Two-Factor Authentication
A second factor that can't be forwarded
SMS codes can be intercepted, forwarded or SIM-swapped. Passkeys and hardware security keys can't. We're moving every customer onto one of the two, and retiring SMS as a standalone factor.
- SMS retirement
- 1 Mar 2025
- Passkey sign-in time
- ~2 seconds
- FIDO2 keys supported
- YubiKey, Titan
- Accounts on passkeys
- 71%
Options
Three ways to sign in, none of them a text message
Choose the method that fits how you bank; all three meet the same security bar and can be combined.
Passkeys
Sign in with Face ID, Touch ID or your device PIN — nothing is typed and nothing can be phished.
FIDO2 hardware keys
Register a YubiKey or Google Titan key for sign-in and for approving high-value payments.
Authenticator app codes
Time-based codes from an app such as Nordhaven Authenticator, generated offline on your device.
SMS retirement
Text-message codes stop working as a standalone second factor from 1 March 2025.
Why SMS is going
The retirement, and what replaces it
SIM-swap fraud and SS7 interception make SMS the weakest widely-used second factor. Replacing it removes an entire category of account takeover.
1 March 2025 cut-off
After this date, SMS can still receive alerts and notices, but will no longer authorise sign-in or payments on its own.
Automatic prompts to switch
Customers still using SMS as their only factor are prompted in-app and by post to add a passkey or hardware key before the cut-off.
Hardware keys for high-value approval
Payments above £10,000 and any change to recovery details can be configured to require a registered FIDO2 key specifically.
Fallback for lost devices
Losing a passkey device doesn't lock you out — a second registered method, or identity verification, restores access.
Your two-factor setup
- Passkeys registered
- iPhone, MacBook
- Hardware keys registered
- 1 — YubiKey 5C
- Authenticator app
- Not set up
- SMS fallback
- Retiring 1 Mar 2025
- High-value approval method
- Hardware key required
We recommend registering at least two independent methods so a single lost device never blocks access.
FAQs
Questions, answered plainly
Next step
Move off SMS before 1 March 2025
Add a passkey or hardware key in under two minutes — no branch visit and no new hardware required to start.