if they are weak?

Because every phone can receive one and regulators accept it as a second factor. Banks are moving to app approvals and passkeys; switch as soon as yours offers it.