How well does YOUR bank protect you from mobile and online fraud?

Customers who bank with TSB and Co-op are more at risk from online and mobile banking scams, research shows.

Weaknesses in some banks’ security measures for online and mobile banking could leave customers more exposed to scammers, new data from Which? reveals.

TSB ranked lowest for mobile app security and second lowest for online security of the banks Which? investigated. 

Thirteen major banks were tested on their login procedures, security, account management and navigation and automatic logout and then ranked.

TSB was the only bank to score two stars out of five for online account management, and two stars for security best practice for its app.

Well protected: Which? has investigated how safe banks keep customers from fraud

The biggest problem Which? found with TSB’s app is that sensitive data could be read by other apps running on the phone. 

The app was also found to store users’ credentials in an insecure way, which makes it more likely that other apps could access them.

Another problem is that TSB specifically asks users to ‘trust’ a device but does not offer a way to ‘distrust’ it afterwards.

The also bank sent a phone number in an SMS alert, which could be replicated by scammers.

TSB’s password requirements are only six characters, meaning users can still choose a range of insecure passwords which are easier for scammers to crack.

Despite ranking poorly for mobile app and online security, TSB is currently the only bank to offer a Fraud Refund Guarantee, fully reimbursing customers who have been victims of fraud. 

TSB said: ‘We continue to strengthen the security of our internet and mobile banking while delivering a positive and convenient user experience for customers. That’s reflected in our high app store ratings.’

Co-op Bank

Co-op ranked worst for online security, receiving three stars for both account management and navigation.

When it comes to security on its mobile app, Co-op came second-last with a score of 57 per cent. 

It was the only bank to fail to require a two factor authentication login on a test laptop. The bank also does not prevent customers from setting weak passwords.

Like TSB, Co-op also sent phone numbers in alerts and security codes.

A spokesperson from Co-op Bank said: ‘The security of our customers’ accounts is always our top priority. Customers can be assured we have robust security measures in place to protect them and their money.

‘We are constantly reviewing and enhancing our security controls and we will be delivering a number of further improvements in 2024 to give our customers peace of mind that they can continue to bank safely and securely with us.’

Lloyds Bank

Lloyds was the only bank that failed to log website users out after five minutes of inactivity, despite this being a regulatory requirement.

A spokesperson from Lloyds said: ‘Helping to keep our customers’ money and data safe is our priority and we have robust, multi-layer security across our online and mobile banking services to protect against potential cyber security threats. We employ world-class experts in the cyber-security field and continually invest to deliver the right balance of online security measures, customer experience and accessibility.

‘Whilst written in the Payment Systems Regulator’s regulation for Secure Customer Authentication, Lloyds Banking Group has made the regulators aware that we would not enforce this on payments and log-on given the considerations for vulnerable customers and businesses that may need longer than that period to complete the transaction.

‘Log-ons from new devices are verified through secondary verification to customers’ registered phones to establish the trust for any devices used. Given this, there are no customer untrusted devices.’

Starling, NatWest and RBS ranked best for online security. These banks scored four stars for login security online and a full five stars for security best practice, account management and navigation.

The best bank for mobile app security was HSBC, with a total score of 78 per cent. HSBC does not rely on SMS for logins, and had no issues with logouts or navigation when tested.

Barclays came second in the mobile app rankings.

A UK Finance spokesperson said: ‘Fraud has a devastating impact on victims, so the banking and finance industry’s primary focus is always on stopping fraud from happening in the first place. To do so, the industry invests heavily in cyber security and data sharing, seeking to detect and prevent malicious actors from infiltrating systems, stealing data, and committing fraud.

‘As the fraud landscape evolves, banks update and reinforce security measures on their platforms to mitigate potential threats, whilst maintaining a positive user experience for customers.’