Use a passphrase that nothing else uses

Four random words plus a couple of digits — generated by a tool, never reused on other sites. Run yours through the breach check linked below.

Turn on two-factor authentication (2FA)

In your bank app: Profile or Security → Two-step verification → ON. Pick "authenticator app" if available — text codes can be defeated by SIM swap. Authy and Google Authenticator are both free.

Set up biometric unlock on the app

Face ID or fingerprint to open the app — every major US bank supports it. Faster than typing the password every time, and the password becomes less exposed.

Bookmark the bank's real site

Type the address into the browser exactly once, bookmark it, and use that bookmark forever. Never click a "log in here" link in an email — that is the most common way phishing scams steal banking passwords.

Alert on every transaction over $1

In the app: Notifications → Account alerts → "Any debit/credit card purchase". Some banks let you set a minimum — set it to $1 so you see everything. The first sign of fraud is usually a small test charge.

Alert on every login from a new device

Settings → Security → "Notify me of sign-ins from new devices". If you ever get one of these and it was not you, change the password immediately.

Alert on bank transfers and Zelle / Venmo / Cash App

These are how scammers move money out fastest. Get an alert the moment one is initiated — not only when it completes. Some banks call this "Outgoing wire alert" or "Pending Zelle".

Set a daily transfer limit

Banks let you cap the daily amount that can leave your account. $500/day is plenty for normal use and stops a scammer from draining you in one shot. Raise it temporarily on the rare day you need to.

Never give a "verification code" by phone

No real bank will ever call and ask you to read back the 6-digit code that landed on your phone. That code is what the scammer needs to take over your account. Hang up.

Never move money to "keep it safe"

A common scam: someone calls claiming to be the bank's fraud department, says your money is at risk, and tells you to wire it to a "safe account". This is always a scam. Your bank already has a safe account — yours.

Treat Zelle and wire transfers like cash

Both are essentially un-reversible. Once you send, the money is gone. Only use Zelle to send money to people you actually know — never to "buy" something or "verify" anything.

Add a trusted contact to the account

Banks let you name a "trusted contact" — a family member they can call if something looks wrong on your account (large transfer, new device login, signs of confusion). They cannot move your money — only get notified.

Call the number on the back of your card

Not the number in any email, text, or pop-up. The number on your physical card is the only number you can trust. Memorize the location of that card.

Lock the card from inside the app

Every major US bank now has a "lock my card" toggle. It freezes new charges instantly while you investigate. You can unfreeze in one tap once it is sorted.

Pull credit reports if anything is unfamiliar

AnnualCreditReport.com is the only government-authorised free source. Equifax, Experian, and TransUnion each give you one free per year — pull all three.

File at IdentityTheft.gov for an official record

The FTC will build you a recovery plan and give you an "Identity Theft Report" — a document banks and credit bureaus take more seriously than a phone call.