Best and worst UK banks for online banking revealed

With the rise of digital payments, you may be wondering what the best UK bank for online banking is. 

The banking sector has undergone a digital transformation in the last few years, with many customers shifting from traditional banks to online platforms. But that doesn’t come without its drawbacks – with banking copycat websites and banking app scams on the rise, you could be worried about just how safe your money is.

According to UK Finance, customers lost £18.7 million to mobile banking scams in the first six months of 2023. This was up by 17% from the year before and was the biggest hike recorded since the trade body began collecting data in 2015. 

Subscribe to MoneyWeek

Subscribe to MoneyWeek today and get your first six magazine issues absolutely FREE

Get 6 issues free

Sign up to Money Morning

Don't miss the latest investment and personal finances news, market analysis, plus money-saving tips with our free twice-daily newsletter

Don't miss the latest investment and personal finances news, market analysis, plus money-saving tips with our free twice-daily newsletter

Sign up

Which? has revealed the best and worst UK banks for online banking and mobile app banking. The data is tested on four parameters –  how customers can log in or access their account, security features, navigation and logging out. 

We look at the winners and losers, so you can see where your provider sits. 

Best UK banks for online banking – how they rank

Here are the best online banks in the UK, and what made them safer than the others. 

1. NatWest/RBS and Starling Bank

NatWest/RBS and Starling Bank received a total of 87% in all four categories and five stars for security best practices, account management and navigation. 

2. HSBC Bank

High street giant HSBC received a score of 80% and five stars for safe access to accounts, recovering usernames and passwords, navigation and logging out. 

3. Barclays

Barclays appears to be taking active measures to crack down on financial crime, announcing a return of its £20k cash deposit limit in its branches. Though it scored 78% for safe online banking, it still allows customers to access their accounts through multiple browsers, IP addresses and devices. Which? warns that this could potentially provide criminals with loopholes to target their money. 

4. First Direct and Nationwide

In February 2024, Nationwide rated poorly with a score of 63%, but it seems to have taken active measures to improve. MoneyWeek asked Nationwide about these changes, and the upgrades involve removing the ability to open multiple sessions online to prevent scammers from hijacking data, and authentication to access online banking via the mobile banking app. Customers can also use FaceID or fingerprints to authenticate their account, while previously, they would have to use the card reader. 

Now, the bank scores 74%, having received five out of five stars for login and security best practices. It still needs to upgrade its system for account management, navigation and logging out.

First Direct also made a slight improvement of 1% and now has a score of 74% for safe online banking. 

5. Lloyds Bank

The increase in digital banking has resulted in the closure of many high-street bank branches, and Lloyds Bank Group (which includes Lloyds, Halifax and Bank of Scotland) has seen some of the most extensive closures. The total number of its branches shutting their doors will reach a whopping 300 in 2025. But does this mean online banking is being made safer for the customers who are making the switch?

Lloyds Bank scored 69% for its safe online banking practices. It only received three stars for account management but successfully implemented strict measures regarding navigation and logging out. However, it was the only bank that did not log out users after five minutes of being inactive, even though this is a regulatory requirement. 

The bank told Which? that it makes it easier for vulnerable customers and businesses that may need longer periods to complete transactions, but that they would be logged out after ten minutes of inactivity. 

6. Virgin Money

Virgin Money only scored two out of five stars when it came to navigation and logging out, while receiving a total aggregate score of 68%. It was ranked two places below Nationwide, which has agreed to take over Virgin Money for £2.8 billion. The Nationwide-Virgin Money takeover could potentially be the biggest UK bank takeover since the 2008 financial crisis. 

7. Santander and TSB

While Santander scored a solid five in security best practices, navigation and logging out, it fell short of two stars in login and account management, bringing its average down to just 67%, the second-lowest of all online banks. 

Though TSB only scored 67%, it was the only bank to receive two stars for online account management.

8.  The Co-operative Bank

At the bottom of the list came the Co-operative Bank, which scored only 61%, marking a significant gap between the last and the second-last position. This is because it’s the only bank that failed to ask for two-factor authentication on a test laptop, thus scoring poorly in security measures. 

Banking apps - how they rank

This is how the banks rank in terms of how safe their banking apps are for their customers.

1. HSBC Bank

HSBC proved to be the best online bank, especially for mobile app security. It scored a particularly high rating of 78%, which was attributed to it not using SMS for login, as well as no issues with logging out and navigation. 

2. Barclays

Though Barclays still faces a few hiccups when it comes to online banking safety, it ranks second best for mobile banking app security, receiving a total of 74%.

3. Santander and Chase

Santander and Chase received 73% and averaged four out of five stars for almost all sections except login and account access, where Santander fell short by just one star. However, it made up for that in navigation and logging out. Both banks scored five out of five in security best practices.

4. Starling Bank

While Starling was at the top for online banking security, it fell down a bit in mobile banking due to its account management systems. However, it received full stars for security best practices, navigation and logging out. 

5. NatWest/RBS 

NatWest and RBS have scored similarly to Starling after both came out on top for online banking but not for mobile banking. Scoring 71%, the main function that required improvement was account management, such as setting up a new payee and security systems for editing account details. 

6. First Direct and Nationwide

First Direct and Nationwide received the same aggregate scores again but this time they tumbled down from 74% to 68%. However, Nationwide received an extra star in navigation and logging out, otherwise both have four stars in all other categories. 

7. Virgin Money

In Which?’s report about online mobile banking apps from February, Virgin Money was rated the poorest of all banks for customer safety, scoring 54% and just two stars for encryption. Significant improvements have been made to the app, which has resulted in a 67% rating and five stars for login procedures. 

8. Lloyds Bank

Next on the list is Lloyds, with a 63% aggregate score and three stars for login methods. It received four stars for security best practices, account management, and navigation and logging out. 

Unlike online banking, Lloyds Bank enforces slightly stricter security for its mobile banking app. Customers must use a trusted device with secondary authentication, and choose between one to five minutes, after which they will be logged out. 

9. Monzo

While Monzo ranks as the best UK bank for current accounts, the ratings don’t cross over for how safe its banking app is. Monzo’s ratings have dipped from 65% in February to 60% now, pushing it to the third-lowest ranking for online security. It received mixed reviews after earning only two stars for navigation and logging out methods, while achieving five out of five for login authentication methods. 

10.  The Co-operative Bank

Similar to the Co-operative Bank’s online banking website, its mobile app also failed several security checks, such as letting customers set up weak passwords or logging in through different IP addresses at the same time. Other issues included phone numbers being visible in alerts and security codes sent on SMS. This plunged the bank to second-last, with a score of 57%. 

11. TSB

TSB received the worst rating of 54% for mobile app security. The most serious issue flagged by Which? was that it didn’t store users’ sensitive credentials safely and securely. It meant that other apps could read this data if they were running on the user’s phone. TSB told Which? that the matter was under review and that a fix would be considered in the future.

There were also encryption issues, weak support for devices that run on Android 8.0 or less, only six character requirements for passwords and no way for users to ‘distrust’ the TSB app after clicking on ‘trust’ once. SMS texts also included the users’ phone numbers, which scammers could take advantage of. TSB told Which? that they had removed phone numbers from most of the SMS alerts.  

How to protect yourself from online banking scams

Fraudsters are getting more sophisticated and are finding new ways to trick people out of their money. Scams related to pensions, holidays, investments, crypto and fake dating websites are becoming all too common, especially on platforms such as Amazon, Facebook and WhatsApp. Here’s how you can remain vigilant.

Secure your mobile phone: In case your phone gets stolen, you should make sure that scammers can’t easily access your money. Do this by having a long, unique passcode and a fingerprint scan. Set your device to auto-lock after a few minutes and register for Find My Device on Google or Apple.  

Choose strong passwords: It’s best to choose strong, unique passwords that are not easy to guess. Try using a combination of lowercase and uppercase letters, numbers and symbols, and don’t repeat it for any other accounts. 

Secure your social media accounts: Adjust your privacy settings on your social media accounts. You can do this by limiting the personal data you share online, such as your email, date of birth and mobile number. Enable two-factor authentication and choose a strong password that is different from what you use on each account you have.

Be alert: In case any suspicious activity occurs on your bank account, like a payment or log-in from a device that you don’t recognise, immediately report it to your bank. Banks usually allow you to freeze your debit card online so that fraudsters can’t scam you.