List of UK banks that are “secure by default”

By Stephen Kellett
13 December, 2017

Not the usual software post today. Something about website security, because that affects everyone. In particular I’m going to talk about the security of online banks and related organisations.

This post has been updated since I first wrote it. 3 banks have been added.

Natwest Online Banking

Two days ago I became aware that National Westminster Bank Plc’s website was not secure. The bits that do the online banking are secure, but the main website, which links to the secure bit, that isn’t secure. This is important because if the non-secure bits get compromised, by a man-in-the-middle attack, or by scripts injected into the site by your ISP then that can provide a means for compromising the access to the secure part of the website.

This important because although your bank may say go to this special page to login, that isn’t how people work. People remember the easy bit (the company name, say “Natwest” in this case), go to that website and then navigate from there to get to the login page. Because of this the whole site needs to be secure.

I raised this with Natwest via twitter, whose customer support team didn’t understand the issue. Which is understandable. I chained Troy Hunt in on the discussion, as he is a well known security researcher. A few hours later this all blew up on twitter and my notifications just became a blur as lots of people effectively told Natwest they were wrong. As I write this, it is still going strong.

One respondent even produced a video showing you a simulation of how this could be done. It’s not the same because he’s modifying his own page in the browser, but it is equivalent in many respects to how a man-in-the-middle-attack would work and is useful for non technical people to understand. His video is in this tweet. Scott Helme went a step further and created a video of the secure Natwest web page loading without any security, because the security had been removed.

Troy Hunt has written up a detailed post on the technical side of this.

Is it only Natwest?

I thought it would be interesting to look at each bank in the UK to see if when you visit their company homepage, is that secure by default? That is, is the page loaded by HTTPS? There are more tests than this that you could do, but that’s the baseline. If they can’t meet that then the other tests are meaningless.

Some banks provide the website in both http and https versions. This is bad practice. If someone visits the website as http then the customer should be served the https version of the page.

Also please note, these test results are for a desktop computer visiting the website. A mobile phone may well get a different experience. In other words desktop visitors may get a secure site, but mobile visitors might not. Or vice versa.

The results list the bank name, if the home page is secure or not and the URL of the page deemed to be the home page for the test.

The following key is used for the secure status:

YesThe site is secure, loaded via https
DualThe site can be loaded via http, or via https.
InvalidThe site loads via https, but the security certificate is invalid and thus the site is insecure.
PartialThe site loads via https, but loads some parts of the page without https. The site is insecure.
NoThe site is loaded via http, not via https.
FixedThe site is loaded via https, but at the time of first writing it was loaded via http.
??We could not find a website to evaluate.

Where possible we’ve tried to identify the appropriate home page (or equivalent) for each bank. In a few occasions that wasn’t possible to do.

We tested 163 UK banks. We found 60 banks that did not have a secure home page (not https or did have https with an invalid security certificate). That is 37% of UK banks have security vulnerabilities. Since publishing this article, 6 banks have responded by fixing their security.

BankSecureHome Page
Abbey National Treasury Services PlcYes
ABC International Bank PlcYes
Access Bank UK LimitedYes
Adam & Company PlcYes
Ahli United Bank (UK) PLCNo
AIB Group (UK) PlcYes
Airdrie Savings BankYes
Al Rayan Bank PLCYes
Aldermore Bank PlcYes
Alliance Trust Savings LimitedNo
Alpha Bank London LimitedNo
ANZ Bank (Europe) LimitedYes
Arbuthnot Latham & Co LimitedNo
Atom Bank PLCYes
Axis Bank UK LimitedYes
Bank and Clients PLCNo
Bank Leumi (UK) plcNo
Bank Mandiri (Europe) LimitedNo
Bank of America Merrill Lynch International LimitedYes
Bank of BarodaYes
Bank of Beirut (UK) LtdNo
Bank of Ceylon (UK) LtdNo
Bank of China (UK) LtdNo
Bank of Communications (UK)No
Bank of Cyprus UK LimitedNo
Bank of IndiaNo
Bank of Ireland (UK) PlcInvalid
Bank of London and The Middle East plcYes
Bank of New York Mellon (International) LimitedYes
Bank of Scotland plcYes
Bank of the Philippine Islands (Europe)Yes
Bank Saderat PlcNo
Bank Sepah International PlcYes
Barclays Bank PlcYes
BFC Exchange LtdYes
BIRA Bank LtdYes
BMCE Bank International plcNo
British Arab Commercial Bank PlcYes
Brown Shipley & Co LimitedYes
C Hoare & CoYes
CAF Bank LtdYes
Cambridge & Counties Bank LimitedYes
Cater Allen LimitedYes
Charity Bank LimitedYes
Charter Court Financial Services LimitedNo
China Construction Bank (London) LimitedNo
CIBC World Markets PlcNo
ClearBank LtdYes
Close Brothers LimitedYes
Clydesdale Bank Plc CYBG plcNo
Co-operative Bank PlcDual
Coutts & CompanyYes
Credit Suisse (UK) LimitedYes
Credit Suisse International Credit SuisseYes
Crown Agents Bank LimitedNo
DB UK Bank LimitedYes
Diamond Bank (UK) PlcYes
Duncan Lawrie LimitedNo
EFG Private Bank LimitedYes
Europe Arab Bank plcYes
First DirectNo
FBN Bank (UK) LtdNo
FCE Bank PlcNo
FCMB Bank (UK) LimitedYes
Gatehouse Bank PlcNo
GE Capital Bank Limited GE CapitalNo
Ghana International Bank PlcNo
Goldman Sachs International BankNo
Guaranty Trust Bank (UK) LimitedYes
Gulf International Bank (UK) LimitedYes
Habib Bank Zurich PlcNo
Habibsons Bank LimitedNo
Hampden & Co PlcYes
Hampshire Trust Bank PlcYes
Harrods Bank LtdYes
Havin Bank LtdNo
HSBC Bank PlcYes
HSBC Private Bank (UK) LimitedYes
HSBC Trust Company (UK) Ltd??
ICBC (London) plcNo
ICBC Standard Bank PlcYes
Investec Bank PLCYes
Itau BBA International PLCYes
J.P. Morgan Europe LimitedYes
J.P. Morgan International Bank Limited??
J.P. Morgan Securities plcYes
Jordan International Bank PlcNo
Julian Hodge Bank LimitedYes
Kexim Bank (UK) LtdNo
Kingdom Bank LtdYes
Kleinwort Benson Bank LtdYes
Kookmin Bank International LimitedYes
Lloyds Bank PlcYes
Lloyds Bank Private Banking LimitedFixed
Lloyds Banking GroupNo
Macquarie Bank International LtdYes
Marks & Spencer Financial Services PlcYes
Masthaven Bank LimitedYes
Melli Bank plcNo
Methodist Chapel Aid LimitedYes
Metro Bank PLCYes
Mizuho International PlcYes
Monzo Bank LtdYes
Morgan Stanley Bank International LimitedYes
National Bank of Egypt (UK) LimitedNo
National Bank of Kuwait (International) PlcYes
National Westminster Bank PlcFixed
Natwest InternationalFixed
Nationwide Building SocietyYes
Nomura Bank International PlcNo
Northern Bank LimitedNo
Northern Trust Global Services LtdYes
OakNorth Bank LimitedYes
OneSavings Bank PlcNo
Paragon Bank PlcYes
PCF Group Holdings LtdYes
Persia International Bank PlcNo
Philippine National Bank (Europe) PlcNo
Punjab National Bank (International) LimitedYes
QIB (UK) PlcYes
R. Raphael & Sons PlcYes
Rathbone Investment Management LimitedYes
RBC Europe LimitedNo
Reliance Bank LtdNo
Royal Bank of Scotland PlcNo
Sainsbury’s Bank PlcYes
Santander UK PlcYes
Schroder & Co LtdNo
Scotiabank Europe PlcNo,,6182,00.html
Scottish Widows Bank PlcNo
Secure Trust Bank PlcYes
SG Hambros Bank LimitedYes
Shawbrook Bank LimitedYes
Smith & Williamson Investment Services LimitedNo
Sonali Bank (UK) LimitedNo
Standard Chartered BankYes
Starling Bank LimitedYes
State Bank of IndiaYes
Sumitomo Mitsui Banking Corporation Europe LimitedYes
Tandem Bank LimitedYes
TD Bank Europe LimitedYes
Tesco Personal Finance PlcNo
TSB Bank plcYes
Turkish Bank (UK) LtdYes
UBS LimitedYes
Ulster Bank LtdFixed
Union Bank of India (UK) LimitedYes
Union Bank UK PlcYes
United National Bank LimitedYes
United Trust Bank LimitedYes
Unity Trust Bank PlcYes
Vanquis Bank LimitedYes
Virgin Money plcYes
VTB Capital plcYes
Weatherbys Bank LimitedYes
Wesleyan Bank LimitedYes
Westpac Europe LtdYes
Wyelands Bank PlcYes
Zenith Bank (UK) LimitedNo

An earlier version of this post also commented on Building Societies. That data has been moved to a separate post to make examining the data easier.


From the above, we’re only commenting on the security of the home page. It’s possible that secure pages link to non-secure pages and also possible that non-secure pages link to secure pages. Either is not good. All pages in a bank should be secure. If in doubt, follow the link to the bank yourself and make your own judgement. We list the above for your information, not to endorse a particular bank or to discredit a particular bank. Although that said, you should have a serious chat with your bank if it is listed above and is not secure.

Of the banks above, Airdrie Savings Bank stands out. It is no longer in business and yet it still provides a secure website.

Axis Bank UK Limited had two websites. One had a 2014 copyright date, the other 2017. We tested the 2017 website.

Ulster Bank had multiple websites. One was secure. One was not. The non-secure website was the first listing in a Google search.

Lloyds bank is worrying. The home page was secure, but the private banking page was not secure, but had a link to the standard log in page. Not good.

The Co-operative bank provides both http and https versions of it site. Mobile users only get the http version (tested on Android). On the desktop customers can either http or https. This needs to be fixed. https only should be served to desktop and mobile visitors.

The Bank of England passes this test, but you can’t have an account there, so we haven’t included it in our test results.

If you find any mistakes, or have additional institutions you’d like me to look at, please get in touch. @softwareverify on twitter or email customer support.

Additional Reading

If you want to know more about securing your website with HTTPS and additional measures, read this excellent article on the 6 step happy path to HTTPS by Troy Hunt.

Reference list of banks.


I shouldn’t need to point this out, but i will, all the same, just to be clear.

The data provided on this page should taken at face value. If you’re not sure about something, please verify it yourself. Nothing reported here should be regarded as a criticism or an endorsement or recommendation of an organisations security effectiveness. I am simply passing comment on whether the home page (whatever that may be) is provided as https on not. Other security concerns are a separate matter.

If your organisation is listed here and is not marked as secure, your best course of action is to fix that, not to complain that someone is reporting a fact anyone with a web browser can discover. The security status of your home page is public information, albeit information that many people don’t understand.

Fully functional, free for 30 days