Could someone move money from your account if they get your phone or a code?

A phone can hold your bank app, text messages, email and payment alerts in one place. That convenience also makes a lost phone or a convincing scam call stressful. The good news is that you can reduce the risk without installing a collection of security apps.

Protect the phone and the SIM, keep banking credentials private and know how to reach your bank quickly. If you notice an unauthorised transaction, report it immediately through the bank’s official channel. No checklist guarantees that every loss can be recovered.

Secure the phone before you open the banking app

Set a screen lock that only you know. A long PIN or password is generally harder to guess than a short, obvious pattern. If your phone supports fingerprint or face unlock, understand how it falls back to the device PIN and keep that PIN private too.

Set the screen to lock promptly when the phone is idle. Avoid lending an unlocked phone to someone you do not trust, especially when financial apps and SMS messages are accessible. Review notification settings if transaction alerts or verification codes appear in full on the lock screen.

Keep the phone and banking app updated through the official app store or the bank’s verified website. Updates can fix security problems, but do not install an app from a link in an unexpected message claiming your account will be blocked today.

Install and verify the genuine app

Open the bank’s official website yourself and follow its link to the app store, or search the store and check the developer name carefully. Lookalike names, copied logos and misleading adverts can appear convincing. If you are unsure, call the number printed on your card or shown on the bank’s official website.

Read the permissions an app requests. Some features may require camera access to scan a document or make a payment, but a request should fit the action you are taking. Do not give an unknown app broad accessibility, screen-sharing or remote-control access because a caller says it is needed to fix your account.

Avoid using a device you suspect has been compromised for banking. Disconnect it from the internet if appropriate, use another trusted device to contact your bank and follow the bank’s instructions. Removing an app does not necessarily undo an unauthorised transaction.

Keep PINs, passwords and one-time codes private

Do not tell anyone your banking password, card PIN, mobile money PIN or one-time verification code. A scammer may claim that the code is needed to reverse a transfer, receive a refund or stop fraud. If you did not initiate the action, do not enter or share the code.

A genuine-looking caller ID or message thread is not sufficient proof of identity. End the call and contact the bank using the number on your card, its official app or a number you independently find on its website. Do not call back a number supplied in the suspicious message.

Use a unique password for any email account connected to your bank, since that inbox may receive important alerts or recovery messages. Our guide on strong passwords gives practical ways to create one.

Protect your SIM and mobile line

Your phone number may receive transaction alerts or login codes. Ask your mobile network about available SIM security options, and use a SIM PIN if you understand how to manage it. Do not guess the SIM PIN repeatedly; too many incorrect attempts can lock the SIM and require a recovery code from the network.

If your phone is lost or your line suddenly stops working without explanation, contact the network promptly through its official support service. Ask about blocking or replacing the SIM and securing the number. Also contact your bank if the number is linked to your account.

A SIM lock is not the same as your banking PIN, and locking the SIM alone does not protect an unlocked banking app. Use both device and account security measures where available.

Turn on alerts and check your transaction limits

Enable transaction notifications in your bank app or through the bank’s official service if available. Review alerts promptly, but remember that a fake alert can also be used to make you call a scammer’s number. Open the bank app or use an official contact if something looks wrong.

Check the transfer limits and payment controls your bank offers. A lower limit may reduce exposure for some transactions, though it can also make a legitimate payment inconvenient. The exact controls differ by bank, so ask your bank how to set or change them.

Review account statements and beneficiary lists regularly. A small unfamiliar transaction can still be worth reporting. Do not wait for a large loss before contacting the bank, and do not assume every unknown entry is fraud until the bank has checked it.

Be careful when paying through links or QR codes

A message that appears to be from a seller, delivery company or support agent may lead to a fake payment page. Rather than opening a surprise link, go to the service through its official app or a known website address. Check the recipient name and amount in your banking app before approving a transfer.

A QR code can contain a website address or payment details. Treat it like a link: look at the destination and recipient before continuing. If a seller sends new payment details halfway through a conversation, verify the change through a separate known channel.

When shopping online, use the payment method and dispute process you understand. Our guide to shopping online safely explains how to check sellers and keep receipts.

What to do after a suspicious transaction

Contact your bank or mobile money provider immediately using its verified number or app. Say whether you lost the device, shared a code or noticed a payment you did not approve. Ask about securing the account, blocking cards or channels and reporting the transaction.

Keep the transaction reference, amount, time and relevant messages. Do not alter evidence or send another payment to someone promising to retrieve your money. The provider can explain its investigation and dispute process, including any deadlines; recovery is not guaranteed.

If the phone or SIM is missing, contact your network as well. Change affected passwords from a trusted device and secure the email account connected to your financial services. If appropriate, report the incident to local authorities using an independently verified contact.

The most useful preparation is knowing what to do before something goes wrong: keep your official support details somewhere accessible, switch on alerts and make sure no one else knows the credentials that approve payments.