Managing your investment account online and keeping it secure

Most people now hold their investments through an online account: a log-in on a website or app that shows what you own, what it is worth, and lets you buy, sell and move money. With most banks, online banking lets you check your balance at any time of day or night, look at statements, transfer money between accounts, send money to people you know, and set up or cancel direct debits and standing orders¹. Investment platforms extend the same idea to shares, funds and pensions, and a self-invested personal pension (SIPP) is built around exactly this: it lets you hold multiple investments and products so you can manage your pension fund yourself².

The security side matters just as much as the convenience. The National Crime Agency advises always using two-step verification, where available, to protect your email account³, and one rule never changes: your bank will never ask you to disclose full security and password details⁴. This page explains what you can do online, how logging in works, how to keep your account safe, the warning signs of investment scams, and what to do when something goes wrong.

What an online investment account lets you do

An online investment account is the control panel for everything you hold with a provider. Depending on the provider and the account type, it typically covers viewing your holdings and their value, dealing (buying and selling), paying money in and withdrawing it, viewing statements and tax documents, and changing your personal details. The range of things you can do online mirrors what online banking offers: with most banks you can check your balance any time of day or night, check your bank statements, transfer money between your bank accounts, send money to people you know, and set up or cancel direct debits and standing orders¹. Investment platforms apply the same pattern to investments rather than everyday banking.

How much you can do yourself depends on the kind of account. A SIPP is designed for self-management: SIPPs allow you to hold multiple investments and products, so you can manage your pension fund yourself and have more control, though they are considered riskier than most personal pension schemes and were created to allow experienced investors the opportunity to take more risks². A general investment account, an ISA or a workplace pension each work differently, and where you hold your investments shapes what tax wrapper you use and what the platform lets you do. If you are new to platforms generally, how investment platforms work explains the model, and investment platform fees and charges covers what it costs.

Not every account can be managed online at all. NS&I's Investment Account is a postal-only account⁸, and NS&I states that once registered you can manage your accounts online except for the Investment Account, which can only be managed by post⁹. NS&I also states that its Investment Account cannot be managed online or by phone, and that you can only access your Investment Account online if you have another account with them⁶. If you hold an account like this, the online experience is limited to viewing, and instructions go by post.

Logging in and two-step verification

Logging in to a financial account is deliberately harder than logging in to an ordinary website. There are multiple steps to log in, including a text message access code from some banks, or Touch ID or Face ID using a fingerprint or face with the bank's app and a newer smartphone¹. The first time, you register online via your bank's website, entering personal details, answering identity verification questions, entering an activation code sent by post or text, and setting up a username and secure password or passcode¹.

The second step is the important one. Some websites let you add a second step when you log in, known as two-factor authentication, which makes it harder for scammers to access your accounts¹⁰. The National Crime Agency's advice is to always use two-step verification (2SV), where available, to protect your email account³. Your email account matters because it is often the route to resetting passwords on everything else, including investment accounts.

Two-step verification is not only about the log-in screen. Take Five's guidance on identity theft sets out a routine of checks around it: check your bank statements regularly for transactions you do not recognise, and check your privacy settings online and think about what personal or financial information you are sharing¹¹. The same guidance also suggests being wary of who has access to your mail¹¹, since paper statements and letters can carry enough information for someone to impersonate you.

Checking holdings, valuations and statements

The most-used feature of an online investment account is simply looking things up. NS&I, for example, states that you can also see the value of your investments on your homepage¹², and for its Fixed Interest Savings Certificates it says you can easily find out how much your Certificates are worth by logging in to your online account¹³. Investment platforms work the same way: the homepage or dashboard shows each holding, the number of units or shares, and a current valuation.

Valuations move with the market, so the figure you see is a snapshot rather than a promise. For funds, the price you deal at depends on when your order is processed, which how funds are priced and dealt explains in detail. Statements and tax documents are the paper trail: platforms issue periodic statements, consolidated tax certificates and other documents, covered in consolidated tax certificates, statements and other investment documents. Checking statements regularly is also a security habit, since transactions you do not recognise are one of the earliest signs that something is wrong¹¹.

Buying, selling and moving money online

Dealing online follows the same logic as any other instruction to a financial firm: you place the instruction, the firm carries it out, and the record appears in your account. When you buy or sell, the choices you make about how the order is handled matter: limit orders, stop losses and other order types control the price at which a deal goes through, and dealing charges for buying and selling investments are the direct cost of each transaction. Moving money in and out has its own mechanics: how to add money to an investment account and how long investment platform withdrawals take cover the two ends of the flow.

Before any payment is made online, common advice includes checking a website is secure, and checking bank statements for unusual transactions¹⁴. If you have been the victim of an online crime, the advice is to report this to the police¹⁴. When a payment goes wrong, the Payment Systems Regulator's route is to contact your financial provider, for example your bank, by phone, and you can also contact the Financial Ombudsman Service if you are still unhappy¹⁵.

Keeping your login details and devices secure

The basics are unglamorous but they carry most of the weight. Strong and unique passwords protect your online accounts¹⁶, and the same applies to passwords and passcodes on devices and digital wallets¹⁷. A password reused between an investment account and a shopping site is only as safe as the weakest place it is stored. Beyond passwords, the identity theft guidance applies directly: check your privacy settings online and think about what personal or financial information you are sharing, check your bank statements regularly for transactions you do not recognise, and be wary of who has access to your mail¹¹.

Losing access is a real risk as well as a security one. If you are storing cryptoassets on a password-protected personal hard drive or memory stick and you lose or forget the password, you may well have lost access to your investment altogether¹⁸. For conventional accounts, providers have recovery routes: NS&I publishes help on how to find accounts and investments with them if you have lost the details¹⁹. Some providers also monitor for suspicious activity: HMRC states that it monitors all HMRC accounts for suspicious sign in attempts and may ask you to change your password if it thinks there is a risk²⁰.

If you think someone else has accessed an account, the advised response is the same whatever the account: change the password straight away and contact the provider²¹. For government accounts the guidance is explicit: change your password straight away and contact Universal Credit if you think someone else has accessed your Universal Credit account²¹, and the same sequence, password first and provider second, applies to an investment account.

A genuine firm will not ask for your full password

This is the single most useful rule for telling a genuine contact from a fake one. Your bank will never ask you to disclose full security and password details, so alarm bells should ring⁴. The FSCS adds that it will never ask for bank details, account passwords, or PIN numbers⁵.

There is a nuance worth knowing. Banks will never ask for your full PIN or password; instead, they ask for specific numbers or letters, for example the first and third character¹. So a caller asking for "the second and fifth letters of your password" can be legitimate, while a caller, email or text asking for the whole password, a full code or your PIN is not. On legitimate calls, firms will never ask you to reveal personal information or full passwords²².

The same rule covers texts and emails. If an email says there is a problem with your account, log in directly through the website or contact the company another way to check whether the email is legitimate²². The route is the website typed in directly, not the link or phone number in the message itself.

Investment scams and cloned firms: the warning signs

Investment scams are built to look like the real thing. An investment opportunity may be a scam if you are contacted unexpectedly, promised high returns with little risk, pressured to act quickly, asked to keep the offer secret, or told to transfer money before you have had time to check the firm independently²³. Citizens Advice lists the same pattern from the consumer side: it might be a scam if you suspect you are not dealing with a real company, are asked to transfer money quickly, asked to pay in an unusual way, asked to give away personal information like passwords or PINs, or receive no written confirmation of what has been agreed¹⁰.

Cloned firms take the disguise further by copying the name, branding and website of a genuine, regulated firm. The Pensions Regulator's threat assessment notes that developments in this area increase vulnerability to specific threats, such as cloned firms and recovery fraud, where victims are targeted again with false promises of assistance in retrieving their lost funds²⁴. Recovery fraud is the second bite: after losing money once, a victim is contacted by someone claiming to be able to get it back, for a fee.

Common warning signs in the messages themselves include inaccurate spelling and wording, a sense of urgency to act quickly, asking for bank details or passwords and being told not to tell anyone, and an unfamiliar email address⁵. Digital wallet fraud adds another: emails about account changes you did not make¹⁷. Once scammers have your information, they can contact you and gain your trust, then convince you to make a payment or provide access to your accounts, set up accounts or take out loans in your name, or access your accounts directly to steal money¹⁶.

Checks available before sharing personal details or sending money include the Financial Conduct Authority's Firm Checker²³, and the details of the investment and whether the provider is genuine can be checked on the FCA's website through its ScamSmart service²⁵. Get Safe Online offers a 'Check a website' tool to check whether a website might be a scam¹⁶. The credentials of any company or legal professional you are unsure about can be checked: you can look them up on Companies House to find out their background or search for reviews online²⁶. If a trader claims membership of a scheme, check the scheme's own website to make sure they are really a member²⁷. The Pensions Regulator also expects governing bodies of pension schemes to provide clear information on how to spot a scam in all relevant communications to members, including retirement wake-up packs and annual benefit statements, and scam warnings may also be placed on the scheme's website²⁸.

IWeb and Scottish Widows share dealing and SIPP accounts: what has changed

If you hold a share dealing or SIPP account with IWeb or Scottish Widows, the guidance that applies to you now depends on when you opened it. Customers who opened a SIPP before 25 October 2024 with IWeb are directed to a separate page for managing their account²⁹. From October 2025, customers who opened a Share Dealing Account or Stocks and Shares ISA through IWeb or Scottish Widows are directed to a new page on managing their investments³⁰. In practice this means the support pages, and possibly the processes behind them, differ between older and newer accounts, so the page that covers a particular account depends on when it was opened.

The change sits against a backdrop of more active management of these accounts. Interactive Investor reported a 58% year-on-year increase in withdrawals from SIPP accounts in September 2024³¹, which points to more people moving money in and out of self-invested pensions rather than leaving them alone. The Pensions Regulator has also flagged a trend of increasing transfer requests to "international self-invested personal pensions (SIPPs)" which look to facilitate investment overseas but through a UK-registered SIPP²⁴. A transfer request of that kind deserves extra scrutiny, since moving a pension is exactly the action investment and pension scammers push for.

If you are managing money for someone else, the channels can differ again. NS&I states that you can manage any of its accounts on behalf of someone else online, by phone or by post, with post required if you have restricted authority, if joint action is required, or if the account is the Investment Account³². And if you are not registered for online access, or have an Investment Account, you need to complete a form and post it to change details such as a nominated account³³.

When an investment trust changes manager

Investment trusts are companies whose business is running a portfolio, and like any company they can change who manages it. Two recent examples show the pattern. Artemis has managed Artemis UK Future Leaders plc since 10 March 2025³⁴. Management of the Murray Income Trust passed to Artemis, with Andy Marsh, Nick Shenton and Adrian Frost as fund managers, from March 2026³⁵. In both cases the trust continued; who runs the portfolio changed.

As a shareholder, you usually do not need to do anything. The trust announces the change, and if you hold the trust through a platform, the platform passes on the announcement. Communications from the new manager about how the trust will be run are the main thing to read, since a change of manager can mean a change of approach. Fund managers: who runs the funds you buy and investment trusts explained cover the wider picture.

One rule applies where funds invest in funds managed by the same person: the product summary must disclose any actual or potential benefits to that person arising from the investment in the investee funds³⁶. And if you are an attorney or deputy investing for someone else, there is a boundary to respect: the rule is that no existing investments or funds are transferred into your own name³⁷. The investments stay in the name of the person you are acting for, and investing rules for attorneys and deputies covers the duties that follow.

Something went wrong: fraud, errors and complaints

The first step is always the provider. If you are not happy with how a firm deals with your claim, you can complain to them; find out how by checking their website³⁸. The Financial Ombudsman Service describes the sequence plainly: talk to the firm first, because they need to have the chance to put things right, then make a formal complaint, and after their final response contact the ombudsman if you are still unhappy³⁹. For payments specifically, the Payment Systems Regulator's route is to contact your financial provider by phone, and you can also contact the Financial Ombudsman Service if you are still unhappy¹⁵.

Which ombudsman depends on the subject. If your complaint is about the administration of a personal pension scheme, including self-invested pensions and group personal pensions, either the Financial Ombudsman Service or The Pensions Ombudsman could help you⁴⁰. For workplace pensions, you can complain to MoneyHelper or the Pensions Ombudsman about how your workplace pension is managed⁴¹. For investments, the Financial Ombudsman Service handles complaints about, for example, advice received or the way an adviser or investment company managed your ISA⁴². The volume gives a sense of scale: the ombudsman resolved 16,460 investments and pensions complaints in the year from April 2021⁴³, and recorded 4,093 investment complaints between 9 July 2023 and 8 July 2024⁷.

If the firm has failed, the route changes. The FSCS's guidance on pension transfer claims is to complain to the adviser first if they are still trading, then go to the Financial Ombudsman Service; the FSCS handles claims where the adviser has failed⁴⁴. What happens to your investments when a platform fails is covered in what happens if an investment platform or pension provider fails, and does FSCS cover poor investment performance? sets out where compensation stops.

Fraud and scams have their own reporting routes. Contact Report Fraud to report a scam, or get more advice on scams and fraud⁴⁵, and the ICO notes that complaints about fraud and scams are referred to Report Fraud⁴⁶. Online scam adverts can be reported to the Advertising Standards Authority using their website⁴⁵. If an organisation has not kept your information safe, you can make a complaint to the Information Commissioner's Office⁴⁷. Age UK's guidance on investment scams is a further source of help for spotting and acting on them⁴⁵.