Logging in with the NAB Connect app, from install to everyday

What the NAB Connect app is for — and what it is not

The NAB Connect app is the mobile companion to the full desktop service. It is designed around the tasks people do away from a desk: checking balances before a meeting, authorising a payment someone in the office has prepared, and generating token codes. For approvers in particular it changes the rhythm of a business day — the "can you log in and release this?" phone call becomes a notification, a review and a tap.

It is not a smaller clone of everything the desktop does. Heavy administration — creating users, restructuring permissions, large file-based work, deep reporting — belongs on the desktop service, and some tasks will direct you there. Nor is the app the same thing as the bank's personal banking app: separate service, separate login, separate purpose. If you hold both a personal account and a business role, you will likely have both apps on your phone, and picking the wrong one at sign-in is a rite of passage everyone completes exactly once.

One more framing fact, because it explains most app behaviour you will meet: the app treats your phone as a registered device, not just a screen. Setup binds the app to you personally, which is why registration has extra steps, why a new phone means re-registering rather than just installing, and why losing the phone is a security event. Our mobile token guide covers that device-as-key idea in depth, and our complete login guide covers the desktop side of the same system.

Setting up the app safely, step by step

1. Confirm your access exists and your role is app-appropriate

   The app signs you into the same profile as the desktop. If you have never completed a first login, do that groundwork first — our first-time login guide walks the sequence — and check with your administrator that app access fits your business's arrangements.

2. Install from the official store, and verify the publisher

   Open your phone's own app store (Apple's App Store or Google Play), search for the NAB Connect app, and check the listed publisher is the bank before installing. Be wary of lookalike names and of any "download" link that arrived by message or email. Counterfeit banking apps are built to be found by the hurried.

3. Lock your phone first, if it is not already

   A banking app on an unlocked phone is a contradiction. Set a strong phone PIN or biometric lock and a short auto-lock time before you register anything. This is not housekeeping; the phone is about to become a banking key.

4. Open the app and register with your NAB Connect credentials

   Sign in with the same User ID and password you use on the desktop. Registration may involve extra verification steps — a code from an existing token, or checks arranged through your administrator — because the app is establishing that this device belongs to this person. Complete the sequence in one sitting; abandoned half-registrations are a reliable source of later errors.

5. Enable the mobile token if offered

   If your setup uses the app as your token, activate that feature now and test a generated code against the desktop login. The dedicated mobile token guide has the full activation and testing routine.

6. Turn on biometrics deliberately (see next section)

   If your phone and your business's policies allow it, enable fingerprint or face unlock for the app — understanding first what it actually replaces. Then do a complete test sign-in, a balance check, and, if you are an approver, find where approvals live before you need one urgently.

Everyday app login, and what biometrics really do

Once registered, the daily app sign-in is deliberately light: open the app, authenticate, and you are looking at your business's position. Depending on your setup, authentication after the first full sign-in is commonly your phone's biometrics or an app PIN, with the full User ID and password required again at intervals or after significant changes — new phone, long absence, security events. That rhythm is a design decision: the heavy proof happens at registration and periodically; the daily proof leans on the registered device plus your biometric or PIN.

What biometrics actually are. Your fingerprint or face unlock is a key the phone keeps: the app asks the phone "is this the enrolled person?", and the phone answers yes or no. Your biometric data does not travel to the bank, and the app never sees your fingerprint — it sees the phone's verdict. This is genuinely good security when the enrolment is genuinely yours. Which produces the one rule that matters: only your own face and fingers should be enrolled on a phone used for business banking. A partner's convenience fingerprint, a child's face enrolled for unlocking games — each becomes, in effect, a person who can open your banking app. Audit your phone's biometric enrolments today if you have never done it; surprises are common.

What biometrics do not replace. They do not replace your User ID and password as the underlying credentials, your token for step-up approvals where required, or your judgement at the approval screen. A biometric opens the door quickly; it does not check the payment for you. The approver's discipline from our other guides — read the payee, the amount, the date, then confirm — applies at exactly the same weight on a phone screen as at a desk.

Biometrics are the phone vouching for you — which is why only your own should be enrolled on it.

App vs browser: choosing the right door for the job

Neither door is the "real" one. Your role each day decides which you walk through.

The practical pattern most businesses settle into: preparers live on the desktop, approvers live on the app, and everyone meets in the same audited queue of payments. If you find yourself doing fiddly preparation on a phone because the desktop feels intimidating, that is worth fixing at the root — our complete login guide is written to make the desktop routine feel ordinary.

Common app errors and their fixes

App problems feel personal — the phone is in your hand and a payment is waiting — but the catalogue of causes is short. Work through these before assuming the worst.

"Session expired" the moment you open the app. Usually just the app's own idle timeout doing its job, especially if the app sat open in the background. Authenticate again and continue. If it happens instantly and repeatedly, fully close the app and reopen it; a background process has likely lost its place.

The app says the device is not recognised or needs registration. Something broke the device binding: a phone change, a major operating system change, the app being deleted and reinstalled, or registration having been revoked. The fix is re-registration — sign in with your full credentials and complete the setup sequence again, with your administrator's help if your business's arrangement requires it. Treat unexpected deregistration seriously once: if you did nothing to cause it, tell your administrator, because registrations are also revoked when businesses respond to security concerns.

Biometrics suddenly not offered. Typically follows a phone update, a biometric enrolment change on the phone (a new fingerprint added, face data reset), or the app sensibly demanding full credentials after a security-relevant change. Sign in with your User ID and password, then re-enable biometrics in the app's settings if you wish. And take the hint the system is giving you: enrolment changes are exactly when a fresh full login should be required.

"App needs updating" or features missing. Banking apps enforce minimum versions for security reasons. Update from the official store — never from a link — and reopen. If your phone's operating system is too old for the current app, that phone has reached the end of its banking life; continuing on an unsupported system is a risk your business should not accept.

Token codes from the app rejected at the desktop. That is the mobile token troubleshooting list: stale code, phone clock not on automatic time, outdated app, or a registration needing refresh. Our mobile token guide works through it in order — and remember failed attempts are finite, so do not brute-force the diagnosis.

The app will not load anything despite good signal. Distinguish your phone from the service: try the desktop login, check whether colleagues see the same problem, and allow for a maintenance window or an outage. If the bank's service is down, no amount of reinstalling helps, and the correct action is patience plus official status channels. If only your phone fails, restart it, check for updates, and only as a last resort reinstall — knowing a reinstall means re-registration.

Update, restart, verify the basics, then escalate in steps — in that order, almost every time.

Second phones, tablets and time zones

One registration, one phone. Your app access and mobile token are bound to a single device at a time for good reason: the registration is the proof. If you change phones, re-register properly (the mobile token guide gives the full lost-and-replacement procedure). Tablets can be tempting as a "bigger app screen", but unless your business's arrangement explicitly supports registering one, treat the phone as the app device and the desktop as the big screen — that division covers every task comfortably.

Travelling. The app works overseas, but three things change. First, your phone's clock must stay on automatic: time zone shifts handled manually can desynchronise token codes. Second, roaming data hiccups can look like app failures; a hotel Wi-Fi captive portal that you have not signed into is the classic culprit. Third, if your phone is lost or stolen while travelling, the procedure is the same as at home but the urgency doubles — administrator first, remote lock and erase second, replacement registration when you are home or properly set up. Tell your administrator before international trips if you are a key approver, so a mid-trip device drama has a pre-agreed understudy rather than an improvisation.

Notifications. Approval notifications are the app's quiet superpower, and also a privacy consideration: a lock-screen notification announces business banking activity to anyone holding your phone. Set notifications to hide content on the lock screen if your phone passes through other hands, and never let notification convenience talk you into approving from the lock screen without opening the payment and reading it properly.

Family phones and borrowed devices. A common real-world pattern deserves a direct answer: the app belongs on a phone you alone control. Not the household tablet the kids use for homework, not a partner's handset "just while mine charges", and never a device borrowed for a trip. Each of those arrangements puts a registered banking device in hands that have no business holding one, and some of them — a child approving a notification out of curiosity — stop being hypothetical the moment they happen. If your only phone truly dies and business cannot wait, the sanctioned route is your administrator plus an interim arrangement, not an improvised install. Businesses forgive a delayed payment explained properly far more readily than a control quietly bypassed.

Keeping the app healthy: updates, permissions and housekeeping

Updates are security, not cosmetics. Banking apps are updated for the reasons you would hope: closing vulnerabilities, keeping pace with the phone's operating system, and maintaining the token machinery. Running a months-old version invites the forced-update wall at the worst possible moment — mid-approval, on a deadline. Turn on automatic updates for the app, or make checking a weekly habit. The same applies to the phone's operating system, with one caveat: do major system updates at a desk, with time to spare, not in the ten minutes before a payment run, because a big update occasionally triggers app re-verification.

Permissions worth reviewing. The app needs remarkably little beyond its core function. Notifications you almost certainly want — approvals and security alerts lose their value silently if the app cannot reach you — but review anything else it requests with a banker's scepticism, and re-check after major updates, because permission prompts reappear in new clothes. On the lock screen, set notifications to hide sensitive content: an approval alert should summon you, not narrate your business's banking to whoever is holding your phone.

Storage and performance. A phone bursting at the seams behaves erratically, and banking apps suffer with everything else. If the app is slow or crashes on open, free space and restart before deeper surgery. Avoid the folk remedy of endlessly clearing the app's data or reinstalling for every hiccup: a reinstall usually means re-registration, which means your administrator, which means a small problem became an appointment. The error clinic's order — update, restart, check basics, then escalate — exists to protect you from that escalation ladder.

Accessibility is a login feature too. If you use your phone's accessibility tools — larger text, screen readers, voice control — the app has to work with them, and a login that fights your assistive technology is a defect, not a personal failing. Test your full routine after major app or system updates, when accessibility integrations most often shift, and raise breakage through your administrator and the bank's accessibility channels; institutions are obliged to keep their services usable, and specific reports get specific fixes. The same goes for the desktop: if the standard routine is hard to operate for any reason, say so early, because alternative arrangements are far easier to make before a deadline than during one.

The annual five-minute audit. Once a year, or whenever your role changes, spend five minutes on app hygiene: confirm the registered phone is still the one in your hand, review biometric enrolments (only yours), check the app is current, and confirm your administrator knows your setup. Businesses change around a banking app quietly; this tiny audit is how your access keeps matching your reality instead of drifting away from it.

Related guides