Before you start: the 10-second setup
Most "slow logins" are actually "hunting for things" time. Have these three within reach before you click anything:
- Your User ID — the business-issued one, not your email and not your account number.
- Your password — from memory or your password manager; know whether Caps Lock is a risk on this keyboard.
- Your token — the physical token in your hand, or your phone with the NAB Connect app ready to open. Chasing a token mid-login while a code timer runs is the classic way a one-minute job becomes five.
The 60-second checklist
- Open the login (0:00)
Official button above, your own bookmark, or type nabconnect.nab.com.au. Never a link from a message.
- Verify the domain (0:10)
End of the address: nab.com.au, padlock showing. One glance — but a real one.
- User ID in (0:20)
Type it, eyeball it, especially any digits and lookalike letters.
- Password in (0:30)
Once, carefully. If it fails, the checklist below tells you what to do — don't burn attempts guessing.
- Token code in (0:45)
Generate it now, not earlier, and submit immediately. Fresh codes are the whole game.
- Confirm the landing (0:55)
You should see your business's accounts. If the workspace looks wrong, stop and sign out.
Checklist broken? Error decoder
| What happened | Most likely meaning | Your next move |
|---|---|---|
| Invalid User ID or password | One of the two fields is wrong — or you're on the personal banking login | Check you're on the NAB Connect page; re-enter once, slowly |
| Token code not accepted | Code expired, or was generated too early in the routine | Generate a new code at the final step and submit straight away |
| Session timed out | The page sat idle — common if you fetched your token mid-login | Start again with everything in hand this time |
| Access locked | Too many wrong attempts have stacked up | Stop. Administrator or bank help is now the fastest route — see the access help page |
| Page looks unfamiliar | An address that isn't the bank's — or a bad link | Close it, re-enter via the official button, and run the domain check again |
Make tomorrow's login 30 seconds
If you do this daily, invest three minutes once: bookmark the verified login page and name it clearly; store your User ID in your password manager alongside the password so both fill exactly; and keep your token or token-phone in a fixed place near your desk. People who do this stop searching "login nab connect" altogether — which is, quietly, the goal of this page. For the fuller explanation of each step (and the first-time login differences), the homepage guide has the long version. And if your searches come out in the other word order — "nab login connect" — that page takes the scenic route through the NAB homepage instead.
Why the checklist runs in this order (and not another)
The sequence is deliberate, and knowing the reasoning helps you adapt it without breaking it. Domain before details, because everything after that point involves giving information away — the check has to come first, while backing out is still free. User ID before password, because the User ID is visible on screen and can be proofread, while the password can't; you want your one fully-checkable field verified before you spend the uncheckable one. Token last, because token codes are perishable — every second spent on earlier steps is a second off the code's life, so generating it at the end maximises your window to submit.
Notice what the order protects you from: the two classic failure cascades. In the first, a user generates a token code early, fumbles the password twice while the code ticks down, and ends up locked in an argument with an expired code. In the second, a user speed-types credentials into the first page that loads, then does the domain check afterwards — when the information is already gone if the page was wrong. Both cascades are order problems, not knowledge problems. Which is good news: order is the easiest thing in the world to fix, and it's fixed the moment you adopt the checklist as written rather than as a rough guide.
One adaptation is allowed: if your token lives in the app on the same phone you're reading this on, open the app before step one so it's warm and signed in when you reach the final step. That's preparation, not reordering — the code itself still gets generated last.
For people in a hurry
What's the single fastest safe way in?
A bookmark you created from the genuine page, clicked with your token already in hand, followed by the one-glance domain check. That's the 60-second routine at its smoothest — everything else is a variation with extra typing.
Why does the token code keep expiring on me?
Because it's generated too early. Codes live briefly by design. Move code generation to the very last step, after your password is in, and submit immediately.
Can I skip the token with a "remember me" option?
Business banking doesn't offer the kind of casual remember-me that shopping sites do, and you wouldn't want it to — the token is what stands between a stolen password and your business's money. The speed fixes above are the safe way to go faster.
Is searching "login nab connect" itself a security risk?
Searching is fine; clicking carelessly is the risk. Search results can include ads and lookalike sites. Whichever result you use, the domain check decides: nab.com.au or close the tab.