NAB Connect security and scam safety, for the people who actually log in

How business banking scams actually work

Strip away the technical vocabulary and almost every attack on a business's banking falls into one of three patterns. Credential theft aims at your login: a lookalike page or message harvests your User ID, password and a token code, and the criminal logs in as you — often within minutes, while the code is still valid. Payment redirection aims at your money's destination: an invoice arrives with altered bank details, or a "supplier" or "executive" emails new instructions, and your own staff willingly send the payment to the wrong account through the genuine platform. Authorised-push deception aims at your judgement: a phone call from someone impersonating the bank's fraud team, talking you through "securing" your account by moving money or revealing codes. Notice what all three share: none of them defeats the bank's technology. All of them defeat a person at a busy moment. That is genuinely good news, because people can be trained, routines can be built, and the defences in this guide are things a small business can implement this week without buying anything.

It also explains why the attackers invest so heavily in plausibility: copied pages, convincing email threads that hijack real supplier conversations, phone manner coached to sound like a fraud department. The standard advice "look for obvious mistakes" is years out of date — modern scam material is polished. The reliable defences are not about spotting flaws in their work. They are about refusing the situations the scammer needs: logging in from their link, paying to unverified details, acting under time pressure. Everything below builds those refusals into habit.

Anatomy of a lookalike login page — and the 10-second address check

A lookalike login page is a visual copy of the real sign-in screen hosted on a domain the criminal controls. The page itself can look flawless. What it cannot copy is the address: the bank's login lives on the bank's domain, and everything about scam detection reduces to reading the address bar correctly. Read an address from the right: the true domain is the last two (for Australian banks, effectively three) segments before the first slash. Everything before that is a subdomain the domain owner can invent freely — which is how addresses like a familiar-bank-name-something-else are built to be misread at a glance.

1. Read the domain backwards

   Find the first slash after the address. The block immediately before it — for the genuine login, nab.com.au — is the real domain. Ignore everything earlier in the address; it is decoration the site owner controls.

2. Be suspicious of extra words and wrong endings

   "Secure", "verify", "login" or the bank's name bolted onto a different ending is the classic construction. The genuine login's whole address is short: nabconnect.nab.com.au. Scam addresses are long because they need the familiar words plus their own domain.

3. Ask how you got there

   A correct-looking address reached by typing it yourself or from your own bookmark is trustworthy. The same-looking address reached from a text message, an unexpected email or a search ad is not — how you arrived is part of the evidence.

4. Watch for pages that ask for too much

   The genuine sign-in wants your User ID, password and token code. A page asking for card numbers, a card PIN, or your full personal details at the login step is asking for harvesting material, not authentication.

5. If anything is off, close the tab — do not "test" it

   Entering a deliberately wrong password to see what happens still tells the page's owner plenty, and partial details help them. There is no safe way to poke a suspected lookalike. Close it and navigate afresh by typing the address yourself.

Lookalike domains: the scam that waits for your fingers to slip

Some criminals register domains that look almost identical to valuable addresses — a letter swapped, dropped or doubled — and wait for people to arrive by accident. For most websites the payoff is advertising revenue. For banking names, the payoff can be your credentials: the lookalike domain hosts an imitation login, and a user typing fast on a Monday morning hands over a User ID, password and fresh token code before noticing anything. People land on addresses like nab connet, nab conect and nab connecty every day, which is why this site keeps a page for each of the variants people actually arrive with. The defensive habits are unglamorous and completely effective:

• Use a bookmark you created from the genuine page for every login, so your fingers are out of the loop entirely — our bookmark guide walks through setting one up.
• Slow down for the address bar, speed up everywhere else. The two seconds spent reading the domain are the highest-value two seconds in the whole login routine.
• Never log in from search results when you can avoid it. Search ads and results can be mimicked or poisoned; your bookmark cannot.
• Treat a "wrong" page as a stop sign, not a puzzle. If the page looks different, asks for unusual information or pressures you with urgency, leave. The login will still be at its address when you type it carefully.

Businesses should also know the organisational angle: staff who are trained to expect lookalike domains stop treating every plausible page as genuine. One sentence at induction — "type the address or use the bookmark; never trust a page you reached by accident" — outperforms any poster campaign, because it gives people a mechanical rule to follow under pressure rather than an aesthetic judgement to make.

Phishing emails, imitation invoices and the phone call from "the fraud team"

The lookalike page is only the destination; phishing is how victims are delivered to it. The business variants follow reliable scripts. The login alert: an email or text claiming your access is locked, expiring or under review, with a button to "sign in and fix it" — urgency is the tell, because urgency is what stops you reading the address. The hijacked thread: a scammer inside a compromised supplier mailbox replies within a genuine invoice conversation, same signatures and tone, with one change — the bank details. This is why verification of changed details must go outside the thread entirely, to a phone number from your own records (the payments guide builds this call into the payment routine). The executive request: a message impersonating a director, marked urgent and confidential, instructing a payment and discouraging the normal checks — the secrecy is the mechanism, since the checks are exactly what would stop it. And the fraud-team call: a polished caller who knows your bank, your name and plausible details, walking you towards revealing codes or moving money "to a safe account". Banks do not maintain safe accounts for customers to flee into, and no genuine fraud officer will ask for your token codes, your password, or for you to install software or share your screen. Any of those requests ends the conversation: hang up, and call the bank yourself on the number from its official website or your card.

Build the counter-habits into your processes so they work on your worst day, not your best: no payment-detail change is ever actioned from email alone; no login ever starts from a link in a message; any request involving secrecy or a deadline measured in minutes gets slower, not faster — a ten-minute verification pause has never bankrupted a business, and its absence has bankrupted several. If your organisation runs its access properly, with named users and separated duties as our setup guide describes, a single deceived person still cannot move money alone — which is precisely the point of designing the human system to catch what individual vigilance misses.

Token safety and password hygiene: the boring controls that work

Your token is the second half of your identity on the platform, and it deserves the same physical seriousness as the key to the premises. Keep a physical token on your person or in a locked place known to you — not in the shared drawer, not taped to the monitor it protects, and never alongside a written password. Report a lost token the day it is lost, not the day you need it; your administrator can flag it and arrange a replacement, and a reported-lost token is a closed door while an unreported one is an open question. For app-based tokens, the phone's own security becomes part of the bank's: a screen lock, current software updates, and not lending the phone unlocked to others are banking controls now, whether they feel like it or not.

Passwords follow the same logic. Yours should be unique to NAB Connect — a password reused from other services means a breach anywhere becomes a breach of your banking, because credential-stuffing software tries leaked combinations automatically and at scale. Store it in a reputable password manager rather than memory-plus-variations; the variations feel clever and are the first thing guessing software tries. And internalise the platform's core rule, which no genuine process will ever ask you to break: nobody legitimate needs your password or your token codes — not the bank's staff, not your IT provider, not your administrator, not us. An administrator can reset your access without ever knowing your password. Anyone asking for the codes themselves is telling you, in plain language, who they are.

"I think I entered my details on a wrong site." Do these things, in this order

First: this happens to careful people. The pages are built by professionals to fool professionals, and the value of the next hour vastly outweighs any embarrassment. Speed converts a disaster into an incident report. Work the list in order and do not skip ahead.

1. Call the bank now, on a number you source yourself

   Use the number on the bank's official website (typed by you) or on the back of your card — never a number from the suspicious page or message. Tell them plainly: "I entered my NAB Connect credentials on a site I now believe was a lookalike, at [time]." They deal with this daily and will move immediately.

2. Have access frozen and the token dealt with

   Ask for the compromised credentials to be disabled and the token suspended or replaced. If you are an employee, tell your administrator at the same time so internal records match the bank's.

3. Reset from a known-safe device

   When the bank guides you to re-establish access, set the new password from a device you trust — not the machine that visited the lookalike page until it has been checked. If the same password was used anywhere else, change it there too, starting with your email account, which is the master key to most resets.

4. Review recent activity together

   With the bank or your administrator, scan recent logins, payments, new beneficiaries and changed details. A harvested credential is often used within the hour — or banked for a payroll day — so the review window matters.

5. Write it down while it is fresh

   The address you visited, how you got there (message, search, an address typed in a hurry), what you entered, and the times. This record serves the bank's investigation, your insurer, and your own team's learning. Our troubleshooting guide has more on what information speeds up any bank call.

If money has already moved to a wrong account — whether by credential theft or a redirected payment — the same first call applies, and every hour counts: recall processes exist, but funds are withdrawn quickly. Ask the bank explicitly what recovery steps they are taking and get a reference number for the case.

Reporting scams in Australia: the channels that exist for exactly this

Reporting is not just self-protection — the reports are how banks, regulators and police see patterns early enough to shut down lookalike domains and warn other businesses. Report through every channel that fits: your bank first, always, for anything touching your accounts. Scamwatch, run by the Australian Competition and Consumer Commission, takes reports of scams of every kind at scamwatch.gov.au and publishes the trend data that warns the next target. ReportCyber, the Australian Cyber Security Centre's portal at cyber.gov.au, is the channel for cybercrime incidents affecting your business, including compromised credentials and mailbox intrusions. If a lookalike page impersonating the bank is still live, reporting its address to the bank and through your browser's "report phishing" function helps get it taken down or blocked for the next person whose fingers slip. Inside your own business, treat the incident report as training material: the anonymised story of how a colleague was nearly caught is the most persuasive security education your team will ever receive, because it replaces "it couldn't happen here" with a story about how it nearly did.

Secure the mailbox: most payment fraud walks in through email

Ask investigators where business payment fraud begins and they will rarely say "the banking platform". They will say "the mailbox". The hijacked supplier thread, the impersonated executive, the imitation login alert — all of them live in email, and a compromised staff mailbox is worse than a noisy intruder: it lets a criminal read real invoices, learn real payment routines, and reply inside real conversations with one detail changed. Defending the bank login while leaving the mailbox on a weak, shared password is locking the safe and propping the office window open. So: every mailbox that touches payments gets a unique password and multi-factor authentication, without exception for seniority — executives' accounts are the most targeted, not the least. Be alert to the quiet signs of a compromised mailbox: rules that auto-forward or delete mail, sent items the owner does not remember, suppliers reporting replies they never received. Any of those means treat it as an incident — reset the mailbox, review its rules and recent access, and re-verify every payment instruction that arrived through it in the affected window, because instructions inside a compromised thread cannot be trusted even when they look perfect. The same standard applies to the personal email addresses used for password resets and administrator contact points. In business banking, email is not an administrative detail. It is part of the security perimeter, and it deserves to be defended like one.