nab connectr — and the 20-second check that keeps login safe

The 20-second verification ritual

Security advice often fails because it's a long list nobody follows on a busy morning. So here is the whole practice compressed into four glances that take about twenty seconds in total. Do them in this order, every login, until they're automatic:

1. Read the domain right-to-left

   Start from the end of the address: .com.au, preceded by nab. Reading backwards defeats the brain's tendency to auto-complete familiar words — an address with a letter added or doubled hides it from a forward skim, but a reversed read exposes it.

2. Account for every word in front

   For the login, the full host should be nabconnect.nab.com.au. Extra words, hyphens, or a different name before the domain means someone has bolted a lookalike front onto a domain they own. If it isn't exactly right, it isn't right.

3. Confirm the padlock, then distrust it anyway

   A padlock means the connection is encrypted — worthless sites can get padlocks too. It's a necessary check, never a sufficient one. Encrypted delivery to a criminal is still delivery to a criminal.

4. Ask: how did I get here?

   Typed the address, or clicked your own bookmark? Proceed. Clicked a message link, or followed a search ad? Back out and re-enter through a route you chose deliberately.

That's it. Four glances. The ritual matters precisely on the days you're rushed, tired or annoyed at a failed login — which are exactly the days a doubled letter slips in.

Then log in, the standard way

With the domain verified, the rest is routine: your business User ID, your password (case-sensitive, entered once and carefully rather than twice and quickly), and a fresh token code from your physical token or the NAB Connect app. If the login returns an error on a page you've verified, it's a details problem, not a safety problem — work through it slowly or visit our access help page before a third attempt, so you don't talk yourself into a lockout.

A word about "connectr" and bounced keys

Doubled final letters usually come from a key registering twice, a membrane keyboard past its prime, or typing on a train. If "connectr" (or bookkeeper favourites like "paymentt" and "transferr") keeps appearing in your work, it may genuinely be the keyboard: test it in a document, and if letters double there too, a replacement keyboard is a five-minute fix for a daily annoyance. It also matters beyond convenience — the same bounce inside a password field is invisible (passwords show as dots) and produces "my password stopped working" mysteries that aren't mysteries at all.

If your searches run more to rearranged letters than added ones, the companion page for "nab conenct" covers proofreading techniques and password-manager setups for people who find standard advice doesn't stick.

If the check ever fails

Say you run the ritual and something's off: an extra word in the address, a domain you don't recognise, a page design that's close but subtly wrong. Do three things. First, close the tab — don't poke around a suspected lookalike to "confirm" what it is; curiosity is how credentials get typed. Second, re-enter deliberately: type nabconnect.nab.com.au letter by letter, or use your verified bookmark, and log in there. Third, if you'd already entered any details before noticing, change your password from the genuine site and notify the bank through its official contact channels — see the triage on our "nab connecty" page for the graded version of this advice.

No embarrassment attaches to any of this. Lookalike domains exist because smart, careful people can be rushed into an address that isn't quite the bank's. The ritual exists so that when it happens, the story ends with a closed tab.

Make it a team habit, not a solo one

If you manage or train anyone who uses NAB Connect, teach the ritual as a team standard rather than a personal tip. Rituals survive staff changes; tips don't. The businesses that rarely feature in fraud stories tend to share this trait: their verification habits are written down, taught at induction, and refreshed whenever a convincing phishing email does the rounds — which, in Australian business, is roughly every few months. Twenty seconds, four glances, everyone, every time.