Home / Learn / Level 1: Beginner / Lesson 10
Level 1: Beginner · Protecting What You Have
Digital payments and staying safe online
6 min read · Before you start: the bank accounts lesson · Updated 1 November 2026
Most money now moves without anyone touching a note. Cards, transfers between accounts, bill payments and app-based wallets have replaced a great deal of cash, and each carries its own costs, its own limits and its own ways of going wrong. This lesson covers how they work and where the risk sits.
The main ways money moves
- Debit card. Spends money already in the account, at the point of sale or online.
- Credit card. Borrows, with the terms described in the debt lesson. Cards also carry foreign-currency limits set by each bank.
- Online and mobile banking transfers. Between your own accounts, to another person at the same institution, or to another institution.
- Standing orders and direct debits. A standing order is an instruction you set for a fixed amount; a direct debit authorises the biller to collect a varying amount. The difference matters, because they are cancelled in different places.
- Bill payment services, in branch, online or at payment agents.
- Mobile wallets and payment apps, which sit on top of a card or account rather than replacing it.
What digital payments cost
The charges are easy to miss because they are small and frequent rather than large and occasional. Transfers to another institution commonly cost more than internal ones; some accounts include a number of free transactions each month and charge beyond it; card transactions in a foreign currency attract the issuer's conversion rate and often a separate fee, as the foreign currency lesson describes. Over a year these add up to a figure most people have never calculated. The institution's schedule of charges states each one.
Where it goes wrong
Mistyped details
A transfer sent to the wrong account number is difficult to reverse, because the funds have arrived with someone who has no obligation to return them. Banks will attempt recovery but cannot compel it. Checking the account number and the recipient name before confirming, and sending a small test amount on a first transfer to a new recipient, are the practices that prevent the problem rather than remedy it.
Card details captured
Card numbers are taken through fake payment pages, compromised merchant systems, and physical skimming devices on machines. The signs of a tampered machine include a card slot that looks added-on or sits unevenly, a keypad that feels raised, and anything obscuring the view of the keypad.
Messages that are not from your bank
A message saying an account is suspended, a transaction is suspicious, or a payment has failed, with a link to resolve it, is the most common route to a stolen password. A bank communicating about a real problem does not need you to arrive through a link in a message. Reaching the institution through the number on your card or its official website, rather than any number or link in the message, is what defeats this.
Our Scam Watch page covers these patterns in more detail, including what to do after the fact.
Practical security
- A unique password for banking, not reused from any other service, since a breach elsewhere otherwise becomes a banking problem.
- Two-factor authentication where the institution offers it, which means a stolen password alone is not enough.
- One-time codes are never shared. No legitimate staff member requires one. A caller asking for a code is the single clearest sign of fraud in progress.
- Transaction alerts enabled, so an unauthorised debit is noticed in minutes rather than at month end.
- Public wi-fi avoided for banking, or used through mobile data instead.
- The app from the official store, and the device's operating system kept updated.
If something has gone wrong
Speed changes the outcome more than anything else. The usual sequence is to contact the institution immediately through its published number, have the card or online access frozen, record the date, time and reference of every call, follow up in writing, and report the matter to the police where a crime has occurred. The Financial Intelligence Unit and the institution's own fraud process handle what follows.
Test yourself
What is the difference between a standing order and a direct debit?
Someone calls saying they are from your bank and asks you to read back the one-time code just sent to your phone. What does this indicate?
Why is a transfer sent to the wrong account number hard to recover?
Not financial advice. This lesson is general education only. See our editorial policy and disclaimer.