Nobody self-registers for NAB Connect — your access is created for you
The first thing to understand about a first-time login is that there is no public sign-up form. Unlike personal banking, where you register yourself, NAB Connect access begins inside your business. Someone with administrator rights on your organisation's NAB Connect facility creates your user profile: your name, the accounts you are allowed to see, whether you can prepare payments, authorise them, or both, and the limits that apply to you. Only after that profile exists do you receive a way in.
This design is deliberate. Business banking moves real money on the strength of these logins, so the bank insists that a known, accountable person inside the business vouches for each user and sets their boundaries before they ever touch the system. If you have been told to "just log in and set yourself up" but nobody has created a profile for you, that missing step — not anything you are doing wrong — is why the login fails. Go back to whoever manages your company's banking access and ask them to create your user first.
Depending on how your business arranged things, the administrator might be your finance manager, your bookkeeper, an external accountant, or the business owner personally. In very small businesses the owner often set everything up with the bank directly and wears the administrator hat themselves. Whoever it is, you will deal with them repeatedly across your NAB Connect life — for password resets, limit changes and access changes — so it is worth knowing exactly who holds the role from day one. Our User ID guide explains the administrator's record-keeping duties in more detail.
The first-login journey. Stages 4 and 5 are the ones people rush — and the ones that matter most later.
Your temporary credentials: what they are and how to treat them
When your profile is created, you receive starting credentials — typically a User ID (which is permanent) and a temporary password or activation arrangement (which is not). They may reach you through your administrator, through an official letter, or through a secure message from the bank, depending on how your business set things up. Two facts about them shape everything that follows.
They are a bridge, not a home. Temporary credentials exist to get you through the door once so you can set your own. The system will require you to replace the temporary password with a personal one during or immediately after the first sign-in. Until you do, your setup is unfinished — and in some configurations your access stays limited. Treat the first login as a single job to complete in one sitting rather than a door to peek through and finish "later"; later has a way of becoming a payroll morning.
They are sensitive until they are spent. Anyone holding your User ID and temporary password before your first login effectively holds your future access. So: do not forward the message containing them, do not photograph them into a shared album, and do not leave a printed copy on your desk. If the temporary details were shared more widely than they should have been — sent to a group inbox, say — tell your administrator before you log in, so the starting password can be reissued. After your first login and password change, the temporary value stops mattering, which is exactly the point of changing it promptly.
One more practical point: temporary arrangements often come with a use-by window. If you sit on your welcome details for weeks, do not be surprised if the first login stalls and your administrator has to refresh the setup. If that has already happened to you, it is a five-minute conversation with your admin, not a catastrophe — and it is one of the most common first-login stories there is.
Your first login, step by step
Do these in order, at a desk, with the temporary details in front of you and your token (or phone) in reach. Allow fifteen unhurried minutes even though it will probably take five.
- Confirm who created your access and what you should be able to do
Before logging in, know what your profile is meant to include: which accounts, whether you prepare or authorise payments, and your limits. You will need this in step seven to check the setup actually matches.
- Go to the official address yourself
Type nabconnect.nab.com.au into your browser's address bar. First login, same rule as every login: never arrive via a link someone sent you, however official it looks. Verify the domain ends in nab.com.au and the padlock is showing.
- Enter your issued User ID and the temporary password
Exactly as provided, watching case and lookalike characters. Temporary passwords are machine-generated and unforgiving of creative interpretation — if you copy and paste, make sure no leading or trailing space sneaks in.
- Complete any token step you are prompted for
Depending on your business's setup, you may register a token as part of this first session, or use a code provided through your administrator's arrangement. Follow the on-screen sequence rather than improvising; the registration order matters.
- Set your own password when required
This is the heart of the first login and the next section is devoted to it. Do not reuse your temporary password, your personal banking password, or anything you use elsewhere.
- Register or confirm your token
If you will use the mobile token, this is when you link it — our mobile token guide covers that activation in detail. If you were issued a physical token, confirm it is recorded against your profile and keep it somewhere you control.
- Tour your workspace and check it matches your role
Look at the accounts visible, your name as it appears, and the functions available to you. If you were meant to authorise payments and no authorisation functions appear — or you can see accounts that are none of your business — raise it with your administrator now, while the setup is fresh.
- Sign out properly
Use the sign-out control, wait for the login screen, and close the tab. Your first session is also your first habit; make it the right one. Our complete login guide explains why the sign-out button matters more than closing the browser.
Setting your own password: the decision you will live with daily
You will type this password on most working days, possibly for years, so the first-login password choice deserves more than the first word that comes to mind. The system will enforce its own rules — expect requirements around length, a mix of characters, and rejection of obvious choices — but rules alone do not make a password strong. Craft does.
Use a passphrase, not a puzzle. A string of several unrelated words with some digits and a symbol woven in is both stronger than a short "clever" password and far easier to type accurately at 8am. Length does most of the protective work in modern password security; a long, memorable phrase beats a short, forgettable tangle every time, and you will get it wrong less often — which matters, because repeated wrong entries are how lockouts happen.
Make it unique to NAB Connect. The one rule with no exceptions: this password must not be your personal banking password, your email password, or anything reused from another service. When other sites leak password databases — and they do, constantly — reused passwords are tried against banking logins automatically. A unique passphrase means a leak anywhere else is a nuisance, not an emergency at your business's bank.
Store it like you mean it. A reputable password manager is the right home for it; it will also fill it accurately, sparing you the lookalike-character failures. If your business does not use one, a sealed envelope in a genuinely secure place is a distant second best. A sticky note, a notebook in the top drawer, or a spreadsheet called "passwords" are not storage — they are invitations. And never share the password with colleagues "just for today": your login is your signature in the audit trail, and everything done with it is attributed to you. If someone needs access, they need their own profile.
Length and uniqueness do the heavy lifting. A long passphrase used only here is the target.
Finally, write down — in your password manager's notes or your own secure records — the date you set the password and who your administrator is. Six months from now, when something needs resetting, those two facts will save you a surprising amount of archaeology. And if that day comes, our password reset guide covers the whole process.
Registering a token during setup: physical, mobile, or both decisions
Your token is the second half of your login security — the thing that proves the person with your password also has your token. During first-time setup you will either be issued a physical token (a small device that displays codes), or be set up with the mobile token inside the NAB Connect app, depending on your business's arrangements. Some users encounter the token for the first time not at login but at their first sensitive action; either way, get it properly registered now rather than discovering a gap later.
Physical token. If a device was handed to you, check that it is actually yours — tokens are registered to individual users, and a drawer full of lookalike tokens is an accident waiting to happen. Label yours discreetly if your workplace allows it, store it where you alone control it, and never lend it. A code from someone else's token will not work for your login, and your code "helping out" a colleague defeats the control entirely.
Mobile token. If your setup uses the app, activation links the token to your phone and your profile. Do it on your own phone, follow the in-app sequence, and test it with a login straight away while the setup screens are fresh in your mind. The full activation and day-to-day use — including what to do when you replace your phone — is covered in our mobile token guide, and signing in with the app itself is covered in the app login guide.
The test that matters. Whichever token you have, finish setup with a clean test: sign out fully, then sign in again from scratch using your new password and your token. Two minutes spent proving the whole chain works — User ID, new password, token — beats discovering a broken link on the day a payment is due.
Your first payment approval: how the two-person rule feels in practice
If your role includes authorising payments, your first approval is the moment the platform's core design stops being theory. NAB Connect separates preparing a payment from releasing it: one person builds it, and — where your business's rules require it — a different person, or the same person with a token-confirmed second step, authorises it. New authorisers are often surprised by how deliberate the sequence feels. That deliberateness is the product.
What you are actually doing when you authorise. You are attaching your identity, via your login and token, to a specific instruction: this amount, to this account, on this date. The audit trail will show your name against it permanently. So the correct first-approval routine is unglamorous: open the payment, check the payee name against the source document (the invoice, the payroll report), check the account details digit by digit for new payees, check the amount and the value date, and only then confirm with your token code. The most expensive business banking errors are not sophisticated fraud; they are approvals given at speed to payments that were wrong in one field.
Limits are real. Your administrator set an authorisation limit on your profile. A payment above it will not go through on your approval alone — it may need a second authoriser or a higher-limit colleague. This is not a malfunction; it is the control working. If your limit does not match what your job actually requires, that is a conversation with your administrator armed with specifics, not a workaround to hunt for.
Never approve your own homework blind. If you both prepared and are asked to authorise the same payment, treat the approval as a fresh review, not a formality: re-read the fields from the source document rather than from your memory of entering them. Businesses configure the prepare/authorise split precisely because the person who typed a number is the worst person to spot their own slip in it.
Prepare, check, authorise: two people and a token stand between an idea and money leaving the account.
The five mistakes almost every new user makes (and how to skip them)
1. Trying to log in before a profile exists. Covered above, but it remains the champion: if nobody created you, no combination of details will work. Confirm creation first.
2. Using personal banking details. New starters who already bank personally with NAB reflexively reach for those credentials. Different service, different door, different key — and the failed attempts count. Keep the two logins mentally in separate rooms from day one.
3. Skipping the token setup. "I'll do it later" meets its reckoning at the first payment that demands a token code. Register it during the first session, test it, and only then call the setup finished. Our mobile token guide exists because of how many people meet this wall mid-task.
4. Rushing the password. A password set in a hurry is a password forgotten by Friday or reused from somewhere else by design. Take the extra minute; you will type it thousands of times.
5. Not checking your access matches your job. Missing functions and wrong limits surface eventually — usually at the worst moment. The step-seven tour of your workspace is not a formality; it is quality control on work your administrator did quickly and will happily fix now.
One theme runs through all five: the first login rewards ten unhurried minutes and punishes two rushed ones. Every later login is standing on what you build in this session — your password, your token, your bookmark, your understanding of your own access. Build it properly and the daily routine in our complete login guide becomes exactly that: routine.
Your first week: five small jobs that future-you will thank you for
The first login gets you in; the first week determines how calm the next year feels. These five small jobs, done while everything is fresh, prevent most of the problems our other guides exist to fix.
1. Complete your password manager entry. User ID, password, the official address, and a note of who your administrator is — all in one entry. This single record is the antidote to both the forgotten-password reset and the lost User ID hunt.
2. Make the bookmark properly. From the genuine signed-in address or the login page you reached by typing it, not from a search result. Name it plainly — "NAB Connect login" — so future-you trusts it at a glance.
3. Learn where approvals wait. If you authorise anything, find the queue now, in a quiet moment, rather than during your first urgent call. If you prepare payments, learn how your business wants them named and referenced; your future approver is reading those fields.
4. Meet your escalation path. Know, by name, who resets passwords, who changes limits, and what number the business calls at the bank. Write them in the same password manager note. Escalations are not the time to discover the org chart.
5. Do one deliberate practice run. Sign in, look at a statement, find a transaction, sign out properly. Ten unhurried minutes of low-stakes familiarity buys you fluency for the day the stakes are a payroll deadline — and it confirms, while it is cheap to fix, that your access really does match your job.
Related guides
First-time login questions
I was told to log in to NAB Connect, but nothing I enter works. What is missing?
Most likely, your user profile has not been created yet. NAB Connect has no self-registration: an administrator inside your business must create your access first and provide your User ID and temporary credentials. Until that exists, no details you type can succeed.
Do I have to change the temporary password straight away?
Yes — expect the system to require it during or immediately after your first sign-in. The temporary password is a bridge to your own password, not a password to keep. Set a long, unique passphrase at that moment; you will use it daily.
My temporary credentials are weeks old and the first login will not proceed. What happened?
Temporary arrangements can lapse if they are not used promptly. This is common and fixable: your administrator can refresh the setup and reissue your starting details. Contact them, confirm your profile still exists, and do the first login the same day the new details arrive.
Should I set up the mobile token or use a physical token?
That depends on your business's arrangements — some issue physical tokens, others use the token inside the NAB Connect app. Either is a valid second factor. If you have the choice, the mobile token means one less object to carry and lose; the physical token does not depend on your phone's battery or survival. Our mobile token guide compares them in detail.
I approved a payment and now I am worried I did it wrong. What can I do?
Act immediately: tell your administrator and, if the payment has not yet been processed, contact the bank through official channels to ask about stopping or recalling it. Authorisations are recorded against your identity, and fast, honest escalation is always the best outcome — far better than hoping nobody notices.
Can I do my first login from home or does it need to be at work?
Where you are matters less than what you use: a computer you trust, your own network, and enough unhurried time to set your password and register your token properly. Avoid shared or public machines entirely for a first login, because password changes and token registration are sensitive setup steps.