The NAB Connect User ID, the small detail that blocks whole mornings

What a NAB Connect User ID actually is

Your User ID is your personal identifier inside your business's NAB Connect facility. When your access was created, the system attached a unique ID to your profile — your name, your accounts, your permissions and your limits all hang off it. Every time you sign in, the User ID tells the platform which person is claiming to be present; your password and token then prove the claim. That division of labour matters: the User ID identifies, the password and token authenticate.

Several practical consequences follow. Your User ID is yours alone — two staff members never share one, because the audit trail attributes everything done in a session to the ID that opened it. It is not chosen by you in most setups — it is issued when the profile is created, which is why it does not look like the usernames you pick for other services, and why trying variations of your name or email at the login is futile. And it is stable: passwords change, tokens get replaced, phones come and go, but the User ID typically stays with you for your whole tenure at the business. That stability is precisely why losing track of it is so disruptive — there is no routine self-service moment where it is shown to you again, so the businesses and users who fare best are the ones who recorded it properly at the start. Our first-time login guide covers that recording habit.

It is also worth knowing what your User ID is not, because the login form's first field attracts three different numbers that all feel like they might belong there. They do not — and each wrong candidate fails identically, which is why User ID confusion masquerades as a password problem. The next section separates them.

Three numbers, three jobs. Only the first belongs in the NAB Connect login's first field.

User ID vs account number vs NAB ID — the definitive separation

Your NAB Connect User ID exists only inside NAB Connect. It was created when your administrator set up your profile, it travels with your role at the business, and if you left the business it would be retired with your access. It has no meaning anywhere else in the bank. If the number or code you are holding was given to you in the context of "your login for the business banking", this is almost certainly it.

An account number identifies a bank account — a transaction account, a savings account — together with its BSB. You have several if your business has several accounts, which alone disqualifies it from being a personal login identifier. Account numbers appear on statements, invoices and payment instructions; they are closer to public information than to a credential. Typing one into the User ID field is one of the most common new-user errors, and it fails without explanation, as failed logins do.

Your NAB ID is your personal customer identifier with the bank — the number behind your personal internet banking and the app, if you bank personally with NAB. It belongs to you as an individual customer, existed before your employer's NAB Connect facility, and will outlast it. The confusion is understandable: it is also a login identifier, also issued by the same bank, and also mostly digits. But it opens the personal door, not the business one. Our complete login guide returns to this distinction because it resolves more failed sign-ins than any other single fact.

A memory aid worth keeping: accounts hold money, NAB IDs hold a person at the bank, User IDs hold a role at a business. When you sit down at the NAB Connect login, you are arriving as a role — bookkeeper, owner, approver — so the role's identifier is the one that belongs in the field.

Where to find your User ID if you have forgotten it

Forgotten User IDs are recovered from records, not from the login screen — the form will never reveal or hint at yours, by design. Work through these sources in order; most people find theirs by the second.

1. Your own onboarding records. When your access was created, the User ID reached you somehow: a welcome letter, an email from your administrator, a note in your induction pack, or a message from whoever set you up. Search your email (including archived folders) for the terms used at the time — the service's name, "User ID", "access", your administrator's name. People are frequently surprised to find the original message, unopened-looking, exactly where it landed months ago.

2. Your password manager. If you or a predecessor saved the NAB Connect login in a password manager, the User ID is usually stored as the "username" on that entry — even if you have been letting the manager fill it in and have not consciously read it in a year. This is also the moment to appreciate the system working as intended: the manager remembered precisely so that you did not have to.

3. Browser autofill history — carefully. If you previously typed the ID into the genuine login on this machine, the browser may offer it as a saved form entry when you click into the User ID field on the official login page. Use this only on the official address, and only as a memory jogger on your own computer. Never go hunting for it on any other site, and never type credentials into a page you opened for this purpose from a search result.

4. Your administrator — the authoritative source. Your NAB Connect administrator can look up the User ID attached to your profile. This is the definitive route and the one the next section builds into a full recovery sequence. Note what they cannot do: they cannot see your password (a good thing), and they should not tell you someone else's ID by mistake — confirm the ID they give relates to your profile, especially in businesses where several staff have similar names.

Records first, people second, guesses never. A User ID is recovered, not intuited.

Recovering a forgotten User ID, step by step

1. Resist the login form

   Do not experiment with candidate numbers at the login. Every wrong combination spends a failed attempt, and enough of them will lock the profile — turning an ID problem into an ID problem plus a lockout. Recovery happens away from the form.

2. Search your onboarding trail

   Email archives, induction documents, welcome letters, and any message from the person who arranged your access. Search broadly: the ID may be labelled "user", "login ID" or "access ID" in older messages.

3. Check your password manager

   Open the NAB Connect entry and read the username field. If the entry exists but is incomplete, that is still a clue — and a prompt to complete it once you are back in.

4. Ask your administrator for a lookup

   Contact whoever administers your business's NAB Connect and ask them to confirm the User ID on your profile. Expect an identity check in return; an administrator who hands IDs out casually is a security problem wearing a helpful face.

5. If there is no administrator available, go to the bank

   Where the administrator has left, is unreachable, or you are the administrator and it is your own ID that is lost, the bank can help through its official channels — expect a rigorous identity process, because from the bank's side this request is indistinguishable from a stranger fishing for access details.

6. Once recovered, record it properly this time

   Store the ID in your password manager entry alongside the password, and note who your administrator is. Then do one clean login at the official address to confirm the whole chain — ID, password, token — works, so the next problem, if any, is isolated rather than compounded.

Is it the User ID, the password, or the account? Reading failed logins

The login screen, for sound security reasons, does not tell you which element failed — a message along the lines of "invalid credentials" covers all of them, because telling attackers exactly which part was wrong would help them enormously. Unfortunately it also leaves legitimate users guessing. Use these discriminators instead.

The general principle: when in doubt, verify the ID from records before touching the password. IDs are checkable facts — someone has them written down — while password guessing is a consumable resource that ends in a lock. Work from the knowable to the guessable, never the reverse.

Administrator duties: the lookup is easy, the record-keeping is the job

If you administer NAB Connect for your business, User IDs flow through your hands constantly — at creation, at every "I've forgotten it", and at every departure. Doing this well is mostly a records discipline.

Issue IDs in writing, once, at setup. The single greatest favour you can do a new user — and your future self — is to deliver their User ID in a durable written form at the moment their profile is created: the welcome message they can search for later, not a number called across a noisy office. Half of all "lost ID" events are actually "never clearly received" events. Our first-time login guide describes what good onboarding looks like from the user's side.

Keep a register. A simple, access-controlled record of who holds which User ID, when it was issued, what role and limits attach to it, and when it was retired. When a lookup request lands, the register answers in seconds; without one, you are reconstructing from memory and inbox archaeology while someone's payroll waits. The register is also what lets you answer the auditor's favourite question — "show me everyone who can access the banking" — without breaking a sweat.

Verify identity on lookups, kindly but consistently. A User ID alone is not a master key — password and token still guard the door — but it is the first component of the credential set and should be handed out with the same care. Confirm the requester through a channel you already trust. Refuse, politely and permanently, to read IDs out to unverified callers, however senior they claim to be.

Retire IDs the day access ends. A departed employee's ID that remains active is a loaded credential waiting for its password to be guessed or phished. Same-day removal, recorded in the register, closes that door. If your business has never audited its active ID list against its current staff list, schedule it; the surprises are rarely pleasant but always cheaper found early.

The ladder works because each rung can verify the one below it.

How secret is a User ID, really?

Somewhere between a username and a password sits the User ID, and users often ask how carefully it needs guarding. The honest answer: it is an identifier, not an authenticator — knowing it alone gets nobody into anything, because password and token stand behind it. Your administrator knowing it, your password manager storing it, even it appearing in internal correspondence, are all normal and fine.

But "not a secret" is not the same as "public information". A User ID is the fixed half of your credential set, the half that never changes, and attackers assembling a picture of a business's banking access collect exactly such fixed halves. So do not publish it: not on social media, not in documents that leave the business, not in screenshots shared for "help" in forums. If you ever need remote assistance, share screen carefully and never read out the full trio — ID, password and token code — to anyone, in any combination, ever. No legitimate support process needs all three from you, because no legitimate support process logs in as you.

If you believe your User ID has been exposed alongside anything else — a password hint, a token photograph, a lost onboarding letter after you changed your password — raise it with your administrator. The remedies are straightforward when caught early, and an administrator would always rather renumber a user than investigate a transaction.

Name changes, second roles and duplicate profiles

When your name changes. Marriage, deed poll, or simply a long-standing error in how your name was recorded: the person is the same, but the profile says otherwise, and in a system built on identity that mismatch deserves tidying. Tell your administrator, who can arrange for the profile details to be corrected or, where the platform requires it, a fresh profile under the corrected name. Do not be surprised if your User ID itself does not change even when your displayed name does — IDs are plumbing, names are presentation — but make sure statements, approvals and correspondence show the right name, because the audit trail is read by humans during exactly the moments when accuracy matters.

When you hold two roles. Some people legitimately act for two businesses, or for two distinct areas of one business, and end up with two User IDs. This is not a problem to hide or merge by sharing: keep the profiles mentally and physically separate — separate password manager entries, a clear note of which ID belongs to which business, and never a shared password between them. Most cross-business login failures are simply the right password offered to the wrong facility, and they burn attempts on both profiles. If you work this way permanently, tell both administrators; they can often note the arrangement so a confused phone call does not sound like a security event.

When duplicates are discovered. Occasionally a person is created twice — once by each of two administrators, or once at setup and again after a "lost" ID that was never truly lost. Duplicate profiles split the audit trail and confuse approvals, so ask your administrator to retire the spare cleanly rather than leaving it dormant. Dormant access is precisely what periodic access reviews exist to catch; a duplicate you report yourself is housekeeping, while a duplicate an auditor finds is a finding.

Related guides