NAB Connect password reset, the right path for your situation

Three different problems all get called "password trouble"

Before you reset anything, work out which problem you actually have, because the fix for one will not cure the others — and attempting logins blindly can convert a simple problem into a harder one.

Problem one: you have forgotten your password, but the account is healthy. You know your User ID, your token works, you simply cannot recall the exact password. This is the straightforward case: a reset gives you a fresh start, and the sections below cover it.

Problem two: your access is locked. After repeated failed attempts, the system locks the user as a security measure. The password might even be one you now remember — it will not matter, because the lock sits on top of the password. Locked access needs to be cleared first, usually by your administrator or the bank, and only then does a password question even arise. More attempts against a lock achieve nothing except, in some cases, extending the problem.

Problem three: the password has expired or a reset is already pending. Passwords can age out under your business's security settings, and a previously requested reset can leave the account in a half-finished state: the old password retired, the new one never set. In this state the login may behave oddly — accepting nothing, or looping you back to change screens. The fix is to complete a clean reset rather than to keep trying combinations of old passwords.

Same symptom, three causes, three fixes. Two minutes of diagnosis saves an afternoon of wrong remedies.

The reset path for a standard user

If you are an ordinary user of your business's NAB Connect — you sign in, you prepare or approve payments, but you do not administer other people's access — your reset runs through the business's own arrangements first and the bank second. In most organisations the sequence looks like this:

1. Stop attempting logins

   Every guess risks converting "forgotten" into "locked", which is a strictly worse problem. Put the keyboard down and switch from guessing mode to process mode.

2. Check the obvious once, carefully

   Caps Lock, a keyboard layout change, a password manager filling an old entry — worth exactly one slow, deliberate check. Our complete login guide lists the common culprits. One check, not five.

3. Contact your NAB Connect administrator

   For most business users this is the actual reset path: your administrator can trigger a credential reset for your profile, or tell you the exact self-service route your business's setup uses. Know who this person is before you need them; if you do not, ask whoever arranged your original access — see our first-time login guide for how access is created.

4. Verify your identity the way your business expects

   A good administrator will confirm you are really you before resetting anything — that friction is a feature, not bureaucracy. Expect questions or a call-back on a number they already hold. Be suspicious of any "reset" process that asks you for your current password or your token codes; a reset exists precisely because you cannot provide the password, and token codes are never part of proving identity to a colleague.

5. Receive the temporary arrangement and use it immediately

   Resets typically produce a temporary password or an activation step, similar to your first login. Use it straight away, in one sitting, and replace it with your own new passphrase — the next section covers choosing one that will not land you back here.

6. Test the full chain, then update your records

   Sign out and sign back in with the new password and your token to prove everything works together. Then update your password manager entry, deleting the old one so it can never be auto-filled again.

The administrator's side: resetting someone else's access

If you administer NAB Connect for your business, password resets will find you regularly — plan on it, and treat each one as the security event it genuinely is. A reset hands a fresh way into business banking to whoever receives it, so the process around it matters as much as the clicks.

Verify before you reset. Confirm the request really comes from the user: a walk-up conversation, a call to the number you already have for them — not a reply to the same email thread that is asking, and never on the strength of a message alone. Business email compromise frequently begins with a plausible "I've locked myself out" story aimed at whoever controls resets. Thirty seconds of verification is the cheapest fraud control your business owns.

Check for the lock behind the story. Look at the user's state before resetting: if the account is locked from failed attempts, the reset and the unlock may both be needed, and the order can matter. Also ask the gentle question — why so many failed attempts? Repeated "forgotten password" events from the same user can indicate a shared-login habit, a password manager problem, or something that deserves a quiet conversation rather than another silent reset.

Deliver temporary credentials like they are cash. Because, functionally, they are. Hand them over through a channel separate from the request where you can, watch the user complete their login and set their own password, and make sure the temporary value is spent in the same session. Never send temporary credentials to a personal email address "for convenience", and never reset a password to something the user dictates to you in advance — the new password must be the user's own, set by the user, unknown to you. That separation protects the user, and it protects you if anything is ever disputed.

Record the event. Note the date, who requested the reset, how you verified them, and when the user confirmed they were back in. If your business ever has to reconstruct events — for an insurer, an auditor or the bank — this small log is gold. The businesses that handle resets well treat them with the same paperwork discipline as the payments themselves.

Know your limits. Some things sit with the bank, not with you: certain lock types, token problems tangled up with credentials, and any situation where the user's identity is in doubt. Escalating to NAB through official channels is not a failure of administration; recognising the boundary is the job.

Locked accounts: why they happen and how they clear

A lockout is the system concluding that the safest response to repeated failure is to stop listening. It is triggered by failed sign-in attempts — the exact threshold is a bank security setting, not something to probe — and it converts your problem from "remember the right password" to "get the lock cleared". Understanding that conversion is important, because everything about your behaviour should change the moment you suspect a lock.

The signs. The login tells you, in words to the effect of access being locked, suspended or requiring assistance. Believe it the first time. A lock message is not a dare, and further attempts cannot succeed — the system has stopped evaluating passwords altogether for that user.

What clears it. Only the sanctioned path: your administrator, or the bank where the administrator cannot. There is no self-service trick, no waiting-it-out shortcut you should count on, and no benefit in trying again "just in case" each hour. When you make contact, have your User ID ready (our User ID guide helps if that is also fuzzy), explain when the failures started, and follow the identity process you are given.

After the clear. A lock is often paired with a fresh password set, because the failures that caused it suggest the old one was not reliably known. Treat the whole event as a reset: new unique passphrase, password manager updated, old entries deleted, full test login completed. And reflect honestly on the cause — Caps Lock gremlins aside, most lockouts trace back to a password that lived in someone's memory instead of a manager, or to credentials shared between two services. Fix the cause and the lockout rarely repeats.

Attempts are a finite resource. The correct move after a couple of failures is to stop and use the reset path.

Password rules, and choosing one that ends the reset cycle

The system enforces its own composition rules, shown on screen as you set the new password — expect the usual family of requirements: a minimum length, a mix of character types, and rejection of your recent passwords and of embarrassingly obvious choices. Follow the on-screen guidance for the specifics. But passing the rules is the floor, not the goal. The goal is a password you will never need this guide for again.

Length beats complexity theatre. A passphrase of several unrelated words, with a number and a symbol in the mix, is stronger than a short string of substituted characters and dramatically easier to type correctly. Most "I swear I typed it right" failures are short, dense passwords dying on one swapped character. A longer phrase gives you accuracy as well as strength — and accuracy is what keeps you out of lockouts.

Unique means unique. Not your personal banking password with a digit changed; not the same passphrase you use for email with the year updated. If it exists anywhere else, it does not belong here. Credential-stuffing attacks feed on near-duplicates just as happily as exact copies.

Let a manager remember it. The reset cycle — forget, lock, reset, repeat — almost always belongs to passwords stored in human memory under workload. A password manager breaks the cycle completely: it remembers, it fills accurately, and it warns you if you are about to reuse an old entry. If your business does not use one, raising it with your administrator is a legitimate outcome of this guide. The hour spent adopting one repays itself at the very next payroll deadline.

What the password is not. It is not a shared team resource, not something to send to a colleague "so they can log in as me", and not something your administrator should ever know. If anyone else learns it — however innocently — change it. Your password is your signature in the audit trail; treat disclosures of it the way you would treat lending out a pen that signs your name.

When the reset email never arrives

Some reset flows involve an email — a confirmation, a notification to your registered address, or advice that a reset has been triggered. When that email does not appear, work through this list in order before concluding anything is broken. In our experience the cause is almost always in the first three.

1. Wait a little, once

   Mail can lag by minutes, occasionally longer under load. Give it a genuine ten minutes before escalating — and use them to do the next steps rather than refreshing theatrically.

2. Search the junk and spam folders properly

   Automated bank messages are prime false-positive material for spam filters. Search by the bank's name and by words like "reset" and "security", not just by scrolling the inbox. Check any quarantine or digest your mail system keeps — business mail gateways often hold automated messages there rather than in the visible spam folder.

3. Confirm which address the business has on file for you

   The reset goes to the address registered against your profile, which may be an old role address, a predecessor's inbox, or a shared mailbox. Your administrator can confirm the registered address. If it is wrong, the fix is to correct the profile — the email was never lost; it was delivered faithfully to the wrong place.

4. Ask whether your setup even uses email

   Many NAB Connect resets are administrator-driven and produce temporary credentials directly, not an email link. If you are waiting for a message your business's process never sends, the delay is conceptual, not technical. Ask your administrator to describe the expected next artifact: email, call, or hand-delivered details.

5. Do not click the email you went hunting for in old messages

   While searching, you may find an ancient reset or security email. Do not act on it: links in old messages are expired at best, and "we found your password email" is a classic phishing shape. Any genuine reset you use should be freshly triggered by the process you are in right now, and ideally completed starting from the official login address you typed yourself.

6. Escalate with specifics

   If the registered address is right and nothing has arrived after a real interval, tell your administrator exactly what was requested, when, and what you have checked. Specifics let them involve the bank efficiently if the problem sits deeper than your inbox.

A "missing" reset email is usually a delivered one — to a filter, a folder, or an address you no longer use.

After a successful reset: the first 24 hours

Getting back in is not the finish line. A reset changes a credential that other devices, saved entries and habits still remember the old version of, and the day after a reset is when the follow-on failures happen. Work through this short list while the reset is fresh.

Update every stored copy, deliberately. Your password manager is the one that matters most — replace the entry, do not add a second one beside it, because duplicate entries are how the wrong password gets auto-filled next month and the whole cycle restarts. Then think about the other places the old password might be lurking: a browser on a second machine that saved it independently, a phone browser you used once, a written note created during a busy week. Each stale copy is a future failed attempt with your name on it.

Expect your sessions elsewhere to end. A password change commonly signs you out of other sessions — the app may ask for the new password at next use, a desktop session at another desk may be gone when you return to it. This is the system working as designed, not a new problem. Sign back in calmly with the new credentials at each place you legitimately work, and treat any session that survived unexpectedly as worth mentioning to your administrator.

Test the token combination once more. A reset proves the password; prove the pair. Before the next real deadline, do one full login with password plus token, and if your role includes approvals, view the approvals queue so you know the whole chain — identity, password, token, permissions — survived the reset intact. If anything in that chain behaves oddly, you want to discover it on a quiet Tuesday, not during the wages run.

Notice whether resets are becoming a pattern. One reset is life. A reset every few months is a system asking for help: the password lives in memory instead of a manager, two services are sharing near-identical passwords and confusing their owner, or the keyboard at one workstation has a failing key. Name the cause honestly and fix that, because each reset-and-lockout cycle costs your business time and costs you goodwill with the administrator who clears them. If you are the administrator reading this about a user, the same applies with kindness: repeated resets are a training or tooling problem, rarely a character flaw.

Related guides