Phone theft spate exposes weak bank login reset checks

A wave of phone thefts in early 2023, many of them involving gym lockers being raided, prompted the consumer body Which? to examine how easily thieves could take over a stolen handset's banking app, it reported on 13 February 2025¹. Which? said it found holes in some banks' defences, with a few requiring only basic information to reset app login details¹.

Which? said Halifax and MBNA asked only for credit card details and a security passcode sent by SMS to the same phone¹. It described this as too weak, while noting that SMS is slowly being phased out across the industry¹. By contrast, it said Chase, Monzo and Starling ask for photo ID or a selfie video before login details can be reset or the app registered on a new device¹.

The wider fraud picture has shifted towards apps. Which? reported that mobile banking fraud overtook internet banking fraud for the first time in 2023 and continued to rise in the first half of 2024¹. It said almost as many people now use banking apps (60%) as online banking (62%), according to UK Finance¹. Card fraud losses, by contrast, were the lowest reported for nine years in 2023 at £361m, which Which? attributed to more stringent verification processes when shopping online¹. Card ID theft, where stolen cards or details are used to take over an existing account or open a new one, reached its highest ever recorded levels of cases and losses in the year before publication¹.

Which? also set out where banks stand on other security features:

On connected devices, Lloyds Banking Group told Which? that all devices are automatically distrusted after 30 days of inactivity, so customers do not need to be notified of new devices¹. The Co-operative Bank and Santander said the feature is in the works¹. Which? added that it was disappointed that Lloyds Banking Group and Nationwide are yet to adopt Sim-swap detection, as both still use SMS-based identity checks¹. It said Santander is the only current account provider it surveyed that uses neither transaction monitoring nor behavioural biometrics, nor geolocation data, to spot unusual activity¹.

Why it matters for households

A stolen phone is not only a lost handset. If a thief can watch a PIN being entered, or reuse a password that has been used elsewhere, they may be able to pass the checks that stand between them and the account¹. Where a bank resets login details on the strength of a passcode texted to the same phone, the handset itself becomes the key to the account¹. Sim-swap fraud, in which a mobile network is tricked into moving a number to a criminal's SIM, allows calls and texts to be redirected so that security codes can be intercepted¹.

The practical effect differs by provider. Customers of banks that require photo ID or a selfie video face more steps to move an app to a new device, while those at banks named as relying on SMS face fewer¹. Push notifications, which let a customer flag a payment they do not recognise, are offered by most banks but not the Co-operative Bank, Nationwide, Santander or TSB¹. The ability to freeze a card in an app is also not universal¹. Which? noted that mobile banking fraud rose even as overall card losses fell to £361m in 2023¹.

What happens next

The Co-operative Bank and Santander told Which? that the connected-devices feature is in the works¹. Which? said SMS is slowly being phased out across the industry, without giving a date¹. No timetable has been reported for the other features it examined.

Consumers can read more on mobile banking apps and online banking, on scams and fraud, and on current accounts. The Confirmation of Payee name-checking service, and what to do when Confirmation of Payee shows no match, are also covered.