• App-based banking Trojans. Hidden inside unrelated apps, these pieces of malware “wake up” when you open your banking app and mimic its login screen to steal your credentials.
• Fake banking apps. Designed to look like real ones, they trick users into entering login info that’s sent straight to criminals.

Only download apps using the links from your bank’s official website — never from social media ads or third-party app stores.

• Download verified apps only. Start at your bank’s website and follow its link to the App Store or Google Play. Confirm the developer name and read reviews before downloading. Never download banking apps from open forums or third-party websites.
• Turn on multi-factor authentication. Two-step verification adds another wall between your account and hackers. It requires you to prove your identity with at least two pieces of information — typically a password plus a confirmation code sent to your phone.

Even if your password is stolen, your phone verification code keeps thieves out.

• Use strong, unique passwords. Mix upper- and lowercase letters, numbers and symbols — and never reuse passwords across accounts. Do not save your passwords in your browser — instead, use a reputable password manager.
• Avoid public Wi-Fi. Free networks are easy for hackers to monitor. When in doubt, use your mobile data or a trusted home network.
• Spot phishing and “smishing.” Phishing emails often look legitimate, as if they are really from your bank. But they are designed to trick you into revealing personal information or downloading malware. Smishing uses the same tactics via text messages.
• Set up account alerts. A quick notification from your bank about transactions on your account can help you detect potential fraudulent activity. Most banks offer customizable alerts via email, text or their app.

Time matters with fraud — the faster you catch it, the better protected you are under Regulation E, which limits your liability if you report unauthorized transactions within two business days.

Banks and credit unions spend billions each year defending against cyber threats — and they’re financially on the hook for most unauthorized transactions.

Under Regulation E, your liability for electronic fraud is limited to $50 if reported within two business days, and up to $500 afterward. Anything beyond that is covered by your financial institution.

Most banks also carry FDIC insurance, protecting up to $250,000 per depositor, per account category.

While your bank invests in cybersecurity, your job is to keep your access points secure — starting with your phone.

Mobile banking is safe — when you stay proactive. Choose banks that use strong encryption, keep your app updated and turn on all available security features.