Online banking abroad: security checks, blocks and tips

Why does your bank ask for extra checks when you log in from abroad?

Because EU law requires banks to detect fraud. To do that, they compare each access with what is normal for you. An unusual location, a new device or unusual behaviour count as risk signals. The bank then asks for an extra confirmation or blocks access as a precaution. It protects your account, but it can be a nuisance when travelling.

The technical standards under PSD2 require payment service providers to run transaction monitoring: they must be able to detect unauthorised or fraudulent payments, taking into account what is typical of your normal use (Article 2).

If a bank wants to skip strong customer authentication for a low-risk payment, its real-time risk analysis must not have found, among other things, an abnormal location of the payer or unusual information about the payer’s device or software access (Article 18). So accessing your account from abroad can mean you have to confirm more often.

What is strong customer authentication under PSD2?

Strong customer authentication means proving it’s you with at least two independent factors: something only you know, have or are. The EU Payment Services Directive (PSD2) requires it when you access your payment account online, start an electronic payment, or do anything through a remote channel that carries a risk of fraud.

The legal basis is Article 4(30) and Article 97 of Directive (EU) 2015/2366. For your trip, that means the second factor is usually your smartphone or your phone number. If that doesn’t work abroad, you can’t get into your account, even if you know your password.

How do you get your online banking ready for a trip?

Before you leave, check that your TAN method works abroad and test logging in on the device you’re taking. Tell your bank about your trip if it offers that, and have your card enabled for use abroad if needed. Save your bank’s emergency number and the German card-blocking hotline on your phone.

1. Tell your bank: some banks let you register a trip in advance, for example in the app or through customer service. Ask whether yours does.
2. Check your card: BaFin, Germany’s financial regulator, advises checking with your bank whether you can withdraw cash with your girocard at your destination. You may need to have the card enabled for use abroad, and depending on the system it may not work outside Europe (BaFin: paying and withdrawing cash abroad, in German).
3. Test your TAN method: log in once before you leave on the device you’re taking, and install any updates to your banking and TAN apps.
4. SMS TANs and roaming: an SMS TAN only reaches you if your German number can receive texts abroad. If you swap your SIM for a local one, the text won’t arrive. A TAN app, on the other hand, needs an internet connection.
5. Have a fallback: set up a second method or device before you go, if your bank offers one.
6. Save the numbers: note your bank’s emergency number and the German card-blocking hotline (Sperr-Notruf) 116 116, or 0049 116 116 from abroad – on your phone and on paper.

Is online banking on hotel or café Wi-Fi safe?

Germany’s Federal Office for Information Security (BSI) advises against using public networks or Wi-Fi hotspots for mobile banking. If you can’t avoid it, use mobile data or a connection that encrypts all your traffic, such as a VPN. Also install banking apps only from trusted sources and keep your device up to date.

These recommendations come from the BSI’s mobile banking tips (in German). On an open Wi-Fi network you don’t know who runs it. Attackers can set up a network too and give it a trustworthy-sounding name.

• Install your banking app only from trusted sources, such as the official app store.
• Keep your operating system and apps up to date.
• Don’t open links in texts or emails that claim to be from your bank. Call the bank on a number you know.

With the Homvoya Kit, all your devices’ traffic runs encrypted through a WireGuard tunnel to your connection at home, so others on the same Wi-Fi can’t read it. If encryption is all you need, though, a reputable VPN app does that job too.

Does a home IP help avoid blocks in online banking?

It can remove one trigger: your bank sees your home connection’s IP address instead of a foreign one. But banks also look at your device, your behaviour and where you pay. So a home IP is no guarantee against security checks or blocks. And it’s no substitute for honesty: if your bank asks where you are, tell it.

Pay by card in a Lisbon restaurant and the payment happens in Portugal, whatever IP address your laptop has.

Our guide to using your home IP abroad explains how it works technically. For banking, an upload speed of 10 Mbit/s at home is usually plenty, but your internet at home has to be up and running. The compatibility checker shows whether your line is suitable.

What should you do if your card, phone or account access is lost or blocked abroad?

Have a lost or stolen card blocked straight away, for example via the German card-blocking hotline 116 116, or 0049 116 116 from abroad. If you lose the phone with your TAN app, have your SIM card and accounts blocked. If your online access is blocked, call your bank on the number you saved before the trip.

The card-blocking number comes from BaFin, the advice on lost devices from the BSI.