NAB Connect login not working? Find the fault, then fix it

The 60-second triage: rule out the embarrassing causes first

Support teams will tell you, quietly, that a large share of "the login is broken" reports end within the first minute. Before you dig into the detailed sections below, run through these five checks. They feel obvious, and that is exactly why they get skipped at 8:55 on a payroll morning.

• Are you on the right service? NAB Connect and personal NAB internet banking are different doors with different keys. If you have typed your personal banking password into the business login — or the other way around — no amount of retrying will help.
• Are you on the right address? The address bar should show nabconnect.nab.com.au. An address typed in a hurry is the single most common cause of "the page looks wrong" and "my details are not accepted". Our pages for the versions people actually type — nab connet, nab conect and nab conenct — explain how those slips happen.
• Is Caps Lock on? Passwords are case-sensitive. User IDs usually are not the problem here; passwords are.
• Is your password manager helping or hurting? Autofill is wonderful until it fills last year's password, or your personal banking one. Clear the fields and type the password by hand once.
• Is the token code fresh? Token codes live for a short window. If you generated the code, answered the phone, then typed it in, it may already be dead. Generate a new one and use it immediately.

If all five check out and you are still locked out, the fault is real. Find the section below that matches the exact message or behaviour on your screen — the wording of the error is your best clue, so read it properly rather than clicking past it.

Work the chart: four questions that sort almost every failure

Read the chart from the top. Each question eliminates a whole family of causes, so by the bottom you are left with a short list and a specific section of this page to read. If you prefer words to pictures, the same logic follows underneath.

The chart in words: If the official page will not load properly, your problem is the address or the browser (Section 4) — credentials are irrelevant until the page itself works. If the page loads and complains about your User ID or password, you are in credentials-or-lockout territory (Sections 1 and 2). If your details are accepted but the one-time code is refused, it is a token fault (Section 3). If you can sign in but the account, payment or approval you need is missing or blocked, that is a permissions or in-session problem (Section 5). And if nothing fits, or colleagues are failing too, suspect an outage or planned maintenance (Section 6).

"Invalid User ID or password" — the most common error, decoded

This message is deliberately vague. Banks write it that way on purpose: if the page told you "the User ID is fine but the password is wrong", anyone holding a stolen User ID would know they were halfway in. So the message covers both fields, and the diagnosis work falls to you. Work through the causes in this order, because they are ordered by how often they turn out to be the answer.

Cause one: you are simply mistyping. Passwords accumulate history — most of us rotate through a handful of patterns, and under pressure the fingers type the pattern from the wrong service. Similar characters are another classic: capital I, lowercase l and the number 1 look near-identical in many fonts, as do zero and the letter O. Cause two: the details belong to a different service. Personal internet banking credentials do not work here, and neither do credentials from a previous employer's NAB Connect access. Cause three: your password was changed and you missed the memo — an administrator reset it, or you changed it on another computer and the password manager on this one still holds the old version. Cause four: the User ID itself. New staff regularly confuse their User ID with their customer number, their email address or their employee number. They are all different strings.

1. Stop and count your attempts

   Repeated failures can lock your access (see Section 2). If you have already failed twice in a row, do not keep guessing — the remaining steps matter more than speed now.

2. Type the User ID slowly, character by character

   Read it off the original source if you can — your welcome documentation or a note from your administrator — rather than from memory. Memory is where transposed digits live.

3. Clear the password field and type by hand

   Defeat the autofill. Type the password yourself, checking Caps Lock and, on laptops, that Num Lock or a function-key layer is not remapping your keys.

4. Confirm which service the password belongs to

   Ask yourself honestly: is this my NAB Connect password, or my personal banking one, or the one from my old job? If you genuinely cannot separate them, that is your answer — you need the reset path, not another guess.

5. Use the password help route rather than a fifth attempt

   Our password and access help page walks through the reset options. Where your organisation has an administrator, they are usually the fastest route; where it does not, the bank is.

Locked or suspended access: what happened, and what actually unlocks it

A lockout is the platform protecting the business's money, and it helps to understand it that way rather than as a punishment. After a small number of consecutive failed sign-in attempts, NAB Connect stops accepting further tries on that User ID. The logic is simple: a legitimate user who has forgotten a password needs a reset, while an attacker needs unlimited guesses. The lockout removes the attacker's option at the cost of your convenience.

What to do when you are locked out. First: stop. Further attempts achieve nothing and, in some configurations, extend the problem. Second: work out who owns your access. In most businesses, your NAB Connect administrator can unlock or reset your credentials during business hours, and this takes minutes when they are available — far faster than any phone queue. If your business has no active administrator (the person left, or you are a sole operator set up directly with the bank), the bank itself is the route, and you should expect identity checks before they reset anything. Third: when you do get back in, change the password to something you will actually remember or store it properly in a password manager. Lockouts repeat when the underlying cause — a forgotten, unrecorded password — is left in place.

Two lockout traps worth knowing. The first is the shared-credentials trap: if your office shares one login (it should not — see our new user setup guide), one person's guessing can lock out the whole team at the worst possible moment. The second is the helpful-colleague trap: a coworker "trying a few passwords it might be" on your account while you are away. Both traps have the same moral — the number of attempts is a shared, finite resource. Spend them like money.

Token code rejected: expired, drifted, or the wrong token entirely

Token failures feel personal because you did everything right — you typed the code the device gave you. But token systems are clocks wearing a disguise. The code is generated from a secret plus the current time, and the bank's server checks it against its own clock, allowing only a small window either side. Anything that disturbs that timing — or points you at the wrong secret — produces a rejection even though the digits were "correct".

Expired codes are the everyday case. The cure is boring: generate a fresh code and enter it immediately, in one motion, without switching tasks. If you are copying the code from the NAB Connect app on the same phone, beware the app switching delay — by the time you return to the browser, the window may have closed. Clock drift afflicts physical tokens over months and years: the device's internal clock creeps away from real time until its codes fall outside the accepted window even when entered instantly. The giveaway is a token that has become gradually less reliable — working on the second or third try, then not at all. Drift is not user-fixable; the token needs to be resynchronised or replaced, which is an administrator or bank job. Wrong-token errors happen in shared offices more than anyone admits: two similar-looking devices in a drawer, or a token from a personal banking relationship used on the business login. Tokens are bound to one user on one service. Finally, if you recently received a replacement token, the old one usually stops working the moment the new one is activated — using the old device afterwards produces exactly this error.

1. Generate a brand-new code and use it within seconds

   Do not reuse a code you can see in an old screenshot, message or note. Every attempt must use the code currently on the device.

2. Check you are holding your token, for this service

   Confirm the device or app profile matches your NAB Connect access — not a colleague's, not a personal one, not the retired one from the drawer.

3. If instant entry still fails twice, suspect drift

   Stop before you trigger a lockout on the token side as well. Record what happened ("codes fail even when entered immediately, getting worse over weeks") — that sentence is gold for whoever helps you next.

4. Escalate with the facts

   Your administrator can check the token's status; a drifted or faulty token needs resynchronisation or replacement through the bank. There is no user-side trick around a dead token, and hunting for one wastes the one resource you cannot recover: attempts.

The page will not load, looks wrong, or kicks you out

Sometimes the credentials are fine and the doorway itself is the problem. Symptoms in this family include a blank page, a page that looks subtly different from usual, a login that loops back to the start, a session that expires the moment you click anything, and forms that will not submit. Work through these causes in order.

Wrong address, again. It earns its second mention because it causes both security scares and pure technical faults: a bookmark saved years ago to an old address, a search result that led somewhere odd, or one of the classic near-miss addresses typed straight into the address bar. Our pages on stray-keystroke domains and verifying the real domain cover this in depth. The fix is always the same: close the tab, type nabconnect.nab.com.au yourself, and only proceed if that exact domain is what loads. Stale browser data. Cached scripts and old cookies can leave you interacting with a ghost of the site. A private (incognito) window is the fastest diagnostic: it starts with a clean slate, so if the login works there, your everyday browser profile is the problem and clearing the site's cookies and cache is the cure. Browser age and settings. Banking platforms drop support for old browsers and can misbehave with aggressive script blockers, some privacy extensions and cookie settings that reject session cookies outright. If your browser is years out of date, updating it is not housekeeping — it is the fix. Network interference. Office firewalls, VPNs and some security software inspect or block banking traffic. If the page works on your phone (off Wi-Fi) but not on the office network, you have found your culprit, and your IT provider owns the next step.

1. Re-type the official address in a fresh tab

   Do not trust the bookmark, the history suggestion or the search result for this test. Type nabconnect.nab.com.au in full.

2. Repeat the test in a private window

   Works there? Your stored cookies/cache are the fault. Clear them for the bank's domain and try your normal window again.

3. Disable extensions for the test

   Script blockers and some password managers can break form submission. Disable, test, re-enable one at a time if needed.

4. Change one variable: browser, device or network

   A second browser, your phone's browser, or a different network. Whichever change fixes it identifies the layer at fault — and the layer's owner.

5. Never "fix" a strange-looking page by logging in anyway

   If the page on the correct domain genuinely looks wrong after all these tests, stop. Take a screenshot, note the time, and treat it as a possible outage or security issue (Section 6) — not as a challenge to push through.

You can log in — but the account, payment or button you need is missing

Getting through the door is only half the system. NAB Connect decides what you can see and do based on the role your administrator built for you, so a successful login followed by a missing account or a greyed-out approval button is usually a permissions story, not a technical one. The classic presentations: an account you know the business holds does not appear in your list; you can create a payment but cannot authorise it (or the reverse); a colleague can see a function that simply does not exist on your screen; or a payment you are mid-way through demands another token code and refuses the one you have.

None of these are fixed by logging out and in again, although everyone tries that first. The two-person control pattern — one user creates, another authorises — means "I can't release this payment" is often the system working exactly as designed. The correct move is to identify whose role covers the missing piece. Our administrator's guide to user setup explains how roles, account access and authorisation limits are assembled, which makes these conversations with your admin much shorter: instead of "it's broken", you can say "my role has viewing access to the operating account but no authorisation limit, and today's supplier run needs releasing". Administrators fix precise requests quickly. If you are the administrator and the role looks right, check the boring sub-causes before escalating: the user may be signed in under a second User ID (it happens after resets), the account may have been closed or renumbered at the bank's end, or the payment may exceed a limit that displays no explanation. Each of those has a paper trail inside the platform's own records — look there before blaming the login.

When it really is the bank: maintenance windows and genuine outages

Sometimes the fault is on the other side of the internet. Banks perform planned maintenance on online platforms, typically in the small hours and often across weekend windows, and unplanned outages do occur. The distinguishing features of a bank-side problem: the official page itself fails to load or shows a maintenance notice; colleagues in other locations and on other networks hit the same wall; your credentials and token behave exactly as they did yesterday right up to the point the service stops responding; and the problem began suddenly rather than creeping in over weeks (creeping problems are almost always local — drift, expiry, stale access).

What to do: confirm through the bank's official channels — the service status information on the bank's main website, or the bank's official social and support channels — rather than through forums or search results, and then wait. The discipline that matters is what you do not do: do not keep attempting logins through an outage "just in case", do not follow links in emails or messages claiming the service has moved to a new address (outages are precisely when phishing campaigns strike, dressed as "emergency login" notices), and do not move business payments to a personal account as a workaround without thinking about the audit and tax trail you are creating. If a payment is genuinely time-critical — a settlement, a wages run — that is the legitimate reason to phone the bank: they can tell you the expected restoration time and discuss options with the full picture in front of them. When service resumes, sign in once, carefully, through your normal typed address or bookmark, and check that balances and any in-flight payments look as expected before resuming normal work.

When to call the bank — and how to make the call short

Escalate when: your access is locked and no administrator is available; your token appears drifted, lost or damaged; the correct page behaves strangely after browser tests; colleagues across networks are failing simultaneously; or you suspect — even slightly — that you entered details anywhere other than the genuine page. That last one is not a support call, it is an urgent security call, and it should happen before anything else on your list.

Two habits make every escalation faster. Write down the exact error wording before you call — "some error about my password" costs you ten minutes; the verbatim message costs none. And keep a one-line log as you troubleshoot: time, what you tried, what happened. Whoever picks up your problem — admin, IT provider or bank — will thank you for it, and you will stop repeating tests you have already done. More background on who holds which keys is in our security and scam safety guide and the homepage login routine.