ANZ Bank to Eliminate Passwords for Digital Banking Services

Melbourne-based ANZ Bank announced plans to introduce passwordless authentication for digital banking services amid news that hackers have stolen the banking credentials of tens of thousands of Australians.

See Also: AI, Cloud, and Cyber Threats: A Financial Sector Survival Guide

The multinational banking and financial services company with over AU$1.23 trillion in asset holdings said Thursday that beginning mid-2025, it will launch passwordless authentication with its ANZ Plus Web Banking service. ANZ will be the first Australian bank to introduce the new security feature.

“By introducing this change, we’re helping prevent customer log in details from the risk of data breaches or phishing attacks – providing an extra layer of protection,” said Maile Carnegie, ANZ Group executive for Australia Retail.

ANZ’s announcement follows cybersecurity company Dvuln warning Tuesday that cybercriminals used infostealer malware to steal the banking credentials of more than 30,000 Australian internet banking users between 2021 and 2025.

The company told Newswire Australia that malicious actors traded the banking details of about 14,000 CommBank customers, 7000 ANZ customers, 5000 NAB customers and 4000 Westpac customers on Telegram and the darkweb.

“The actual number of stolen customer credentials is likely substantially higher, as many infections remain undetected or are traded in private channels outside our visibility,” Dvuln said. Stolen credentials can be used for fraudulent transactions, account takeovers and identity theft.

Dvuln also warned that traditional multi-factor authentication mechanisms may not prevent identity theft. Infostealers can capture authentication cookies to access live authenticated sessions and extract active session tokens to steal device fingerprinting data to defeat anomaly detection systems.

The multinational bank’s security offerings for customers come not long after the Australian government passed the Scams Prevention Framework in Parliament to make social media companies, banks and telecommunication companies potentially liable for consumer scam losses and subject to fines of up to AU$50 million for not taking reasonable steps to prevent, detect and disrupt scams. The law requires banks to confirm the identity of payees to make it easy for people to know where their money went (see: New Australian Law Makes Banks, Telecoms Liable for Scams).

In July 2024, Singapore’s monetary authority also announced that major retail banks will phase out auto-generated one-time passwords for bank account logins, making digital tokens the sole method for banking users to log in to their digital accounts. The authority said the move will prevent malicious actors from impersonating banks to make victims divulge their banking account usernames, passwords and one-time passwords (see: Singapore to Phase Out One-Time Passwords in Banking).

The authority added that unlike one-time passwords, scammers cannot phish for customers’ digital tokens by setting up fake bank websites, nor can they access a bank account or funds without the customer’s explicit authorization.