nab connecty — landed somewhere strange? Read this first

Why the address bar deserves a careful glance

Searches for NAB Connect come in many quick forms — shortened, run together, or with an extra letter at the end, like the "y" here (the Y key sits right next to T, so a fast finish to "connect" can brush it on the way out). In a search box, all of this is effortless — the engine figures out what you meant.

The address bar is different. Web domains are exact. One extra character produces a completely different address, owned by a completely different party — and some of those parties set out to catch visitors who are headed for the bank. Security researchers have a name for the practice: registering domains that differ from famous ones by a letter or two, and putting something profitable on them. Sometimes it's just advertising. Sometimes it's a copy of the bank's login page, built to harvest the credentials of people who don't notice the difference.

"I think I landed on a strange page." Triage, in order

Work through these honestly — the right response depends on how far things went:

1. You saw the page and closed it without typing anything

   You're almost certainly fine. Merely viewing a page doesn't hand over your banking details. Note the address if you can remember it, avoid it, and move on via the official button above.

2. You typed your User ID but stopped before the password

   Low risk on its own — a User ID alone isn't enough to access an account — but worth noting. Be extra alert for convincing follow-up phishing emails or calls "about your account" in the next few weeks.

3. You entered your password (with or without a token code)

   Treat this as a real incident. Go to the genuine site now — by typing nabconnect.nab.com.au yourself — and change your password immediately. Then contact NAB through the official number on nab.com.au or on the back of your card, explain what happened, and let them check the account. Don't delay, and don't use any contact details shown on the suspicious page itself.

4. You downloaded or installed something the page offered

   Stop using that device for banking until it's been checked. Run your security software, and if it's a work machine, tell your IT person or administrator today — businesses are expected to report these things quickly, and nobody sensible will blame you for a fast report.

How the genuine page differs from the copies

Copies are often pixel-perfect, so judging by looks alone is a trap. Judge by these instead:

• The domain is the fingerprint. Real: ends in nab.com.au. Copies add letters, hyphens, reassuring words ("secure", "verify", "login") or a different ending entirely.
• Copies rush you. Countdowns, closure threats and "verify now" banners are theatre designed to stop you checking the address.
• Copies ask for extras. The genuine login wants your User ID, password and token. Pages asking for card PINs, full card numbers or personal ID documents at the login step are collecting, not authenticating.
• Copies arrive uninvited. You reached the official login deliberately, by typing its address or using your bookmark. Lookalike pages are usually reached by following a link in a message, or by landing on an address that isn't quite the bank's.

Our sister page in this series, on "nab connectr", turns this into a short pre-login verification ritual. If you usually search the shorter form instead, see "nab connec".

Making every visit land in the right place, permanently

You can't stop your fingers brushing a neighbouring key once in a while, but you can make it inconsequential. A bookmark created while you are verifiably on the bank's login page (create it now, from the button above) replaces address-bar typing altogether. Pair it with the habit of glancing at the domain before entering your password — not before clicking, but before the password — and any detour becomes a two-second correction instead of a security incident.