The NAB Connect login, from start to finish

Before you start: the four things every login needs

Every NAB Connect sign-in, no matter who you are or what you plan to do inside, is built from the same four ingredients. Having all four ready before you begin is the difference between a forty-second login and a ten-minute scramble.

1. The address. NAB Connect lives at nabconnect.nab.com.au. That exact address — typed by you, or opened from a bookmark you created from it — is the safe starting point. Search results, email links and message links are all detours that can be imitated, and imitations of banking pages are a real and ongoing problem. If you have never made the bookmark, do it after your next successful login; our bookmark guide explains why this one habit matters so much.

2. Your User ID. This is the identifier created for you personally when your business's NAB Connect access was set up. It is not your email address, not your account number, and not the customer number you might use for personal banking. If you are not sure what yours is, our dedicated guide to the NAB Connect User ID explains where it comes from and how to recover it. Guessing at this field wastes the limited number of attempts you get before a lockout, so find it first if you are unsure.

3. Your password. The one you set for NAB Connect specifically — not your personal internet banking password, which belongs to a different service and will simply fail here. Passwords are case-sensitive, so be honest with yourself about whether you actually remember yours. If you do not, reset it before you start burning attempts; the password reset guide covers both the user and administrator paths.

4. Your token. A source of one-time codes: either the small physical token issued to you, or the mobile token inside the NAB Connect app on your phone. Know where it is and have it in reach before you begin, because codes are time-sensitive and the clock starts the moment one is generated. If your token lives in the app and you have never set that up, our mobile token guide walks through activation.

The whole sign-in is four stages. Every problem in this guide maps to one of them.

The desktop sign-in, step by step

These are the full steps, with the reasoning behind each one. If you have logged in a hundred times, skim it anyway — the checks in steps two and seven are the ones experienced users stop doing, and they are the two that catch fraud and mistakes.

1. Open the official login page yourself

   Type nabconnect.nab.com.au into the address bar, or use your own bookmark. Do not use a link from an email, text message or chat message, even one that looks like a routine bank notification. Typing the address takes five seconds and removes an entire category of risk.

2. Read the address bar before touching the form

   The domain must end in nab.com.au and the connection must be secure (the padlock icon). Slightly different addresses — nab connet, nab conect — catch people precisely because they skip this glance. If the address is wrong, close the tab. Do not "just check" by typing your details.

3. Enter your User ID

   Type your personal NAB Connect User ID. Watch for lookalike characters — zero and the letter O, one and lowercase L — and for stray spaces if you paste it from somewhere. One careful entry beats three fast ones.

4. Enter your password

   Passwords are case-sensitive. If you use a password manager, let it fill and then glance at which entry it chose — many people keep an old business password and a personal banking password side by side, and managers occasionally pick the wrong one.

5. Respond to the token prompt

   When the token code is requested, generate a fresh code on your physical token or in the app and enter it immediately. Never reuse a code from an earlier attempt, and never use a code you generated minutes ago "to save time" — expiry is the most common cause of a rejected code.

6. Wait for the workspace to load fully

   After a successful sign-in you land in your business's workspace. Let it load before clicking; the first screen usually shows your accounts and balances and any items waiting for your attention, such as payments needing authorisation.

7. Sanity-check what you see

   The organisation name, the accounts and the balances should all be recognisably yours. If anything looks wrong — accounts you do not recognise, a layout that seems off — sign out immediately and raise it through official channels. Two seconds of suspicion has saved more than one business from a very bad day.

What each element of the login screen means

The login screen is deliberately plain, but each element has a job, and misreading one of them explains a surprising share of failed sign-ins. Here is the whole screen, decoded.

A useful rule of thumb: the genuine login asks for exactly three things — User ID, password, token code. A "login" page asking for your card number, card PIN, or the password to your email account is asking for things the real process never requests at sign-in, and that alone tells you to leave.

Anatomy of a safe address bar: whatever comes before it, the address must end in the bank's real domain.

Session timeouts: why NAB Connect signs you out

Sooner or later every NAB Connect user meets the timeout: you switch to your accounting software, take a phone call, come back to the banking tab — and you are signed out, sometimes with work half-prepared. It feels like the platform is being difficult. It is actually one of its most important safety behaviours, and understanding it makes it far less annoying.

Why timeouts exist. A signed-in banking session on an unattended screen is an open door. Anyone who sits down at that computer — in an office, a shared workspace, a home with visitors — inherits everything the session can do, including preparing or authorising payments within your limits. The timeout closes that door automatically. Personal banking does the same thing for the same reason; business banking, where the amounts and the number of people with physical access to machines are both larger, treats it as non-negotiable.

How the timeout behaves. The clock is driven by inactivity, not by how long you have been signed in overall. Working actively — moving between accounts, preparing payments — keeps the session alive. Reading a long statement on screen without interacting may not. Many systems warn you shortly before the cut-off; if you see a warning, a click in the banking window is usually enough to extend the session, but do not rely on catching it. The safer habit is to treat any pause longer than a coffee break as a likely sign-out and plan accordingly.

What you lose when a session ends. Anything already submitted — payments created and saved, approvals completed — is kept; the platform records completed actions as it goes. What you can lose is an unsaved, half-built item you were in the middle of preparing. The practical defence is boring and effective: build large payment batches in your accounting system or a file first, bring them into NAB Connect in a deliberate session, and avoid leaving a half-prepared item sitting while you do something else.

Timeouts versus lockouts. These are different events that users often confuse. A timeout simply ends an idle session; you sign in again and continue. A lockout is a security response to repeated failed sign-ins, and signing in again is exactly what you cannot do until it is cleared — that path runs through your administrator or the bank, as our password reset guide explains. If the screen says your access is locked or suspended, more attempts will not help.

A session's life: activity sustains it, idleness ends it. Completed work is saved; half-built work may not be.

Logging out safely — and why closing the tab is not the same thing

The end of a banking session deserves the same care as the start. The single habit that matters: use the service's own sign out / log out control when you finish, every time, rather than simply closing the browser tab or walking away and letting the timeout handle it.

Why the button matters. Signing out tells the bank's systems to end your session immediately and completely. Closing a tab, by contrast, relies on the session expiring on its own — which it will, but not instantly — and on your browser behaving exactly as expected. On your own machine, at home, the practical difference is small. On a shared office computer, a hot-desking setup, or any machine other people use, the difference is the whole ballgame: a live session you abandoned is a session someone else can wander into.

A safe sign-off routine. Finish or deliberately abandon any half-prepared item first, so nothing of yours is left mid-flight. Then sign out using the on-screen control, wait for the confirmation or the return to the login screen, and only then close the tab. If you used a public or shared machine — avoid doing that for business banking at all, but if it happened — also close the browser completely, and never let it save your password or User ID when it offers.

The walked-away scenario. If you realise you left a session open on a machine you have left, act quickly: sign in from a device you control and sign out properly, which typically ends other active sessions, and if you cannot do that or are at all unsure, contact the bank and your administrator. It feels embarrassing; it is still much cheaper than the alternative. Administrators would rather hear about a forgotten session the same afternoon than discover it in a transaction review.

Multiple sessions and multiple people. Remember that your login is personal. If a colleague "just quickly uses" your signed-in session to check something, the audit trail will record it as you. The two minutes it takes them to sign in with their own credentials is the correct price for accountability, and it protects both of you if anything is ever questioned.

If the routine fails: match the symptom to the guide

This page is the complete login, so it is also the junction for everything that can interrupt it. Find your symptom below; each one has a dedicated guide on this site, because each one has a different cause and a different fix.

Whatever the symptom, the rule from the top of this page still applies: only ever type your credentials at nabconnect.nab.com.au. Troubleshooting done in a hurry is when lookalike pages catch people, so slow down at exactly the moment it feels least convenient.

Different computers, browsers and networks: why the same login behaves differently

Users often report that the login "works at my desk but not in the meeting room", or behaves on one browser and not another. The credentials have not changed — the environment has. Knowing the usual environmental culprits turns a mystery into a checklist.

Saved details differ per browser. Your password manager or browser may hold your current password in Chrome but a retired one in Edge, because you reset it while using the other one. If a login fails on a machine you rarely use, suspect the stored entry before suspecting yourself, and never let a browser on a shared machine save banking details when it cheerfully offers. Private or incognito windows are a useful diagnostic here: they bypass saved entries and extensions, so a login that works privately but fails normally is pointing at something stored, not something about your account.

Workplace networks can interfere. Corporate proxies, security filters and aggressive web gateways occasionally mangle banking pages or block elements the login needs. Symptoms include blank panels, buttons that do nothing, or sessions that drop instantly. The tells are that colleagues on the same network share the problem and that the same machine works fine from a home connection. This is an IT conversation, armed with specifics — which network, which browser, what exactly failed — and business banking is a legitimate reason to ask for the bank's domain to be handled properly by the filter.

Dates, times and certificates. A computer with a badly wrong clock can produce certificate warnings or session oddities, because secure connections reason about time. If several secure sites misbehave on one machine, check its date and time settings before anything else. And if the browser shows a genuine certificate warning for the bank's address, the correct response is always to stop — not to click through "for now". Clicking through warnings trains exactly the reflex that real attacks depend on.

Cookies and site data. Banking sessions rely on your browser keeping site data for the session's life. Browsers configured to discard everything on exit, or privacy tools that strip cookies mid-session, can make a healthy login look broken — most often as a loop back to the login screen. If you are caught in a loop, try a private window once (it starts clean), and if that fixes it, the everyday profile's stored site data is the story; clearing data for the bank's domain specifically is the targeted remedy.

Through all of these, the anchor from the top of this page holds: type the real address yourself, watch the domain, and let the environment be the variable you investigate — not your credentials, which repeated experimenting will only lock.

Related guides