Online banking without the panic: a patient, practical guide for older adults

Online banking ought to free up an afternoon, not turn it into an audition for a spy film. Used quietly and well, it makes bill-paying and a balance check wonderfully ordinary. The aim is not to become ‘good with technology’; it is to use a few steady habits that make it hard for a crook to hurry you. Security features and customer protections vary by bank, device, account and country, but the foundations travel well.

The most useful rule is pleasingly unglamorous: slow down whenever a message tries to make you speed up.

1. Make the bank come to you

A text, email, phone call or QR code saying there is an urgent problem may be genuine — but it is not the place to begin banking. Phishing messages commonly pretend to be a bank, create alarm and lead to a convincing imitation site. The Canadian Centre for Cyber Security lists urgent activity alerts, requests for codes and fake links or QR codes among common tactics.

Instead, close the message. Open the bank’s app yourself, type the web address you already know, or call the number on the back of your card. Do not use a phone number or link supplied by the unexpected message. A padlock or https is useful encryption, not proof that the organisation is honest: the US Federal Trade Commission (FTC) notes that a scammer’s fake website can be encrypted too.

This is not paranoia; it is good household administration. Genuine problems can wait the two minutes it takes to use a known route.

2. Choose a login you can live with

If your bank offers passkeys through its official app or website settings, they are worth considering. A passkey uses the way you unlock your own device — such as its PIN, fingerprint or face check — rather than a password you must remember. The UK’s National Cyber Security Centre recommends passkeys where available and explains that they are resistant to ordinary password-phishing. Set one up only on a personal, locked and up-to-date device, and make sure you understand the bank’s recovery process before retiring an old phone.

Where passkeys are not offered, use a long, unique password or passphrase for the bank. Do not reuse the password from email, shopping or social media; access to email can often be used to reset other accounts. Turn on multi-factor authentication (MFA) when the bank provides it. It adds another check — something you know, have or are — before access is granted.

A code sent by text, an app approval or a fingerprint prompt is for you to use, not to read aloud. Never approve a sign-in or payment you did not start, and never give a password, passkey, device PIN or one-time code to anybody claiming to protect you. Banks have rather a lot of security theatre already; handing out the ticket defeats the point.

3. Treat the device and connection as part of the bank

Turn on automatic updates for your phone, tablet or computer, its browser and the banking app. Updates repair security weaknesses, and the Canadian guidance specifically advises patching devices and downloading banking apps only from official stores or the financial institution’s own site. Lock the device with a PIN, passcode or biometric check and keep lock-screen notifications discreet.

For routine banking, prefer your home connection or mobile data. Public Wi-Fi is not automatically disastrous — modern encrypted websites make it usually safer than it once was — but it is no place for carelessness, and a secure connection cannot turn a fake bank site into a real one. Avoid banking on public or shared computers altogether. If you are travelling and uncertain, wait until you have mobile data or a trusted connection. Convenience is a fine servant, but a poor reason to use the hotel lobby computer.

4. Accept help without handing over the keys

A trusted relative, friend or carer can be excellent company while you learn. Their role is to help you read the screen, find the official number, write questions down or sit with you while you operate your account. They should never know your passwords, device-unlock PIN, passkeys, security answers or one-time codes; nor should they install remote-access software or take control of your screen. Remote access is a favourite shortcut of scammers precisely because it gives them a front-row seat to everything.

If you need continuing assistance, ask the bank about its official accessibility support, authorised-representative or power-of-attorney process. Use the bank’s formal arrangement rather than a shared login. The UK’s MoneyHelper notes that many banks offer free digital lessons by phone or video; availability will vary, but it is always reasonable to ask. Independence does not mean struggling alone.

5. Make checks a small routine, not a nightly vigil

Turn on alerts for card use, payments and new logins if your bank offers them. Then give the account a brief, regular look — perhaps weekly, and after a trip, an online purchase or a change of device. Check recent transactions, payees, contact details, linked devices and any new standing orders or direct debits. The first unfamiliar small payment deserves attention too; it can be a test run rather than a typo.

A short before-you-bank checklist

• Use the official app or a web address you entered yourself.
• Pause if anyone creates urgency or asks for a code.
• Check the payee and amount before confirming a transfer.
• Keep updates on and lock the device when finished.
• If anything feels wrong, stop and call the bank through a known number.

There is time left for better things than refreshing a balance. That time can go to people and stories; MemContinuity Publications offers reflective reading paths about family, heritage and connection.

6. If something goes wrong, act promptly and methodically

If you clicked a link, shared information, approved something by mistake or see an unfamiliar transaction, do not spend the next hour trying to outwit the caller. End the contact and call the bank or card provider immediately using its app, website or the number on your card. Explain exactly what happened and ask it to secure the account, stop or try to reverse transactions, and advise the next steps. Canada’s national cyber guidance similarly says to contact the bank right away and review transactions, account details, security settings and linked services.

Write down the date, time, amount, recipient, transaction reference and what the message or caller said. Keep screenshots and messages; do not keep engaging with the scammer. On a clean, updated device, follow the bank’s directions on changing credentials and check email as well, since it may be a recovery route. If you installed remote-access software, disconnect and seek reputable technical help; do not let the original caller ‘fix’ it. Prompt reporting is about protecting your account, not assigning blame.

7. Country examples: help and complaint paths

These are examples, not a worldwide rulebook. Eligibility, complaint deadlines and protection can depend on where you live, the institution, payment type and account terms.

United Kingdom. Contact the bank first. For an unexpected call about money, use the number on the card or, where applicable, dial 159; MoneyHelper describes 159 and advises never sharing one-time passcodes. If the bank does not resolve a complaint, the free Financial Ombudsman Service route starts after the business has had the appropriate chance to respond.

Canada. Contact the bank immediately, then report attempted or actual fraud to the Canadian Anti-Fraud Centre. For a complaint about a federally regulated bank, use the bank’s own process first. The Financial Consumer Agency of Canada says the bank must provide a detailed written response within 56 calendar days; in defined circumstances a customer can then approach the Ombudsman for Banking Services and Investments. Provincial credit unions may follow a different route.

Australia. Tell the bank or card provider to stop transactions straight away, then report the scam to Scamwatch. For an unresolved complaint about an eligible member financial firm, first raise it with the firm, then consider the Australian Financial Complaints Authority’s free, independent process.

United States. Report an unauthorised electronic transfer to the bank or credit union immediately. For lost or stolen debit cards or security codes, the Consumer Financial Protection Bureau says US federal protections can be stronger when notice is given within two business days; statement-related deadlines can also matter. If a provider issue remains unresolved, the CFPB has an online financial-product complaint route. Do not apply these US timelines outside the US.

Money is only one thread in a life. When a family comes together to celebrate someone, the tales behind a first pay packet, a carefully saved holiday or quiet generosity can be worth preserving — alongside the photographs — in a MemContinuity memorial.

Official sources

• Canadian Centre for Cyber Security: online banking securely
• UK National Cyber Security Centre: passkeys
• MoneyHelper: guide to digital banking
• Financial Ombudsman Service: how to complain
• Scamwatch: report a scam
• Australian Financial Complaints Authority: make a complaint
• US Consumer Financial Protection Bureau: unauthorised transactions
• US Federal Trade Commission: public Wi-Fi safety

This is general education, not personal financial, legal or tax advice. For an urgent suspected fraud, contact your bank or card provider through a verified route immediately; for individual rights or a complaint, use the relevant official process in your country.

More Finance reading

Money Scams That Target Trust: Fake Bank Staff, Romance Fraud and AI Voices · Digital Money Records Your Family Can Actually Find