Which? tested the customer-facing security systems of 13 current account providers from September to November 2022. The banks were scored across four key categories - login, navigation and logout, account management and encryption - for both their online banking security and app security.

Among other issues, banks were marked down for not adequately blocking weak passwords, sending one-time passcodes or other sensitive information via text messages, and failing to log customers out after five minutes of inactivity.

They also lost points for allowing access to accounts from multiple web browsers or IP addresses at the same time, without flagging this as a potential cyber attack, and for sending customers notifications that include a phone number or web link. The latter can be a gift to scammers who often replicate texts and emails to trick people into calling them or entering their details on a fake website.

The research comes after 29,102 cases of remote banking fraud were reported to industry body UK Finance in the first half of 2022. This involves unscrupulous scammers gaining access to consumers’ bank accounts via their internet, telephone or mobile banking and making an unauthorised transfer of money from the account.

Virgin Money got the lowest total scores for online (52%) and app (54%) banking. Virgin Money’s poorest scores for online banking were in the navigation and logout and account management categories - it got two stars out of five for both. It also scored just two stars for the encryption on its app.

Red Maple Technologies found six outdated Virgin Money web applications which had potential vulnerabilities. The bank noted minor vulnerabilities on three and said these will be corrected. Virgin Money did not adequately block insecure passwords and remove phone numbers from notifications. Worryingly, there were no security checks to pay someone new, change an email address or edit the details of a payee. Which? also found issues with website session management, though the bank said it plans to improve this in early 2023, following Which?’s tests.

Which? had several concerns when it came to TSB, which scored 57% for its app, the second lowest, but got a slightly higher score of 66% for its online offering. It still asks basic security questions such as ‘name your favourite food’ to recover login details. It also failed to block insecure passwords and only requires six characters. Red Maple Technologies found a potentially vulnerable subdomain, which TSB said will be removed in 2023, and two outdated web applications.

TSB also lost points for using SMS-based security, not sending alerts when sensitive account changes were made and including phone numbers in new-payee notifications. TSB said it is reviewing alerts and password complexity as part of its digital strategy. The bank told Which? that it has now removed phone numbers from all SMS alerts, except for one which is due to be removed in February.

Starling came out top for online banking security (82%), although its high-scoring app (80%) is also key to security - it is used to authorise online logins and instant alerts of any sensitive activity. Starling scored five stars in almost every category.

Which?’s top scorer for online banking security last year, HSBC, performed well once again this year - it followed closely behind Starling with a score of 80% for online banking while its app had the highest score of 82%.

While Which? found fewer issues with Nationwide’s app security (67%), it had the second lowest score for online banking security at 63%. Which? thinks it should notify users of sensitive changes to contact details, password changes and new payees - although Nationwide said it is looking to offer this in the future.

The banks included in the research also have behind-the-scenes systems that Which? and Red Maple Technologies were not able to test.

Sam Richardson, Which? Money deputy editor, comments: “Banks should not be leaving these open doors for scammers to exploit and must up their game to protect their customers properly.

“By making improvements, such as blocking weak passwords, banks can take an important step in preventing unscrupulous fraudsters from attempting to steal money and personal data from consumers.”